MENU
[Tools and Code Analysis]
During an assessment, a penetration tester gains access to one of the internal hosts. Given the following command:
schtasks /create /sc onlogon /tn "Windows Update" /tr "cmd.exe /c reverse_shell.exe"
Which of the following is the penetration tester trying to do with this code?
The command creates a scheduled task that executes a reverse shell payload at logon, ensuring persistence.
Option A (Enumerate tasks) : This command creates a task, not lists tasks (schtasks /query is used for enumeration).
Option B (Establish persistence) : Correct.
The attacker ensures a reverse shell opens every time a user logs in.
Option C (Deactivate Windows Update) : The task is named 'Windows Update' but does not disable updates.
Option D (Create a Windows Update binary) : This executes a reverse shell, not a system update.
Reference: CompTIA PenTest+ PT0-003 Official Guide -- Windows Persistence Techniques