While writing material for the Blackhat training course that Andrew Case and I gave this summer, I realized that there did not appear to be many tools that would parse job files. At that time, Harlan Carvey had written a blogpost on job files and had mentioned them in part of his timeline materials, but he had not yet released his Perl script (It has since been released here). This prompted me to write up a parser of my own in Python.
.job files consist of two sections: 1) Fixed Length and 2) Variable Length. The MSDN documentation is fairly good for letting us know how to parse out these sections.
So what does a .job file look like?
$ xxd At5.job 0000000: 0006 0100 e378 73f7 4d8b 2a45 a589 1cc5 .....xs.M.*E.... 0000010: fa64 cfd2 4600 cc00 0000 0000 3c00 0a00 .d..F.......<... 0000020: 2000 0000 0014 730f 0000 0000 0513 0400 .....s......... 0000030: 0200 e421 dc07 0700 0100 1000 0b00 1a00 ...!............ 0000040: 0000 0f00 0000 0400 6300 6d00 6400 0000 ........c.m.d... 0000050: 0f00 2f00 6300 2000 6e00 6f00 7400 6500 ../.c. .n.o.t.e. 0000060: 7000 6100 6400 2e00 6500 7800 6500 0000 p.a.d...e.x.e... 0000070: 0000 0700 5300 5900 5300 5400 4500 4d00 ....S.Y.S.T.E.M. 0000080: 0000 1e00 4300 7200 6500 6100 7400 6500 ....C.r.e.a.t.e. 0000090: 6400 2000 6200 7900 2000 4e00 6500 7400 d. .b.y. .N.e.t. 00000a0: 5300 6300 6800 6500 6400 7500 6c00 6500 S.c.h.e.d.u.l.e. 00000b0: 4a00 6f00 6200 4100 6400 6400 2e00 0000 J.o.b.A.d.d..... 00000c0: 0000 0800 0000 0000 0000 0000 0100 3000 ..............0. 00000d0: 0000 dc07 0700 1000 0000 0000 0000 0b00 ................ 00000e0: 1a00 0000 0000 0000 0000 0000 0000 0000 ................ 00000f0: 0000 feff ffff fd68 7377 0000 0000 0100 .......hsw...... 0000100: 0100 0416 10dd 78d9 b300 f7f0 9b20 9bd8 ......x...... .. 0000110: a0c4 5108 c943 d5c9 c64f 47ea 6052 0349 ..Q..C...OG.`R.I 0000120: 23e1 e1ab 6815 e8ef 219e 6d3b aa88 1360 #...h...!.m;...` 0000130: 706b c27b 2e44 9db1 4e89 81ca dd0a 869e pk.{.D..N....... 0000140: 2b61 .6..
We can see the first section of the job file below:
0000000: 0006 0100 e378 73f7 4d8b 2a45 a589 1cc5 .....xs.M.*E.... 0000010: fa64 cfd2 4600 cc00 0000 0000 3c00 0a00 .d..F.......<... 0000020: 2000 0000 0014 730f 0000 0000 0513 0400 .....s......... 0000030: 0200 e421 dc07 0700 0100 1000 0b00 1a00 ...!............ 0000040: 0000 0f00 ....
