Simple fixes

11 files changed, 1145 insertions, 0 deletions

diff --git a/internal/client/dcerpc/client.go b/internal/client/dcerpc/client.go
new file mode 100644
index 0000000..d9d8d71
--- /dev/null
+++ b/internal/client/dcerpc/client.go
@@ -0,0 +1,11 @@
+package dcerpc
+
+import (
+	"context"
+	"github.com/RedTeamPentesting/adauth"
+)
+
+type Client interface {
+	Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target) error
+	Close(ctx context.Context) error
+}
diff --git a/internal/client/dcerpc/dcerpc.go b/internal/client/dcerpc/dcerpc.go
new file mode 100644
index 0000000..5c9a734
--- /dev/null
+++ b/internal/client/dcerpc/dcerpc.go
@@ -0,0 +1,106 @@
+package dcerpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/RedTeamPentesting/adauth"
+	"github.com/RedTeamPentesting/adauth/dcerpcauth"
+	"github.com/oiweiwei/go-msrpc/dcerpc"
+	"github.com/oiweiwei/go-msrpc/msrpc/epm/epm/v3"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+	"github.com/oiweiwei/go-msrpc/smb2"
+	"github.com/oiweiwei/go-msrpc/ssp/gssapi"
+	"github.com/rs/zerolog"
+)
+
+const (
+	DceDefaultProto string = "ncacn_np"
+	DceDefaultPort  uint16 = 445
+)
+
+type DCEClient struct {
+	Port  uint16
+	Proto string
+
+	log      zerolog.Logger
+	conn     dcerpc.Conn
+	opts     []dcerpc.Option
+	authOpts dcerpcauth.Options
+}
+
+func NewDCEClient(ctx context.Context, insecure bool, smbConfig *SmbConfig) (client *DCEClient) {
+	client = &DCEClient{
+		Port:     DceDefaultPort,
+		Proto:    DceDefaultProto,
+		log:      zerolog.Ctx(ctx).With().Str("client", "DCE").Logger(),
+		authOpts: dcerpcauth.Options{},
+	}
+	client.opts = []dcerpc.Option{dcerpc.WithLogger(client.log)}
+	client.authOpts = dcerpcauth.Options{Debug: client.log.Trace().Msgf}
+
+	if smbConfig != nil {
+		if smbConfig.Port != 0 {
+			client.Port = smbConfig.Port
+			client.opts = append(client.opts, dcerpc.WithSMBPort(int(smbConfig.Port)))
+		}
+	}
+	if insecure {
+		client.log.Debug().Msg("Using insecure DCERPC connection")
+		client.opts = append(client.opts, dcerpc.WithInsecure())
+	} else {
+		client.log.Debug().Msg("Using secure DCERPC connection")
+		client.authOpts.SMBOptions = append(client.authOpts.SMBOptions, smb2.WithSeal())
+	}
+	return
+}
+
+func (client *DCEClient) OpenSvcctl(ctx context.Context) (ctl svcctl.SvcctlClient, err error) {
+	if client.conn == nil {
+		return nil, errors.New("DCE connection not open")
+	}
+	if ctl, err = svcctl.NewSvcctlClient(ctx, client.conn, dcerpc.WithInsecure()); err != nil {
+		client.log.Debug().Err(err).Msg("Failed to open Svcctl client")
+	}
+	return
+}
+
+func (client *DCEClient) DCE() dcerpc.Conn {
+	return client.conn
+}
+
+func (client *DCEClient) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target, dialOpts ...dcerpc.Option) (err error) {
+	if creds != nil && target != nil {
+		authCtx := gssapi.NewSecurityContext(ctx)
+
+		binding := fmt.Sprintf(`%s:%s`, client.Proto, target.AddressWithoutPort())
+		mapper := epm.EndpointMapper(ctx, fmt.Sprintf("%s:%d", target.AddressWithoutPort(), client.Port), dcerpc.WithLogger(client.log))
+		dceOpts := []dcerpc.Option{dcerpc.WithLogger(client.log), dcerpc.WithSeal()}
+
+		if dceOpts, err = dcerpcauth.AuthenticationOptions(authCtx, creds, target, &client.authOpts); err == nil {
+			dceOpts = append(dceOpts, mapper)
+			dceOpts = append(dceOpts, client.opts...)
