Simple fixes

1 files changed, 238 insertions, 0 deletions

diff --git a/internal/exec/scmr/scmr.go b/internal/exec/scmr/scmr.go
new file mode 100644
index 0000000..3a6ae08
--- /dev/null
+++ b/internal/exec/scmr/scmr.go
@@ -0,0 +1,238 @@
+package scmrexec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/FalconOpsLLC/goexec/internal/exec"
+	"github.com/FalconOpsLLC/goexec/internal/util"
+	"github.com/FalconOpsLLC/goexec/internal/windows"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+)
+
+type service struct {
+	name         string
+	exec         string
+	createConfig *MethodCreateConfig
+	modifyConfig *MethodModifyConfig
+
+	svcState  uint32
+	svcConfig *svcctl.QueryServiceConfigW
+	handle    *svcctl.Handle
+}
+
+// openSCM opens a handle to SCM via ROpenSCManagerW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/dc84adb3-d51d-48eb-820d-ba1c6ca5faf2
+func (mod *Module) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) {
+	if mod.ctl != nil {
+
+		hostname := mod.hostname
+		if hostname == "" {
+			hostname = util.RandomHostname()
+		}
+		if response, err := mod.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{
+			MachineName:   hostname + "\x00",    // lpMachineName; The server's name (i.e. DC01, dc01.domain.local)
+			DatabaseName:  "ServicesActive\x00", // lpDatabaseName; must be "ServicesActive" or "ServicesFailed"
+			DesiredAccess: ServiceModifyAccess,  // dwDesiredAccess; requested access - appears to be ignored?
+		}); err != nil {
+
+			if response != nil {
+				return nil, response.Return, fmt.Errorf("open scm response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open scm: %w", err)
+		} else {
+			return response.SCM, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// createService creates a service with the provided configuration via RCreateServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6a8ca926-9477-4dd4-b766-692fab07227e
+func (mod *Module) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil {
+		cfg := scfg.createConfig
+		if response, err := mod.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    cfg.ServiceName + "\x00",
+			DisplayName:    cfg.DisplayName + "\x00",
+			BinaryPathName: ecfg.GetRawCommand() + "\x00",
+			ServiceType:    cfg.ServiceType,
+			StartType:      cfg.StartType,
+			DesiredAccess:  ServiceCreateAccess,
+		}); err != nil {
+
+			if response != nil {
+				return response.Return, fmt.Errorf("create service response: %w", err)
+			}
+			return 0, fmt.Errorf("create service: %w", err)
+		} else {
+			scfg.handle = response.Service
+			return response.Return, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// openService opens a handle to a service given the service name (lpServiceName)
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6d0a4225-451b-4132-894d-7cef7aecfd2d
+func (mod *Module) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) {
+	if mod.ctl != nil && scm != nil {
+		if openResponse, err := mod.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    svcName,
+			DesiredAccess:  ServiceAllAccess,
+		}); err != nil {
+			if openResponse != nil {
+				if openResponse.Return == windows.ERROR_SERVICE_DOES_NOT_EXIST {
+					return nil, openResponse.Return, fmt.Errorf("remote service does not exist: %s", svcName)
+				}
+				return nil, openResponse.Return, fmt.Errorf("open service response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open service: %w", err)
+		} else {
+			return openResponse.Service, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// deleteService deletes an existing service with RDeleteService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6744cdb8-f162-4be0-bb31-98996b6495be
+func (mod *Module) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if deleteResponse, err := mod.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil {
+			defer func() {}()
+			if deleteResponse != nil {
+				return deleteResponse.Return, fmt.Errorf("delete service response: %w", err)
+			}
+			return 0, fmt.Errorf("delete service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// controlService sets the state of the provided process
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (mod *Module) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if controlResponse, err := mod.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{
+			Service: svc.handle,
+			Control: control,
+		}); err != nil {
+			if controlResponse != nil {
+				return controlResponse.Return, fmt.Errorf("control service response: %w", err)
+			}
+			return 0, fmt.Errorf("control service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// stopService sends stop signal to existing service using controlService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (mod *Module) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if code, err = mod.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE {
+		err = nil
+	}
+	return
+}
+
+// startService starts the specified service with RStartServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/d9be95a2-cf01-4bdc-b30f-6fe4b37ada16
+func (mod *Module) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if startResponse, err := mod.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil {
+			if startResponse != nil {
+				// TODO: check if service is already running, return nil error if so
+				if startResponse.Return == windows.ERROR_SERVICE_REQUEST_TIMEOUT {
+					return 0, nil
+				}
+				return startResponse.Return, fmt.Errorf("start service response: %w", err)
+			}
+			return 0, fmt.Errorf("start service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// closeService closes the specified service handle using RCloseServiceHandle
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/a2a4e174-09fb-4e55-bad3-f77c4b13245c
+func (mod *Module) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil {
+		if closeResponse, err := mod.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil {
+			if closeResponse != nil {
+				return closeResponse.Return, fmt.Errorf("close service response: %w", err)
+			}
+			return 0, fmt.Errorf("close service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// getServiceConfig fetches the configuration details of a service given a handle passed in a service{} structure.
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/89e2d5b1-19cf-44ca-969f-38eea9fe7f3c
+func (mod *Module) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if getResponse, err := mod.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{
+			Service:      svc.handle,
+			BufferLength: 1024 * 8,
+		}); err != nil {
+			if getResponse != nil {
+				return getResponse.Return, fmt.Errorf("get service config response: %w", err)
+			}
+			return 0, fmt.Errorf("get service config: %w", err)
+		} else {
+			svc.svcConfig = getResponse.ServiceConfig
+			return code, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// queryServiceStatus fetches the state of the specified service
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/cf94d915-b4e1-40e5-872b-a9cb3ad09b46
+func (mod *Module) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) {
+	if mod.ctl != nil && svc != nil {
+		if queryResponse, err := mod.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil {
+			if queryResponse != nil {
+				return queryResponse.Return, fmt.Errorf("query service status response: %w", err)
+			}
+			return 0, fmt.Errorf("query service status: %w", err)
+		} else {
+			svc.svcState = queryResponse.ServiceStatus.CurrentState
+			return 0, nil
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// changeServiceConfigBinary edits the provided service's lpBinaryPathName
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/61ea7ed0-c49d-4152-a164-b4830f16c8a4
+func (mod *Module) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if changeResponse, err := mod.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{
+			Service:        svc.handle,
+			ServiceType:    svc.svcConfig.ServiceType,
+			StartType:      svc.svcConfig.StartType,
+			ErrorControl:   svc.svcConfig.ErrorControl,
+			BinaryPathName: bin + "\x00",
+			LoadOrderGroup: svc.svcConfig.LoadOrderGroup,
+			TagID:          svc.svcConfig.TagID,
+			// Dependencies: svc.svcConfig.Dependencies // TODO
+			ServiceStartName: svc.svcConfig.ServiceStartName,
+			DisplayName:      svc.svcConfig.DisplayName,
+		}); err != nil {
+			if changeResponse != nil {
+				return changeResponse.Return, fmt.Errorf("change service config response: %w", err)
+			}
+			return 0, fmt.Errorf("change service config: %w", err)
+		}
+		return
+	}
+	return 0, errors.New("invalid arguments")
+}