Advanced Security Testing Tool for Scheduled Tasks
TaskThief is a sophisticated security tool for active testing of scheduled tasks and cron jobs on Linux systems. It helps identify and evaluate misconfigurations in task schedulers that could lead to privilege escalation or persistent backdoors.
🔍 Discover → 🛡️ Analyze → 🧪 Test → 📊 Report
| Feature | Description |
|---|---|
| 🔍 Enhanced Discovery | Systematically detects all scheduled tasks, including hidden ones in udev rules, systemd units, and more |
| 🛡️ Configuration Analysis | Evaluates settings against security best practices to identify potential vulnerabilities |
| 🧪 Simulated Attacks | Performs controlled modifications to test for privilege escalation vectors |
| 📊 Comprehensive Reporting | Generates detailed HTML and text reports with actionable recommendations |
| 📝 Advanced Logging | Configurable logging levels with enhanced backup and restore mechanisms |
| 🔐 Smart Privilege Handling | Intelligently manages root access requirements for operations |
| 🧩 Modular Architecture | Easily extensible with additional modules for other schedulers |
| ⌨️ CLI Support | Run specific operations directly from the command line |
- Bash 4.0 or higher
- Linux operating system
- Root privileges for full functionality (can be provided via sudo)
# Clone the repository
git clone https://github.com/reschjonas/TaskThief.git
# Navigate to the directory
cd TaskThief
# Make the script executable
chmod +x taskthief.sh
# Run TaskThief
./taskthief.sh🔍 Automatic Discovery [Requires Root]
• Identifies cron jobs, systemd timers, AT jobs, and anacron jobs
• Discovers hidden scheduled tasks like udev rules, startup scripts, and more
• Gathers detailed information about each scheduled task
🛡️ Configuration Analysis [Requires Root]
• Analyzes cron jobs and systemd timers for security issues
• Checks for permission problems in configuration files
• Identifies weak configurations that could be exploited
🧪 Task Manipulation [Requires Root]
• Tests cron job hijacking by attempting controlled modifications
• Tests systemd timer manipulation to identify privilege escalation vectors
• Demonstrates how an attacker might create persistent backdoors
📊 Reporting
• Generates comprehensive HTML or text reports
• Provides detailed findings and recommendations
• Exports results for documentation purposes
./taskthief.sh [OPTION]| Option | Description |
|---|---|
-h, --help |
Display help message |
-v, --version |
Display version information |
-d, --discover |
Run full discovery immediately |
-a, --analyze |
Run full analysis immediately |
-r, --report |
Generate a full report immediately |
TaskThief automatically detects when root privileges are required and offers options to:
- Continue without root privileges (limited functionality)
- Restart with sudo to gain full functionality
- Exit the application
For critical operations that require root access, TaskThief will prompt you to elevate privileges when needed.
| Level | Description |
|---|---|
DEBUG |
Most verbose, logs all operations |
INFO |
Standard information (default) |
WARNING |
Only logs warnings and errors |
ERROR |
Only logs errors |
NONE |
Disables logging |
Configure logging in the Settings menu or by editing the config file.
TaskThief is designed for legitimate security testing and educational purposes. When using this tool:
- ✅ Always ensure you have proper authorization to test the target systems
- ✅ Use in a controlled environment when possible
- ✅ Backup important files before running manipulation tests
- ✅ Review all findings and manipulations carefully
The tool performs active testing that modifies system files to demonstrate vulnerabilities. You should use this tool cautiously and only on systems you are authorized to test.
This project is licensed under the MIT License - see the LICENSE.md file for details.
Developed as a penetration testing tool for identifying vulnerabilities in scheduled task systems.