Skip to content

Commit 778138b

Browse files
Meatballs1Meatballs1
committed
Refactors
Add a Rex::Constants::Windows module to hold windows constants Convert DCERPC_SERVICES to a class and move to Rex
1 parent 48a88c9 commit 778138b

File tree

6 files changed

+194
-72
lines changed

6 files changed

+194
-72
lines changed

‎lib/msf/core/exploit/dcerpc.rb

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
require 'msf/core/exploit/dcerpc_epm'
55
require 'msf/core/exploit/dcerpc_mgmt'
66
require 'msf/core/exploit/dcerpc_lsa'
7-
require 'msf/core/exploit/dcerpc_services'
87

98
module Msf
109

@@ -33,7 +32,6 @@ module Exploit::Remote::DCERPC
3332
include Exploit::Remote::DCERPC_EPM
3433
include Exploit::Remote::DCERPC_MGMT
3534
include Exploit::Remote::DCERPC_LSA
36-
include Exploit::Remote::DCERPC_SERVICES
3735

3836
def initialize(info = {})
3937
super

‎lib/msf/core/exploit/smb/psexec.rb

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# -*- coding: binary -*-
2+
require 'rex/proto/dcerpc/svcctl'
23

34
module Msf
45

@@ -12,6 +13,7 @@ module Msf
1213

1314
module Exploit::Remote::SMB::Psexec
1415

16+
include Rex::Constants::Windows
1517
include Msf::Exploit::Remote::DCERPC
1618
include Msf::Exploit::Remote::SMB::Authenticated
1719

@@ -97,7 +99,8 @@ def psexec(command, disconnect=true)
9799
vprint_status("#{peer} - Bound to #{handle} ...")
98100
vprint_status("#{peer} - Obtaining a service manager handle...")
99101

100-
scm_handle, scm_status = dce_openscmanagerw(dcerpc, datastore['RHOST'])
102+
svc_client = Rex::Proto::DCERPC::SVCCTL::Client.new(dcerpc)
103+
scm_handle, scm_status = svc_client.openscmanagerw(datastore['RHOST'])
101104

102105
if scm_status == ERROR_ACCESS_DENIED
103106
print_error("#{peer} - ERROR_ACCESS_DENIED opening the Service Manager")
@@ -112,15 +115,15 @@ def psexec(command, disconnect=true)
112115
end
113116

114117
vprint_status("#{peer} - Creating the service...")
115-
svc_handle, svc_status = dce_createservicew(dcerpc, scm_handle, service_name, display_name, command, opts)
118+
svc_handle, svc_status = svc_client.createservicew(scm_handle, service_name, display_name, command, opts)
116119

117120
case svc_status
118121
when ERROR_SUCCESS
119122
vprint_good("#{peer} - Successfully created the service")
120123
when ERROR_SERVICE_EXISTS
121124
service_exists = true
122125
print_warning("#{peer} - Service already exists, opening a handle...")
123-
svc_handle = dce_openservicew(dcerpc, scm_handle, service_name)
126+
svc_handle = svc_client.openservicew(scm_handle, service_name)
124127
when ERROR_ACCESS_DENIED
125128
print_error("#{peer} - Unable to create service, ACCESS_DENIED, did AV gobble your binary?")
126129
return false
@@ -129,19 +132,19 @@ def psexec(command, disconnect=true)
129132
return false
130133
end
131134

132-
unless svc_handle
135+
if svc_handle.nil?
133136
print_error("#{peer} - No service handle retrieved")
134137
return false
135138
else
136139

137140
if service_description
138141
vprint_status("#{peer} - Changing service description...")
139-
dce_changeservicedescription(dcerpc, svc_handle, service_description)
142+
svc_client.changeservicedescription(svc_handle, service_description)
140143
end
141144