The fixed length section is pretty straightforward (I will only fill in a few):
0-2 : Product Info (0x600 - Vista)
2-4 : File Version (0x1)
4-20 : UUID ({F77378E3-8B4D-452A-A589-1CC5FA64CFD2})
20-22: Application Name Offset (0x46)
22-24: Trigger Offset (0xcc)
24-26: Error Retry Count (0x00)
26-28: Error Retry Interval (0x00)
28-30: Idle Deadline (0x3c)
30-32: Idle Wait (0xa)
32-36: Priority
36-40: Maximum Runtime
40-44: Exit Code (0x0)
44-48: Status (0x41305)
48-52: Flags
52-68: Run Date (Monday Jul 16 11:26:00.15 2012)
The variable length section actually contains sizes (denoted in red below) before some of the data members mentioned in the MSDN documentation:
0000 0400 6300 6d00 6400 0000 ...c.m.d... 0000050: 0f00 2f00 6300 2000 6e00 6f00 7400 6500 ../.c. .n.o.t.e. 0000060: 7000 6100 6400 2e00 6500 7800 6500 0000 p.a.d...e.x.e... 0000070: 0000 0700 5300 5900 5300 5400 4500 4d00 ....S.Y.S.T.E.M. 0000080: 0000 1e00 4300 7200 6500 6100 7400 6500 ....C.r.e.a.t.e. 0000090: 6400 2000 6200 7900 2000 4e00 6500 7400 d. .b.y. .N.e.t. 00000a0: 5300 6300 6800 6500 6400 7500 6c00 6500 S.c.h.e.d.u.l.e. 00000b0: 4a00 6f00 6200 4100 6400 6400 2e00 0000 J.o.b.A.d.d..... 00000c0: 0000 0800 0000 0000 0000 0000 0100 3000 ..............0. 00000d0: 0000 dc07 0700 1000 0000 0000 0000 0b00 ................ 00000e0: 1a00 0000 0000 0000 0000 0000 0000 0000 ................ 00000f0: 0000 feff ffff fd68 7377 0000 0000 0100 .......hsw...... 0000100: 0100 0416 10dd 78d9 b300 f7f0 9b20 9bd8 ......x...... .. 0000110: a0c4 5108 c943 d5c9 c64f 47ea 6052 0349 ..Q..C...OG.`R.I 0000120: 23e1 e1ab 6815 e8ef 219e 6d3b aa88 1360 #...h...!.m;...` 0000130: 706b c27b 2e44 9db1 4e89 81ca dd0a 869e pk.{.D..N....... 0000140: 2b61 .6..
Going over some of the data above we have:
Running instance count
Command Name Length (0x4 - includes ending '\x00')
Command Name (cmd )
Parameter length (0xf)
Parameter (/c notepad.exe )
Working Directory Length (0x0)
Working Directory (if Working Directory Length > 0)
User Name Length (0x7)
User Name (SYSTEM)
Comment Length (0x1e)
Comment (if Comment length > 0 - Created by NetScheduleJobAdd. )
User Data / Reserved data
Trigger count
Triggers
- Scheduled date (Jul 16 11:26:00.0 2012)
Job Signature
So I am releasing a job file parser script that can parse out almost all of these items mentioned above. You can find it here. The only things left off are the user/reserved data, some of the trigger data and the job signature sections. I have only tested this on 32 bit *nix systems, so let me know if you hit issues on another platforms. You can see an example output of the above job file below:
$ python jobparser.py -f At5.job Product Info: Windows Vista File Version: 1 UUID: {F77378E3-8B4D-452A-A589-1CC5FA64CFD2} Maximum Run Time: 72:00:00.0 (HH:MM:SS.MS) Exit Code: 0 Status: Properties not set Flags: TASK_FLAG_DONT_START_IF_ON_BATTERIES Date Run: Monday Jul 16 11:26:00.15 2012 Running Instances: 0 Application: cmd Parameters: /c notepad.exe Working Directory: Working Directory not set User: SYSTEM Comment: Created by NetScheduleJobAdd. Scheduled Date: Jul 16 11:26:00.0 2012
Here is some output of job files taken from a Windows 2008 machine:
$ python jobparser.py -d Tasks/ ************************************************************************ File: Tasks/At1.job Product Info: Windows Vista File Version: 1 UUID: {CE14B659-4115-4263-BFAD-A8318428AB68} Maximum Run Time: 72:00:00.0 (HH:MM:SS.MS) Exit Code: 0 Status: Properties not set Flags: TASK_FLAG_DONT_START_IF_ON_BATTERIES Date Run: Task not yet run Running Instances: 0 Application: notepad.exe Working Directory: Working Directory not set User: SYSTEM Comment: Created by NetScheduleJobAdd. Scheduled Date: Jul 17 02:20:00.0 2012 ************************************************************************ ************************************************************************ File: Tasks/At2.job Product Info: Windows Vista File Version: 1 UUID: {46F61E52-4581-49A9-9AD0-2244C206AEEB} Maximum Run Time: 72:00:00.0 (HH:MM:SS.MS) Exit Code: 0 Status: Properties not set Flags: TASK_FLAG_DONT_START_IF_ON_BATTERIES Date Run: Task not yet run Running Instances: 0 Application: notepad.exe Working Directory: Working Directory not set User: SYSTEM Comment: Created by NetScheduleJobAdd. Scheduled Date: Jul 16 14:20:00.0 2012 ************************************************************************
