> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/scheduled-tasks.md).

# Windows 计划任务

当自动化以特权账户运行，但执行的是低权限用户可修改的文件、脚本或命令路径时，计划任务是很有用的提权目标。

## 枚举

先从内置的任务计划程序输出开始：

```cmd
schtasks /query /fo LIST /v
```

PowerShell 让检查任务操作更容易：

```powershell
Get-ScheduledTask |
  ForEach-Object {
    [PSCustomObject]@{
      TaskName = $_.TaskName
      TaskPath = $_.TaskPath
      State = $_.State
      Author = $_.Author
      Actions = ($_.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
    }
  }
```

## 什么样的任务值得关注

留意以下类型的任务：

* 该任务以 `SYSTEM`管理员或服务账户身份运行。
* 该操作指向受保护的 Windows 路径之外的脚本或可执行文件。
* 目标文件或其任一父目录可写。
* 参数中包含凭据、网络路径、令牌或 API 密钥。
* 该任务可以手动触发、运行频繁，或会在用户登录时运行。

## 检查目标路径

在识别出任务使用的可执行文件或脚本后，检查其权限。

```cmd
icacls "C:\Path\To\task-script.ps1"
icacls "C:\Path\To"
```

```powershell
Get-Acl "C:\Path\To\task-script.ps1" | Format-List
```

诸如以下的可写组： `Users`, `已验证用户`，或 `所有人` 在任务以提升权限运行时会很可疑。

## 安全验证

先使用一个无害的标记，以便在不破坏计划工作流的情况下证明执行上下文。

```powershell
'whoami > C:\Windows\Temp\task-check.txt' | Out-File -Encoding ASCII C:\Path\To\task-script.ps1
```

如果你的用户有权限，就触发该任务：

```cmd
schtasks /run /tn "\Task\Name"
type C:\Windows\Temp\task-check.txt
```

如果你无法手动触发它，请记下下次运行时间：

```cmd
schtasks /query /tn "\Task\Name" /fo LIST /v
```

## 凭据线索

任务可能通过命令参数或映射的网络路径泄露秘密。

```cmd
schtasks /query /fo LIST /v | findstr /i "password user runas /ru /rp \\\\"
```

```powershell
Get-ScheduledTask |
  Select-Object -ExpandProperty Actions |
  Select-String -Pattern 'password|passwd|pwd|token|secret|\\\\'
```

## 清理

测试后恢复原始目标文件并删除临时标记。

```cmd
del C:\Windows\Temp\task-check.txt
```

## 关键要点

* 任务账户和目标权限比任务名称更重要。
* 通常，验证一个可写脚本比替换二进制文件更干净。
* 记录证据：任务名称、以哪个账户运行、操作路径、ACL 输出，以及触发条件。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/scheduled-tasks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.