T06 · System Persistence
Error
- Location
scripts/apply.js:47- Finding
Scheduled Task Persistence Without Cleanup
- Content
View full analysis
等 2s -> node apply.js --install） function runSchedule() { const skillDir = path.dirname(__dirname); const tmpDir = path.join(process.env.TEMP || os.tmpdir(), 'wb-dream-skin'); fs.mkdirSync(tmpDir, { recursive: true }); const ps1 = path.join(tmpDir, 'kill-restart.ps1'); const js = path.join(__dirname, 'apply.js'); const node = process.execPath; const ps = [ '$ErrorActionPreference="SilentlyContinue"', `Get-CimInstance Win32_Process -Filter "Name='WorkBuddy.exe'" | Where-Object { $_.CommandLine -notmatch '--type=' -and $_.CommandLine -notmatch 'codebuddy' -and $_.CommandLine -notmatch 'app.asar.main' -and $_.CommandLine -notmatch '--require' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }`, 'Start-Sleep -Seconds 2', `& '${node}' '${js}' --install`, ].join('\n'); fs.writeFileSync(ps1, ps, 'utf8'); log(skillDir, `wrote temp ps1: ${ps1}`); const taskName = 'ApplyWorkBuddySkin'; const next = new Date(Date.now() + 60 * 1000); const t = next.toTimeString().slice(0, 8); const tr = `powershell.exe -NoProfile -ExecutionPolicy Bypass -File ${ps1}`; log(skillDir, 'scheduling detached install+restart task'); execFile('schtasks', ['/delete', '/tn', taskName, '/F'], { windowsHide: true }, () => { execFile('schtasks', ['/create', '/tn', taskName, '/tr', tr, '/sc', 'once', '/st', t, '/F'], { windowsHide: true }, (err, stdout, stderr) => { if (stdout) log(skillDir, `schedule stdout: ${stdout.trim()}`); if (stderr) log(skillDir, `schedule stderr: ${stderr.trim()}`); if (err) log(skillDir, `schedule error: ${err.message}`); else log(skillDir, `scheduled install task at ${t}`); }); }); } ``` ### Technical Analysis The Skill creates a Wind ...[truncated 2045 chars]- Remediation
View remediation