@@ -16,8 +16,8 @@ def initialize(info={})
16
16
'Name' => "Windows Gather Service Info Enumeration" ,
17
17
'Description' => %q{
18
18
This module will query the system for services and display name and configuration
19
- info for each returned service. It allows you to optionally search the credentials, path, or start
20
- type for a string and only return the results that match. These query operations
19
+ info for each returned service. It allows you to optionally search the credentials, path,
20
+ or start type for a string and only return the results that match. These query operations
21
21
are cumulative and if no query strings are specified, it just returns all services.
22
22
NOTE: If the script hangs, windows firewall is most likely on and you did not
23
23
migrate to a safe process (explorer.exe for example).
@@ -68,11 +68,11 @@ def run
68
68
service_list . each do |sname |
69
69
srv_conf = { }
70
70
isgood = true
71
- #make sure we got a service name
71
+ # make sure we got a service name
72
72
if sname
73
73
begin
74
74
srv_conf = service_info ( sname )
75
- #filter service based on filters passed, the are cumulative
75
+ # filter service based on filters passed, the are cumulative
76
76
if qcred and ! srv_conf [ 'Credentials' ] . downcase . include? qcred . downcase
77
77
isgood = false
78
78
end
@@ -83,19 +83,20 @@ def run
83
83
if qtype and ! ( srv_conf [ 'Startup' ] || '' ) . downcase . include? qtype . downcase
84
84
isgood = false
85
85
end
86
- #count the occurance of specific credentials services are running as
86
+ # count the occurance of specific credentials services are running as
87
87
serviceCred = srv_conf [ 'Credentials' ] . upcase
88
88
unless serviceCred . empty?
89
89
if credentialCount . has_key? ( serviceCred )
90
90
credentialCount [ serviceCred ] += 1
91
91
else
92
92
credentialCount [ serviceCred ] = 1
93
- #let the user know a new service account has been detected for possible lateral movement opportunities
93
+ # let the user know a new service account has been detected for possible lateral
94
+ # movement opportunities
94
95
print_good ( "New service credential detected: #{ sname } is running as '#{ srv_conf [ 'Credentials' ] } '" )
95
96
end
96
97
end
97
98
98
- #if we are still good return the info
99
+ # if we are still good return the info
99
100
if isgood
100
101
msgString = "\t Name: #{ sname } "
101
102
msgString << "\n \t \t Startup: #{ srv_conf [ 'Startup' ] } "
@@ -114,7 +115,7 @@ def run
114
115
print_error ( "Problem enumerating services" )
115
116
end
116
117
end
117
- #store loot on completion of collection
118
+ # store loot on completion of collection
118
119
p = store_loot ( "windows.services" , "text/plain" , session , lootString , "windows_services.txt" , "Windows Services" )
119
120
print_good ( "Loot file stored in: #{ p . to_s } " )
120
121
end
0 commit comments