142145
vprint_status("#{peer} - Starting the service...")
143146
begin
144-
svc_status = dce_startservice(dcerpc, svc_handle)
147+
svc_status = svc_client.startservice(svc_handle)
145148
case svc_status
146149
when ERROR_SUCCESS
147150
print_good("#{peer} - Service started successfully...")
@@ -164,7 +167,7 @@ def psexec(command, disconnect=true)
164167
print_warning("#{peer} - Not removing service for persistance...")
165168
else
166169
vprint_status("#{peer} - Removing the service...")
167-
svc_status = dce_deleteservice(dcerpc, svc_handle)
170+
svc_status = svc_client.deleteservice(svc_handle)
168171
if svc_status == ERROR_SUCCESS
169172
vprint_good("#{peer} - Successfully removed the sevice")
170173
else
@@ -173,7 +176,7 @@ def psexec(command, disconnect=true)
173176
end
174177
ensure
175178
vprint_status("#{peer} - Closing service handle...")
176-
dce_closehandle(dcerpc, svc_handle)
179+
svc_client.closehandle(svc_handle)
177180
end
178181
end
179182
end

‎lib/rex/constants.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# -*- coding: binary -*-
2+
23
#
34
# Log severities
45
#

‎lib/rex/constants/windows.rb

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
module Rex::Constants
2+
module Windows
3+
4+
##
5+
#
6+
# Access Types
7+
# winnt.h
8+
#
9+
##
10+
11+
STANDARD_RIGHTS_REQUIRED = 0x000F0000
12+
13+
##
14+
#
15+
# Errors
16+
#
17+
##
18+
19+
ERROR_SUCCESS = 0x0
20+
ERROR_FILE_NOT_FOUND = 0x2
21+
ERROR_ACCESS_DENIED = 0x5
22+
ERROR_SERVICE_REQUEST_TIMEOUT = 0x41D
23+
ERROR_SERVICE_EXISTS = 0x431
24+
25+
##
26+
#
27+
# SVCCTL Protocol Functions
28+
# http://msdn.microsoft.com/en-us/library/cc245920.aspxa
29+
#
30+
##
31+
32+
CLOSE_SERVICE_HANDLE = 0x00
33+
CONTROL_SERVICE = 0x01
34+
DELETE_SERVICE = 0x02
35+
QUERY_SERVICE_STATUS = 0x05
36+
CHANGE_SERVICE_CONFIG_W = 0x0b
37+
CREATE_SERVICE_W = 0x0c
38+
OPEN_SC_MANAGER_W = 0x0f
39+
OPEN_SERVICE_W = 0x10
40+
CHANGE_SERVICE_CONFIG2_W = 0x25
41+
42+
##
43+
#
44+
# Services
45+
# winsvc.h
46+
##
47+
48+
SERVICE_WIN32_OWN_PROCESS = 0x10
49+
SERVICE_INTERACTIVE_PROCESS = 0x100
50+
51+
SERVICE_BOOT_START = 0x00
52+
SERVICE_SYSTEM_START = 0x01
53+
SERVICE_AUTO_START = 0x02
54+
SERVICE_DEMAND_START = 0x03
55+
SERVICE_DISABLED = 0x04
56+
57+
SERVICE_ERROR_IGNORE = 0x0
58+
59+
SERVICE_CONFIG_DESCRIPTION = 0x01
60+
61+
SERVICE_CONTROL_STOP = 0x01
62+
SERVICE_NO_CHANGE = 0xffffffff
63+
SERVICE_ACTIVE = 0x00000001
64+
SERVICE_INACTIVE = 0x00000002
65+
SERVICE_STATE_ALL = (SERVICE_ACTIVE | \
66+
SERVICE_INACTIVE)
67+
SERVICE_CONTROL_STOP = 0x00000001
68+
SERVICE_CONTROL_PAUSE = 0x00000002
69+
SERVICE_CONTROL_CONTINUE = 0x00000003
70+
SERVICE_CONTROL_INTERROGATE = 0x00000004
71+
SERVICE_CONTROL_SHUTDOWN = 0x00000005
72+
SERVICE_CONTROL_PARAMCHANGE = 0x00000006
73+
SERVICE_CONTROL_NETBINDADD = 0x00000007
74+
SERVICE_CONTROL_NETBINDREMOVE = 0x00000008
75+
SERVICE_CONTROL_NETBINDENABLE = 0x00000009
76+
SERVICE_CONTROL_NETBINDDISABLE = 0x0000000A
77+
SERVICE_CONTROL_DEVICEEVENT = 0x0000000B
