Please don't quote text with code blocks:

> The task scheduler service has an alpc endpoint, supporting the method “SchRpcSetSecurity”. The prototype looks like this:

    long _SchRpcSetSecurity(
        [in][string] wchar_t* arg_1, //Task name
        [in][string] wchar_t* arg_2, //Security Descriptor string
        [in]long arg_3);

> Tasks created by the task scheduler will create a corresponding folder/file in c:\windows\system32\tasks. This function seems to be designed to write the DACL of tasks located there, and will do so while impersonating.

> However, for some reason it will also check if a .job file exists under c:\windows\tasks and try to set the DACL while not impersonating.

> Since a user, and even a user belonging to the guests group can create files in this folder, we can simply create a hardlink to another file (all we need is read access). Because of the hardlink, we can let the task scheduler write an arbitrary DACL (see second parameter of SchRpcSetSecurity) to a file of our choosing.

> So any file that we have read access over as a user and that system has the write DACL permission for, we can pivot into full control and overwrite it.