infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Forgot, TABS not spaces for indent 

git-svn-id: file:///home/svn/framework3/trunk@9921 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Carlos Perez 2010-07-25 01:54:29 +00:00
parent d279123b77
commit 1ae81367ac
2 changed files with 80 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
lib/msf/scripts/meterpreter/services.rb
View File

@ -76,22 +76,22 @@ end
# executable on the host that will execute at startup as string and the startup # executable on the host that will execute at startup as string and the startup
# type as an integer of 2 for Auto, 3 for Manual or 4 for Disable, default Auto. # type as an integer of 2 for Auto, 3 for Manual or 4 for Disable, default Auto.
def service_create(name, display_name, executable_on_host,startup=2) def service_create(name, display_name, executable_on_host,startup=2)
client.core.use("railgun") client.core.use("railgun")
adv = client.railgun.advapi32 adv = client.railgun.advapi32
manag = adv.OpenSCManagerA(nil,nil,0x13) manag = adv.OpenSCManagerA(nil,nil,0x13)
if(manag["return"] != 0) if(manag["return"] != 0)
# SC_MANAGER_CREATE_SERVICE = 0x0002 # SC_MANAGER_CREATE_SERVICE = 0x0002
newservice = adv.CreateServiceA(manag["return"],name,display_name,0x0010,0X00000010,startup,0,executable_on_host,nil,nil,nil,nil,nil) newservice = adv.CreateServiceA(manag["return"],name,display_name,0x0010,0X00000010,startup,0,executable_on_host,nil,nil,nil,nil,nil)
#SERVICE_START=0x0010 SERVICE_WIN32_OWN_PROCESS= 0X00000010 #SERVICE_START=0x0010 SERVICE_WIN32_OWN_PROCESS= 0X00000010
#SERVICE_AUTO_START = 2 SERVICE_ERROR_IGNORE = 0 #SERVICE_AUTO_START = 2 SERVICE_ERROR_IGNORE = 0
if newservice["GetLastError"] == 0 if newservice["GetLastError"] == 0
return true return true
else else
return false return false
end end
else else
raise "Could not open Service Control Manager, Access Denied" raise "Could not open Service Control Manager, Access Denied"
end end
end end
# Function for service startup, returns 0 if service started, 1 if service is # Function for service startup, returns 0 if service started, 1 if service is
# already started and 2 if service is disabled. # already started and 2 if service is disabled.
@ -112,12 +112,12 @@ def service_start(name)
adv.CloseServiceHandle(servhandleret["return"]) adv.CloseServiceHandle(servhandleret["return"])
adv.CloseServiceHandle(manag["return"]) adv.CloseServiceHandle(manag["return"])
if retval["GetLastError"] == 0 if retval["GetLastError"] == 0
return 0 return 0
elsif retval["GetLastError"] == 1056 elsif retval["GetLastError"] == 1056
return 1 return 1
elsif retval["GetLastError"] == 1058 elsif retval["GetLastError"] == 1058
return 2 return 2
end end
end end
@ -140,11 +140,11 @@ def service_stop(name)
adv.CloseServiceHandle(servhandleret["return"]) adv.CloseServiceHandle(servhandleret["return"])
adv.CloseServiceHandle(manag["return"]) adv.CloseServiceHandle(manag["return"])
if retval["GetLastError"] == 0 if retval["GetLastError"] == 0
return 0 return 0
elsif retval["GetLastError"] == 1062 elsif retval["GetLastError"] == 1062
return 1 return 1
elsif retval["GetLastError"] == 1052 elsif retval["GetLastError"] == 1052
return 2 return 2
end end
end end
end end