78+
SERVICE_CONTROL_HARDWAREPROFILECHANGE =0x0000000C
79+
SERVICE_CONTROL_POWEREVENT = 0x0000000D
80+
SERVICE_CONTROL_SESSIONCHANGE = 0x0000000E
81+
SERVICE_CONTROL_PRESHUTDOWN = 0x0000000F
82+
SERVICE_CONTROL_TIMECHANGE = 0x00000010
83+
SERVICE_CONTROL_TRIGGEREVENT = 0x00000020
84+
SERVICE_STOPPED = 0x00000001
85+
SERVICE_START_PENDING = 0x00000002
86+
SERVICE_STOP_PENDING = 0x00000003
87+
SERVICE_RUNNING = 0x00000004
88+
SERVICE_CONTINUE_PENDING = 0x00000005
89+
SERVICE_PAUSE_PENDING = 0x00000006
90+
SERVICE_PAUSED = 0x00000007
91+
SERVICE_ACCEPT_STOP = 0x00000001
92+
SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002
93+
SERVICE_ACCEPT_SHUTDOWN = 0x00000004
94+
SERVICE_ACCEPT_PARAMCHANGE = 0x00000008
95+
SERVICE_ACCEPT_NETBINDCHANGE = 0x00000010
96+
SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020
97+
SERVICE_ACCEPT_POWEREVENT = 0x00000040
98+
SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080
99+
SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100
100+
SERVICE_ACCEPT_TIMECHANGE = 0x00000200
101+
SERVICE_ACCEPT_TRIGGEREVENT = 0x00000400
102+
SC_MANAGER_CONNECT = 0x0001
103+
SC_MANAGER_CREATE_SERVICE = 0x0002
104+
SC_MANAGER_ENUMERATE_SERVICE = 0x0004
105+
SC_MANAGER_LOCK = 0x0008
106+
SC_MANAGER_QUERY_LOCK_STATUS = 0x0010
107+
SC_MANAGER_MODIFY_BOOT_CONFIG = 0x0020
108+
109+
SC_MANAGER_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | \
110+
SC_MANAGER_CONNECT | \
111+
SC_MANAGER_CREATE_SERVICE | \
112+
SC_MANAGER_ENUMERATE_SERVICE | \
113+
SC_MANAGER_LOCK | \
114+
SC_MANAGER_QUERY_LOCK_STATUS | \
115+
SC_MANAGER_MODIFY_BOOT_CONFIG)
116+
117+
SERVICE_QUERY_CONFIG = 0x0001
118+
SERVICE_CHANGE_CONFIG = 0x0002
119+
SERVICE_QUERY_STATUS = 0x0004
120+
SERVICE_ENUMERATE_DEPENDENTS = 0x0008
121+
SERVICE_START = 0x0010
122+
SERVICE_STOP = 0x0020
123+
SERVICE_PAUSE_CONTINUE = 0x0040
124+
SERVICE_INTERROGATE = 0x0080
125+
SERVICE_USER_DEFINED_CONTROL = 0x0100
126+
SERVICE_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | \
127+
SERVICE_QUERY_CONFIG | \
128+
SERVICE_CHANGE_CONFIG | \
129+
SERVICE_QUERY_STATUS | \
130+
SERVICE_ENUMERATE_DEPENDENTS | \
131+
SERVICE_START | \
132+
SERVICE_STOP | \
133+
SERVICE_PAUSE_CONTINUE | \
134+
SERVICE_INTERROGATE | \
135+
SERVICE_USER_DEFINED_CONTROL)
136+
137+
SERVICE_RUNS_IN_SYSTEM_PROCESS = 0x00000001
138+
SERVICE_CONFIG_DESCRIPTION = 1
139+
SERVICE_CONFIG_FAILURE_ACTIONS = 2
140+
SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 3
141+
SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 4
142+
SERVICE_CONFIG_SERVICE_SID_INFO = 5
143+
SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 6
144+
SERVICE_CONFIG_PRESHUTDOWN_INFO = 7
145+
SERVICE_CONFIG_TRIGGER_INFO = 8
146+
SERVICE_CONFIG_PREFERRED_NODE = 9
147+
SERVICE_CONFIG_LAUNCH_PROTECTED = 12
148+
149+
end
150+
end

‎lib/rex/proto/dcerpc/svcctl.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# -*- coding: binary -*-
2+
require 'rex/proto/dcerpc/svcctl/packet'

0 commit comments

Comments
 (0)