终端安全系列-计划任务详解

# 指定XML文件路径
$xmlFilePath = "C:\Path\to\your\Task.xml"

# 创建XmlDocument对象并加载XML文件
$xmlDocument = New-Object System.Xml.XmlDocument
$xmlDocument.Load($xmlFilePath)

# 创建XML命名空间管理器
$nsManager = New-Object System.Xml.XmlNamespaceManager($xmlDocument.NameTable)
$nsManager.AddNamespace("ns", $xmlDocument.DocumentElement.NamespaceURI)

# 获取根节点
$rootNode = $xmlDocument.DocumentElement

# 获取子节点的值
$taskVersion = $rootNode.GetAttribute("version")
$namespace = $rootNode.NamespaceURI

# 获取RegistrationInfo节点的子节点值
$registrationInfoNode = $rootNode.SelectSingleNode("//ns:RegistrationInfo", $nsManager)
if ($registrationInfoNode -ne $null) {
    $date = $registrationInfoNode.SelectSingleNode("ns:Date", $nsManager).InnerText
    $author = $registrationInfoNode.SelectSingleNode("ns:Author", $nsManager).InnerText
}

# 获取Triggers节点下的TimeTrigger子节点值
$triggersNode = $rootNode.SelectSingleNode("//ns:Triggers", $nsManager)
if ($triggersNode -ne $null) {
    $timeTriggerNode = $triggersNode.SelectSingleNode("//ns:TimeTrigger", $nsManager)
    if ($timeTriggerNode -ne $null) {
        $startBoundary = $timeTriggerNode.SelectSingleNode("ns:StartBoundary", $nsManager).InnerText
        $isEnabled = $timeTriggerNode.SelectSingleNode("ns:Enabled", $nsManager).InnerText
    }
}

# 获取Actions节点下的Exec子节点值
$actionsNode = $rootNode.SelectSingleNode("//ns:Actions", $nsManager)
if ($actionsNode -ne $null) {
    $execNode = $actionsNode.SelectSingleNode("//ns:Exec", $nsManager)
    if ($execNode -ne $null) {
        $command = $execNode.SelectSingleNode("ns:Command", $nsManager).InnerText
    }
}

# 输出解析的结果
Write-Host "任务版本：$taskVersion"
Write-Host "XML命名空间：$namespace"
Write-Host "注册日期：$date"
Write-Host "作者：$author"
Write-Host "启动边界：$startBoundary"
Write-Host "触发器是否启用：$isEnabled"
Write-Host "执行命令：$command"

schtasks /Create /TN "MyTask" /TR "C:\MyScript.bat" /SC DAILY /ST 09:00

Register-ScheduledTask -TaskName "MyTask" -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute "C:\MyScript.ps1") 

# 创建计划任务的触发器
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 3) -RepetitionDuration (New-TimeSpan -Days 1)
# 重复持续时间设置为 1 天
# 创建计划任务的操作
$action = New-ScheduledTaskAction -Execute "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Argument "-file C:\Users\shi001admin\Desktop\test.ps1"
# 创建计划任务对象
$task = New-ScheduledTask -Action $action -Trigger $trigger
# 注册计划任务并指定任务名称
Register-ScheduledTask -TaskName "MyTask" -InputObject $task

# 创建计划任务的操作
$action = New-Object -ComObject "Schedule.Service" -Property @{
    "ActionType" = 0     # 0 表示运行程序，其他类型可参考相关文档
    "Id" = 1             # 操作的 ID，可以设置为 1
    "Path" = "C:\MyScript.ps1"   # 要执行的脚本路径
}
# 创建计划任务的触发器
$trigger = New-Object -ComObject "Schedule.Service" -Property @{
    "TriggerType" = 1     # 1 表示登录时触发，其他类型可参考相关文档
}
# 获取计划任务服务
$service = New-Object -ComObject "Schedule.Service"
$service.Connect()
# 创建计划任务对象
$rootFolder = $service.GetFolder("\")
$taskDefinition = $service.NewTask(0)
$taskDefinition.RegistrationInfo.Description = "My Task Description"
$taskDefinition.Settings.Enabled = $true
$taskDefinition.Settings.Hidden = $false
$trigger = $taskDefinition.Triggers.Create(1)  # 1 表示登录时触发，其他类型可参考相关文档
$trigger.Id = "Trigger1"
$trigger.StartBoundary = (Get-Date).AddMinutes(1).ToString("yyyy-MM-ddTHH:mm:ss")
$trigger.Enabled = $true
$action = $taskDefinition.Actions.Create(0)  # 0 表示运行程序，其他类型可参考相关文档
$action.Id = "Action1"
$action.Path = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
$action.Arguments = "-ExecutionPolicy Bypass -File C:\MyScript.ps1"
$rootFolder.RegisterTaskDefinition("MyTask", $taskDefinition, 6, $null, $null, 3)  # 6 表示 "TaskScheduler" 设置
# 运行计划任务
$task = $rootFolder.GetTask("MyTask")
$task.Run("")

using System;
using Microsoft.Win32.TaskScheduler;

class Program
{
    static void Main()
    {
        string taskName = "MyTask";
        string command = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
        string arguments = "-ExecutionPolicy Bypass -File C:\\MyScript.ps1";
        DateTime startTime = DateTime.Now.AddMinutes(1);
        bool runRepeatedly = true;

        using (TaskService taskService = new TaskService())
        {
            TaskDefinition taskDefinition = taskService.NewTask();