116
lib/rex/post/meterpreter/extensions/railgun/api.rb
View File

@ -9295,116 +9295,116 @@ class ApiDefinitions
railgun.kernel32.LoadLibraryA("Advapi32.dll") railgun.kernel32.LoadLibraryA("Advapi32.dll")
# Function to open the Service Control Database # Function to open the Service Control Database
railgun.add_function( 'advapi32', 'OpenSCManagerA','DWORD',[ railgun.add_function( 'advapi32', 'OpenSCManagerA','DWORD',[
[ "PCHAR", "lpMachineName", "inout" ], [ "PCHAR", "lpMachineName", "inout" ],
[ "PCHAR", "lpDatabaseName", "inout" ], [ "PCHAR", "lpDatabaseName", "inout" ],
[ "DWORD", "dwDesiredAccess", "in" ] [ "DWORD", "dwDesiredAccess", "in" ]
]) ])
# Function for creating a Service # Function for creating a Service
railgun.add_function( 'advapi32', 'CreateServiceA','DWORD',[ railgun.add_function( 'advapi32', 'CreateServiceA','DWORD',[
[ "DWORD", "hSCManager", "in" ], [ "DWORD", "hSCManager", "in" ],
[ "PCHAR", "lpServiceName", "in" ], [ "PCHAR", "lpServiceName", "in" ],
[ "PCHAR", "lpDisplayName", "in" ], [ "PCHAR", "lpDisplayName", "in" ],
[ "DWORD", "dwDesiredAccess", "in" ], [ "DWORD", "dwDesiredAccess", "in" ],
[ "DWORD", "dwServiceType", "in" ], [ "DWORD", "dwServiceType", "in" ],
[ "DWORD", "dwStartType", "in" ], [ "DWORD", "dwStartType", "in" ],
[ "DWORD", "dwErrorControl", "in" ], [ "DWORD", "dwErrorControl", "in" ],
[ "PCHAR", "lpBinaryPathName", "in" ], [ "PCHAR", "lpBinaryPathName", "in" ],
[ "PCHAR", "lpLoadOrderGroup", "in" ], [ "PCHAR", "lpLoadOrderGroup", "in" ],
[ "PDWORD", "lpdwTagId", "out" ], [ "PDWORD", "lpdwTagId", "out" ],
[ "PCHAR", "lpDependencies", "in" ], [ "PCHAR", "lpDependencies", "in" ],
[ "PCHAR", "lpServiceStartName", "in" ], [ "PCHAR", "lpServiceStartName", "in" ],
[ "PCHAR", "lpPassword", "in" ] [ "PCHAR", "lpPassword", "in" ]
]) ])
railgun.add_function( 'advapi32', 'OpenServiceA','DWORD',[ railgun.add_function( 'advapi32', 'OpenServiceA','DWORD',[
[ "DWORD", "hSCManager", "in" ], [ "DWORD", "hSCManager", "in" ],
[ "PCHAR", "lpServiceName", "in" ], [ "PCHAR", "lpServiceName", "in" ],
[ "DWORD", "dwDesiredAccess", "in" ] [ "DWORD", "dwDesiredAccess", "in" ]
]) ])
#access rights: SERVICE_CHANGE_CONFIG (0x0002) SERVICE_START (0x0010) #access rights: SERVICE_CHANGE_CONFIG (0x0002) SERVICE_START (0x0010)
#SERVICE_STOP (0x0020) #SERVICE_STOP (0x0020)
railgun.add_function( 'advapi32', 'StartServiceA','BOOL',[ railgun.add_function( 'advapi32', 'StartServiceA','BOOL',[
[ "DWORD", "hService", "in" ], [ "DWORD", "hService", "in" ],
[ "DWORD", "dwNumServiceArgs", "in" ], [ "DWORD", "dwNumServiceArgs", "in" ],
[ "PCHAR", "lpServiceArgVectors", "in" ] [ "PCHAR", "lpServiceArgVectors", "in" ]
]) ])
railgun.add_function( 'advapi32', 'ControlService','BOOL',[ railgun.add_function( 'advapi32', 'ControlService','BOOL',[
[ "DWORD", "hService", "in" ], [ "DWORD", "hService", "in" ],
[ "DWORD", "dwControl", "in" ], [ "DWORD", "dwControl", "in" ],
[ "PBLOB", "lpServiceStatus", "out" ] [ "PBLOB", "lpServiceStatus", "out" ]
]) ])
#SERVICE_CONTROL_STOP = 0x00000001 #SERVICE_CONTROL_STOP = 0x00000001
# _SERVICE_STATUS is an array of 7 DWORDS - dwServiceType; # _SERVICE_STATUS is an array of 7 DWORDS - dwServiceType;
#dwCurrentState; dwControlsAccepted; dwWin32ExitCode; #dwCurrentState; dwControlsAccepted; dwWin32ExitCode;
#dwServiceSpecificExitCode; dwCheckPoint; dwWaitHint; #dwServiceSpecificExitCode; dwCheckPoint; dwWaitHint;
railgun.add_function( 'advapi32', 'ChangeServiceConfigA','BOOL',[ railgun.add_function( 'advapi32', 'ChangeServiceConfigA','BOOL',[
[ "DWORD", "hService", "in" ], [ "DWORD", "hService", "in" ],
[ "DWORD", "dwServiceType", "in" ], [ "DWORD", "dwServiceType", "in" ],
[ "DWORD", "dwStartType", "in" ], [ "DWORD", "dwStartType", "in" ],
[ "DWORD", "dwErrorControl", "in" ], [ "DWORD", "dwErrorControl", "in" ],
[ "PCHAR", "lpBinaryPathName", "in" ], [ "PCHAR", "lpBinaryPathName", "in" ],
[ "PCHAR", "lpLoadOrderGroup", "in" ], [ "PCHAR", "lpLoadOrderGroup", "in" ],
[ "PDWORD", "lpdwTagId", "out" ], [ "PDWORD", "lpdwTagId", "out" ],
[ "PCHAR", "lpDependencies", "in" ], [ "PCHAR", "lpDependencies", "in" ],
[ "PCHAR", "lpServiceStartName", "in" ], [ "PCHAR", "lpServiceStartName", "in" ],
[ "PCHAR", "lpPassword", "in" ], [ "PCHAR", "lpPassword", "in" ],
[ "PCHAR", "lpDisplayName", "in" ] [ "PCHAR", "lpDisplayName", "in" ]
]) ])
railgun.add_function( 'advapi32', 'CloseServiceHandle','BOOL',[ railgun.add_function( 'advapi32', 'CloseServiceHandle','BOOL',[
[ "DWORD", "hSCObject", "in" ] [ "DWORD", "hSCObject", "in" ]
]) ])
end # method end # method