search

lu4p / ToRat_client

This is the ToRat client, a part of the ToRat Project.
https://github.com/lu4p/ToRat
The Unlicense
26 stars 11 forks source link

Stealthy Scheduled Task Creation #13

Open capnspacehook opened 5 years ago

capnspacehook commented 5 years ago

I saw that you are calling the schdtask binary to establish persistence, and while that's totally fine, given your concern for opsec in other parts of the code, I'm assuming you would like to avoid calling external binaries as much as possible.

I recently wrote a Task Scheduler library in Go that allows you to create, modify, delete, run etc scheduled tasks in Windows using COM objects, so no commandline logging will be done. Just thought I'd let you know about it because it's an easy improvement :)

lu4p commented 5 years ago

Nice would you like to submit a pull request?

lu4p commented 5 years ago

If you dont want to compile tor you can easily test using the notor tag.

cd ~/go/src/github.com/lu4p/ToRat_client

env GOOS=windows go build -ldflags "-s -w" -tags "notor"

capnspacehook commented 5 years ago

I actually haven't implemented creating tasks from an XML file, that's one of the last things I need to do. Once I implement that I'll let you know.

lu4p commented 5 years ago

The only essential thing is that it is started at logon.

lu4p commented 5 years ago

@capnspacehook How is the current state can a onlogon trigger be used?