            // 设置计划任务的基本属性
            taskDefinition.RegistrationInfo.Description = "My Task Description";
            taskDefinition.Settings.AllowDemandStart = true;
            taskDefinition.Settings.DisallowStartIfOnBatteries = false;
            taskDefinition.Settings.StopIfGoingOnBatteries = false;

            // 设置触发器，这里使用时间触发器，表示在 startTime 后重复执行
            TimeTrigger trigger = new TimeTrigger(startTime);
            trigger.Repetition.Interval = TimeSpan.FromMinutes(3); // 每3分钟重复执行

            // 设置重复执行的持续时间，例如设置为2天
            trigger.Repetition.Duration = TimeSpan.FromDays(2);

            taskDefinition.Triggers.Add(trigger);

            // 设置执行操作，这里是调用 PowerShell 脚本
            ExecAction action = new ExecAction(command, arguments);
            taskDefinition.Actions.Add(action);

            // 注册计划任务
            taskService.RootFolder.RegisterTaskDefinition(taskName, taskDefinition);

            Console.WriteLine("Task created successfully.");
        }
    }
}

using System;
using System.Management;

class Program
{
    static void Main()
    {
        string taskName = "MyTask";
        string command = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
        string arguments = "-ExecutionPolicy Bypass -File C:\\MyScript.ps1";
        DateTime startTime = DateTime.Now.AddMinutes(1);
        bool runRepeatedly = true;

        string xml = $@"
            <Task xmlns='http://schemas.microsoft.com/windows/2004/02/mit/task'>
                <RegistrationInfo>
                    <Description>My Task Description</Description>
                </RegistrationInfo>
                <Triggers>
                    <TimeTrigger>
                        <StartBoundary>{startTime:s}</StartBoundary>
                        <Repetition>
                            <Interval>PT3M</Interval>
                            <Duration>PT1H</Duration>
                        </Repetition>
                    </TimeTrigger>
                </Triggers>
                <Settings>
                    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
                    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
                    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
                </Settings>
                <Actions>
                    <Exec>
                        <Command>{command}</Command>
                        <Arguments>{arguments}</Arguments>
                    </Exec>
                </Actions>
            </Task>
        ";

        using (ManagementClass taskClass = new ManagementClass(@"root\cimv2", "Win32_ScheduledJob", null))
        {
            ManagementBaseObject inParams = taskClass.GetMethodParameters("Create");
            inParams["JobData"] = xml;

            ManagementBaseObject outParams = taskClass.InvokeMethod("Create", inParams, null);
            int returnValue = Convert.ToInt32(outParams["ReturnValue"]);

            if (returnValue == 0)
            {
                Console.WriteLine("Task created successfully.");
            }
            else
            {
                Console.WriteLine("Failed to create task. Error code: " + returnValue);
            }
        }
    }
}

using System;
using System.Runtime.InteropServices;

class Program
{
    private const int ERROR_SUCCESS = 0;
    private const string TaskFolder = "\\MyTasks\\"; // The folder in which the task will be created

    [DllImport("taskschd.dll", CharSet = CharSet.Unicode, SetLastError = true)]
    private static extern int TaskCreate(
        string pwszTaskName,
        ref Guid rclsid,
        ref Guid riid,
        [MarshalAs(UnmanagedType.Interface)] out ITask pUnk);

    [ComImport]
    [Guid("148BD520-A2AB-11CE-B11F-00AA00530503")]
    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
    private interface ITask
    {
        void SetApplicationName([MarshalAs(UnmanagedType.LPWStr)] string pwszApplicationName);
        void SetParameters([MarshalAs(UnmanagedType.LPWStr)] string pwszParameters);
        void SetWorkingDirectory([MarshalAs(UnmanagedType.LPWStr)] string pwszWorkingDirectory);
        void SetFlags(uint dwFlags);
        void SetAccountInformation([MarshalAs(UnmanagedType.LPWStr)] string pwszAccountName, IntPtr pwszPassword);
        void SetCreator([MarshalAs(UnmanagedType.LPWStr)] string pwszCreatorName);
        void SetComment([MarshalAs(UnmanagedType.LPWStr)] string pwszComment);
        void SetTrigger(IntPtr pTrigger);
        void SetErrorRetryInterval(uint dwErrorRetryInterval);
        void SetErrorRetryCount(uint dwErrorRetryCount);
    }

    static void Main()
    {
        string taskName = "MyTask";
        string command = "C:\\Windows\\System32\\calc.exe";
        string arguments = "";

        Guid clsidTaskScheduler = new Guid("{148BD524-A2AB-11CE-B11F-00AA00530503}");
        Guid iidITaskScheduler = new Guid("{148BD520-A2AB-11CE-B11F-00AA00530503}");

        ITask task;
        int result = TaskCreate(taskName, ref clsidTaskScheduler, ref iidITaskScheduler, out task);

        if (result == ERROR_SUCCESS)
        {
            // Set the task properties
            task.SetApplicationName(command);
            task.SetParameters(arguments);
            task.SetWorkingDirectory("C:\\Windows\\System32");
            task.SetFlags(0); // 0 means run with default settings
            task.SetAccountInformation(null, IntPtr.Zero); // Run with the user's credentials
            task.SetCreator("MyTaskCreator");
            task.SetComment("My Task Description");

            // Set the trigger (e.g., run every day at a specific time)
            // ...

            // Save the task
            // ...

            Console.WriteLine("Task created successfully.");
        }
        else
        {
            Console.WriteLine("Failed to create task. Error code: " + result);
        }
    }
}