T06 · System Persistence
Error
- Location
SKILL.md:33- Finding
Persistent Health Server Registered with Unnecessary Elevated Privileges
- Content
View full analysis
" $trigger = New-ScheduledTaskTrigger -AtLogon Register-ScheduledTask -TaskName "HealthSyncServer" -Action $action -Trigger $trigger -RunLevel Highest -Force Start-ScheduledTask -TaskName "HealthSyncServer" ``` ```xml ProgramArguments python3server.py WorkingDirectoryHEALTH_SYNC_DIR RunAtLoad KeepAlive ``` ```bash launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist ``` ### Technical Analysis The Skill instructs the Agent to register the generated server as a Windows scheduled task or macOS LaunchAgent. Both mechanisms survive the Skill execution and future Agent sessions. Continuous background operation is relevant to the declared real-time synchronization functionality. However, the Windows task uses `-RunLevel Highest`, even though a Flask server listening on an unprivileged port and writing to the user's project directory does not require administrative execution. This exceeds the minimum privileges necessary. The service runs `server.py` using relative executable and script references. If the script, working directory, or resolved Python executable is replaced or compromised, attacker-controlled code will execute automatically at subsequent logons. On Windows, it may execute with the task's elevated privileges. ### Attack Path 1. The user or Agent follows the setup instructions. 2. A scheduled task or LaunchAgent is installed and configured to run at logon and remain active. 3. An attacker gains write access to `server.py`, its working directory, or a dependency ...[truncated 647 chars]- Remediation
View remediation