2014-04-02 20:21:45 +00:00
|
|
|
# -*- coding: binary -*-
|
2014-05-21 19:15:32 +00:00
|
|
|
module Rex
|
2014-04-02 20:21:45 +00:00
|
|
|
|
|
|
|
###
|
|
|
|
# This module implements MSRPC functions that control creating, deleting,
|
|
|
|
# starting, stopping, and querying system services.
|
|
|
|
###
|
2014-05-21 19:15:32 +00:00
|
|
|
module Proto::DCERPC::SVCCTL
|
2014-04-02 20:21:45 +00:00
|
|
|
|
2016-07-26 21:59:13 +00:00
|
|
|
require 'windows_error'
|
|
|
|
require 'windows_error/win32'
|
2014-05-21 19:15:32 +00:00
|
|
|
require 'rex/constants/windows'
|
2014-04-02 20:21:45 +00:00
|
|
|
NDR = Rex::Encoder::NDR
|
|
|
|
|
2014-04-05 17:38:12 +00:00
|
|
|
|
2014-05-21 19:15:32 +00:00
|
|
|
class Client
|
2014-04-02 20:21:45 +00:00
|
|
|
|
2016-07-26 21:59:13 +00:00
|
|
|
include WindowsError::Win32
|
2014-05-21 19:15:32 +00:00
|
|
|
include Rex::Constants::Windows
|
2014-04-05 17:38:12 +00:00
|
|
|
|
2014-05-21 19:15:32 +00:00
|
|
|
attr_accessor :dcerpc_client
|
2014-04-05 17:38:12 +00:00
|
|
|
|
2014-05-21 19:15:32 +00:00
|
|
|
def initialize(dcerpc_client)
|
|
|
|
self.dcerpc_client = dcerpc_client
|
|
|
|
end
|
2014-04-05 17:38:12 +00:00
|
|
|
|
|
|
|
# Returns the Windows Error Code in numeric format
|
|
|
|
#
|
|
|
|
# @param raw_error [String] the raw error code in binary format.
|
|
|
|
#
|
|
|
|
# @return [Integer] the Windows Error Code integer.
|
|
|
|
def error_code(raw_error)
|
|
|
|
raw_error.unpack('V').first
|
|
|
|
end
|
|
|
|
|
2014-04-02 20:21:45 +00:00
|
|
|
# Calls OpenSCManagerW() to obtain a handle to the service control manager.
|
|
|
|
#
|
|
|
|
# @param rhost [String] the target host.
|
|
|
|
# @param access [Fixnum] the access flags requested.
|
|
|
|
#
|
2014-05-23 20:16:11 +00:00
|
|
|
# @return [Array<String,Integer>] the handle to the service control manager or nil if
|
2014-04-02 21:52:07 +00:00
|
|
|
# the call is not successful and the Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def openscmanagerw(rhost, access = SC_MANAGER_ALL_ACCESS)
|
2014-04-02 20:21:45 +00:00
|
|
|
scm_handle = nil
|
|
|
|
scm_status = nil
|
|
|
|
stubdata =
|
|
|
|
NDR.uwstring("\\\\#{rhost}") +
|
|
|
|
NDR.long(0) +
|
|
|
|
NDR.long(access)
|
2014-04-02 20:34:36 +00:00
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(OPEN_SC_MANAGER_W, stubdata)
|
2014-04-02 20:34:36 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
scm_status = error_code(response[20,4])
|
2014-04-02 21:41:31 +00:00
|
|
|
if scm_status == ERROR_SUCCESS
|
2014-04-02 20:34:36 +00:00
|
|
|
scm_handle = response[0,20]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error getting scm handle: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
2014-05-23 20:16:11 +00:00
|
|
|
[scm_handle, scm_status]
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Calls CreateServiceW() to create a system service. Returns a handle to
|
|
|
|
# the service on success, or nil.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param scm_handle [String] the SCM handle (from {#openscmanagerw}).
|
2014-04-02 20:21:45 +00:00
|
|
|
# @param service_name [String] the service name.
|
|
|
|
# @param display_name [String] the display name.
|
|
|
|
# @param binary_path [String] the path of the binary to run.
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param opts [Hash] arguments for CreateServiceW()