And here are a couple of XP Tasks, notice that one has "Running Instances" value of "1", this was copied when the command was currently running:
************************************************************************ File: Solitaire.job Product Info: Windows XP File Version: 1 UUID: {3824DDBB-A037-4016-B99A-28BD95D429AF} Maximum Run Time: 72:00:00.0 (HH:MM:SS.MS) Exit Code: 0 Status: Task has not run Flags: TASK_FLAG_INTERACTIVE, TASK_FLAG_DELETE_WHEN_DONE Date Run: Monday Aug 13 12:37:00.10 2012 Running Instances: 1 Application: C:\WINDOWS\system32\sol.exe Working Directory: C:\WINDOWS\system32 User: user Comment: Comment not set Scheduled Date: Aug 13 12:37:00.0 2012 ************************************************************************ ************************************************************************ File: Solitaire2.job Product Info: Windows XP File Version: 1 UUID: {3824DDBB-A037-4016-B99A-28BD95D429AF} Maximum Run Time: 72:00:00.0 (HH:MM:SS.MS) Exit Code: 0 Status: Task is ready to run Flags: TASK_FLAG_INTERACTIVE, TASK_FLAG_DELETE_WHEN_DONE Date Run: Monday Aug 13 12:37:00.10 2012 Running Instances: 0 Application: C:\WINDOWS\system32\sol.exe Working Directory: C:\WINDOWS\system32 User: user Comment: Comment not set Scheduled Date: Aug 13 12:37:00.0 2012 ************************************************************************
References:
[1] Windows Forensic Analysis 2nd Ed., Harlan Carvey
[2] .JOB File Format, http://msdn.microsoft.com/en-us/library/cc248285%28v=prot.13%29.aspx
[3] Windows Scheduler (at job) Forensics, http://computer-forensics.sans.org/blog/2009/09/16/windows-scheduler-at-job-forensics
9 comments:
this is hilarious that you just released this. i just spent the w/e creating a netwitness api script that would grab job files from pcap and do all this parsing in python. your code is nicer and neater than mine :) and more complete, I am only parsing out the more interesting bits of info (for now).
did you also have issues with MS' documentation regarding the UUID size in the FIXEDLEN / Header portion? I find that it is still overstated by 2 bytes - let me now what you think...can't figure out why it would still be documented as such.
Chris
this is hilarious that you just released this. i just spent the w/e creating a netwitness api script that would grab files and do all this parsing in python. your code is nicer and neater than mine :) and more complete, I am only parsing out the more interesting bits of info.
did you also have issues with MS' documentation regarding the UUID size in the FIXEDLEN / Header portion? I find that it is still overstated by 2 bytes - let me now what you think...
Hi Christian,
Thanks for comment :-)
Actually, the documentation on UUID size should be correct, if you look at: http://msdn.microsoft.com/en-us/library/aa379358%28v=vs.85%29.aspx you see:
typedef struct _GUID {
unsigned long Data1; //4 bytes
unsigned short Data2; //2 bytes
unsigned short Data3; //2 bytes
unsigned char Data4[8]; //8 bytes
} GUID, UUID;
We should end up with 16 bytes total. Looking at the following GUID:
20d04fe0-3aea-1069-a2d8-08002b30309d
we see we have 32 characters. Each byte is represented by 2 characters of hex and 16 * 2 == 32.
Where did you find the extra bytes?
Ah wait, I hit send too quickly. I see that you are talking about the documentation from here: http://msdn.microsoft.com/en-us/library/cc248286%28v=prot.13%29.aspx. I think it's just confusing the way they wrote that actually, I'll agree with that :-)
That's exactly the MSDN reference that I had in mind; sorry, I should have provided that in my comment and realized that you don't have direct access to my thoughts! I struggled with that for a while before discovering Harlan Carvey's article on the subject from 2009 where he cited similar issues.
No worries! Yeah, I think it's just not written up very clearly.
Hey Gleeda! Your parser inspired me to create a carver, see 'at_jobs_carver.py' at http://passionateaboutis.blogspot.com/2015/09/carving-at-job-files.html
Hi There, works great, but you're missing two commas. One on line 31 and one on line 32.
0x603:"Windows 8.1"
0xa00:"Windows 10"
Best,
Jeff
Thanks, Jeff! It's now fixed :-)
Post a Comment