ATExec / SchTaskExec

Administrator rights on the target machine are mandatory.

SchTasks is short for Scheduled Tasks and operates initially on port 135, then continues communication on an ephemeral port, using DCE/RPC for communication. Similar to creating a cron job in Linux, you can schedule a task to occur and execute whatever action you desire.

UNIX

# Executes a command on the target machine via the Task Scheduler service and returns the output of the executed command.
atexec.py domain/user:password@IP <command>

Windows

References

Page not found - HackTricksbook.hacktricks.xyz