|
|
|
|
# @option opts [Fixnum] :access (SERVICE_ALL_ACCESS) the access level.
|
|
|
|
# @option opts [Fixnum] :type (SERVICE_WIN32_OWN_PROCESS ||
|
|
|
|
# SERVICE_INTERACTIVE_PROCESS) the type of service.
|
|
|
|
# @option opts [Fixnum] :start (SERVICE_DEMAND_START) the start options.
|
|
|
|
# @option opts [Fixnum] :errors (SERVICE_ERROR_IGNORE) the error options.
|
|
|
|
# @option opts [Fixnum] :load_order_group (0) the load order group.
|
|
|
|
# @option opts [Fixnum] :dependencies (0) the dependencies of the service.
|
|
|
|
# @option opts [Fixnum] :service_start (0)
|
|
|
|
# @option opts [Fixnum] :password1 (0)
|
|
|
|
# @option opts [Fixnum] :password2 (0)
|
|
|
|
# @option opts [Fixnum] :password3 (0)
|
|
|
|
# @option opts [Fixnum] :password4 (0)
|
2014-04-02 20:21:45 +00:00
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [String, Integer] a handle to the created service, windows
|
|
|
|
# error code.
|
2014-05-21 19:15:32 +00:00
|
|
|
def createservicew(scm_handle, service_name, display_name, binary_path, opts)
|
2014-04-02 20:21:45 +00:00
|
|
|
default_opts = {
|
2014-04-05 17:38:12 +00:00
|
|
|
:access => SERVICE_ALL_ACCESS,
|
|
|
|
:type => SERVICE_WIN32_OWN_PROCESS || SERVICE_INTERACTIVE_PROCESS,
|
|
|
|
:start => SERVICE_DEMAND_START,
|
|
|
|
:errors => SERVICE_ERROR_IGNORE,
|
2014-04-02 20:21:45 +00:00
|
|
|
:load_order_group => 0,
|
|
|
|
:dependencies => 0,
|
|
|
|
:service_start => 0,
|
|
|
|
:password1 => 0,
|
|
|
|
:password2 => 0,
|
|
|
|
:password3 => 0,
|
|
|
|
:password4 => 0
|
|
|
|
}.merge(opts)
|
|
|
|
|
|
|
|
svc_handle = nil
|
|
|
|
svc_status = nil
|
|
|
|
stubdata = scm_handle +
|
|
|
|
NDR.wstring(service_name) +
|
|
|
|
NDR.uwstring(display_name) +
|
|
|
|
NDR.long(default_opts[:access]) +
|
|
|
|
NDR.long(default_opts[:type]) +
|
|
|
|
NDR.long(default_opts[:start]) +
|
|
|
|
NDR.long(default_opts[:errors]) +
|
|
|
|
NDR.wstring(binary_path) +
|
|
|
|
NDR.long(default_opts[:load_order_group]) +
|
|
|
|
NDR.long(default_opts[:dependencies]) +
|
|
|
|
NDR.long(default_opts[:service_start]) +
|
|
|
|
NDR.long(default_opts[:password1]) +
|
|
|
|
NDR.long(default_opts[:password2]) +
|
|
|
|
NDR.long(default_opts[:password3]) +
|
|
|
|
NDR.long(default_opts[:password4])
|
2014-04-02 21:41:31 +00:00
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(CREATE_SERVICE_W, stubdata)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response[24,4])
|
2014-04-02 20:21:45 +00:00
|
|
|
|
2014-04-02 21:41:31 +00:00
|
|
|
if svc_status == ERROR_SUCCESS
|
|
|
|
svc_handle = response[4,20]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error creating service: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
return svc_handle, svc_status
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
2014-04-02 22:16:58 +00:00
|
|
|
# Calls ChangeServiceConfig2() to change the service description.
|
|
|
|
#
|
|
|
|
# @param svc_handle [String] the service handle to change.
|
|
|
|
# @param service_description [String] the service description.
|
|
|
|
#
|
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def changeservicedescription(svc_handle, service_description)
|
2014-04-02 22:16:58 +00:00
|
|
|
svc_status = nil
|
|
|
|
stubdata =
|
|
|
|
svc_handle +
|
2014-04-05 17:38:12 +00:00
|
|
|
NDR.long(SERVICE_CONFIG_DESCRIPTION) +
|
2014-04-02 22:16:58 +00:00
|
|
|
NDR.long(1) + # lpInfo -> *SERVICE_DESCRIPTION
|
|
|
|
NDR.long(0x0200) + # SERVICE_DESCRIPTION struct
|
|
|
|
NDR.long(0x04000200) +
|
|
|
|
NDR.wstring(service_description)
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(CHANGE_SERVICE_CONFIG2_W, stubdata) # ChangeServiceConfig2
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response)
|
2014-04-02 22:16:58 +00:00
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error changing service description : #{e}")
|
2014-04-02 22:16:58 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
svc_status
|
|
|
|
end
|
|
|
|
|
|
|
|
|
2014-04-02 21:41:31 +00:00
|
|
|
# Calls CloseHandle() to close a handle.
|
2014-04-02 20:21:45 +00:00
|
|
|
#
|
|
|
|
# @param handle [String] the handle to close.
|
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def closehandle(handle)
|
2014-04-02 21:41:31 +00:00
|
|
|
svc_status = nil
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(CLOSE_SERVICE_HANDLE, handle)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response[20,4])
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error closing service handle: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
svc_status
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Calls OpenServiceW to obtain a handle to an existing service.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param scm_handle [String] the SCM handle (from {#openscmanagerw}).
|
2014-04-02 20:21:45 +00:00
|
|
|
# @param service_name [String] the name of the service to open.
|
|
|
|
# @param access [Fixnum] the level of access requested (default is maximum).
|
|
|
|
#
|
|
|
|
# @return [String, nil] the handle of the service opened, or nil on failure.
|
2014-05-21 19:15:32 +00:00
|
|
|
def openservicew(scm_handle, service_name, access = SERVICE_ALL_ACCESS)
|
2014-04-02 20:21:45 +00:00
|
|
|
svc_handle = nil
|
|
|
|
svc_status = nil
|
|
|
|
stubdata = scm_handle + NDR.wstring(service_name) + NDR.long(access)
|
2014-04-02 21:41:31 +00:00
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(OPEN_SERVICE_W, stubdata)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response[20,4])
|
2014-04-02 21:41:31 +00:00
|
|
|
if svc_status == ERROR_SUCCESS
|
|
|
|
svc_handle = response[0,20]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error opening service handle: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
2014-04-02 21:41:31 +00:00
|
|
|
svc_handle
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Calls StartService() on a handle to an existing service in order to start
|
|
|
|
# it. Returns true on success, or false.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param svc_handle [String] the handle of the service (from {#openservicew}).
|
2014-04-02 20:21:45 +00:00
|
|
|
# @param magic1 [Fixnum] an unknown value.
|
|
|
|
# @param magic2 [Fixnum] another unknown value.
|
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def startservice(svc_handle, magic1 = 0, magic2 = 0)
|
2014-04-02 21:41:31 +00:00
|
|
|
svc_status = nil
|
2014-04-02 20:21:45 +00:00
|
|
|
stubdata = svc_handle + NDR.long(magic1) + NDR.long(magic2)
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(0x13, stubdata)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response)
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error starting service: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
svc_status
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Stops a running service.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param svc_handle [String] the handle of the service (from {#openservicew}).
|
2014-04-02 20:21:45 +00:00
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def stopservice(svc_handle)
|
|
|
|
dce_controlservice(svc_handle, SERVICE_CONTROL_STOP)
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Controls an existing service.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param svc_handle [String] the handle of the service (from {#openservicew}).
|
2014-04-02 20:21:45 +00:00
|
|
|
# @param operation [Fixnum] the operation number to perform (1 = stop
|
|
|
|
# service; others are unknown).
|
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def controlservice(svc_handle, operation)
|
2014-04-02 21:41:31 +00:00
|
|
|
svc_status = nil
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(CONTROL_SERVICE, svc_handle + NDR.long(operation))
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response[28,4])
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error controlling service: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
svc_status
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Calls DeleteService() to delete a service.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param svc_handle [String] the handle of the service (from {#openservicew}).
|
2014-04-02 20:21:45 +00:00
|
|
|
#
|
2014-04-02 21:41:31 +00:00
|
|
|
# @return [Integer] Windows error code
|
2014-05-21 19:15:32 +00:00
|
|
|
def deleteservice(svc_handle)
|
2014-04-02 21:41:31 +00:00
|
|
|
svc_status = nil
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(DELETE_SERVICE, svc_handle)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response
|
2014-04-05 17:38:12 +00:00
|
|
|
svc_status = error_code(response)
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error deleting service: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
svc_status
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Calls QueryServiceStatus() to query the status of a service.
|
|
|
|
#
|
2014-05-23 19:47:52 +00:00
|
|
|
# @param svc_handle [String] the handle of the service (from {#openservicew}).
|
2014-04-02 20:21:45 +00:00
|
|
|
#
|
|
|
|
# @return [Fixnum] Returns 0 if the query failed (i.e.: a state was returned
|
|
|
|
# that isn't implemented), 1 if the service is running, and
|
|
|
|
# 2 if the service is stopped.
|
2014-05-21 19:15:32 +00:00
|
|
|
def queryservice(svc_handle)
|
2014-04-02 20:21:45 +00:00
|
|
|
ret = 0
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
begin
|
2014-05-21 19:15:32 +00:00
|
|
|
response = dcerpc_client.call(QUERY_SERVICE_STATUS, svc_handle)
|
2014-04-02 21:41:31 +00:00
|
|
|
if response[0,9] == "\x10\x00\x00\x00\x04\x00\x00\x00\x01"
|
|
|
|
ret = 1
|
|
|
|
elsif response[0,9] == "\x10\x00\x00\x00\x01\x00\x00\x00\x00"
|
|
|
|
ret = 2
|
|
|
|
end
|
|
|
|
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
|
2016-01-28 19:58:24 +00:00
|
|
|
print_error("Error deleting service: #{e}")
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|
|
|
|
ret
|
2014-04-02 20:21:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
end
|
|
|
|
end
|
2014-05-21 19:15:32 +00:00
|
|
|
end
|
2014-04-02 21:41:31 +00:00
|
|
|
|