+			dceOpts = append(dceOpts, dialOpts...)
+
+			if client.conn, err = dcerpc.Dial(authCtx, binding, dceOpts...); err == nil {
+				client.log.Debug().Msg("Bind successful")
+				return nil
+			}
+			client.log.Debug().Err(err).Msg("DCERPC bind failed")
+			return errors.New("bind failed")
+		}
+		return errors.New("unable to parse DCE authentication options")
+	}
+	return errors.New("invalid arguments")
+}
+
+func (client *DCEClient) Close(ctx context.Context) (err error) {
+	if client.conn == nil {
+		client.log.Debug().Msg("Connection already closed")
+	} else if err = client.conn.Close(ctx); err == nil {
+		client.log.Debug().Msg("Connection closed successfully")
+	} else {
+		client.log.Error().Err(err).Msg("Failed to close connection")
+	}
+	return
+}
diff --git a/internal/client/dcerpc/smb.go b/internal/client/dcerpc/smb.go
new file mode 100644
index 0000000..cab82eb
--- /dev/null
+++ b/internal/client/dcerpc/smb.go
@@ -0,0 +1,13 @@
+package dcerpc
+
+import "github.com/oiweiwei/go-msrpc/smb2"
+
+const (
+	SmbDefaultPort = 445
+)
+
+type SmbConfig struct {
+	Port         uint16
+	FullSecurity bool
+	ForceDialect smb2.Dialect
+}
diff --git a/internal/exec/exec.go b/internal/exec/exec.go
new file mode 100644
index 0000000..16fa543
--- /dev/null
+++ b/internal/exec/exec.go
@@ -0,0 +1,44 @@
+package exec
+
+import (
+	"context"
+	"github.com/RedTeamPentesting/adauth"
+)
+
+type CleanupConfig struct {
+	CleanupMethod       string
+	CleanupMethodConfig interface{}
+}
+
+type ExecutionConfig struct {
+	ExecutableName string // ExecutableName represents the name of the executable; i.e. "notepad.exe", "calc"
+	ExecutablePath string // ExecutablePath represents the full path to the executable; i.e. `C:\Windows\explorer.exe`
+	ExecutableArgs string // ExecutableArgs represents the arguments to be passed to the executable during execution; i.e. "/C whoami"
+
+	ExecutionMethod       string // ExecutionMethod represents the specific execution strategy used by the module.
+	ExecutionMethodConfig interface{}
+	ExecutionOutput       string      // not implemented
+	ExecutionOutputConfig interface{} // not implemented
+}
+
+type ShellConfig struct {
+	ShellName string // ShellName specifies the name of the shell executable; i.e. "cmd.exe", "powershell"
+	ShellPath string // ShellPath is the full Windows path to the shell executable; i.e. `C:\Windows\System32\cmd.exe`
+}
+
+type Module interface {
+	// Exec performs a single execution task without the need to call Init.
+	Exec(context.Context, *adauth.Credential, *adauth.Target, *ExecutionConfig) error
+	Cleanup(context.Context, *adauth.Credential, *adauth.Target, *CleanupConfig) error
+
+	// Init assigns the provided TODO
+	//Init(ctx context.Context, creds *adauth.Credential, target *adauth.Target)
+	//Shell(ctx context.Context, input chan *ExecutionConfig, output chan []byte)
+}
+
+func (cfg *ExecutionConfig) GetRawCommand() string {
+	if cfg.ExecutableArgs != "" {
+		return cfg.ExecutablePath + " " + cfg.ExecutableArgs
+	}
+	return cfg.ExecutablePath
+}
diff --git a/internal/exec/scmr/exec.go b/internal/exec/scmr/exec.go
new file mode 100644
index 0000000..41c5d8a
--- /dev/null
+++ b/internal/exec/scmr/exec.go
@@ -0,0 +1,226 @@
+package scmrexec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	dcerpc2 "github.com/FalconOpsLLC/goexec/internal/client/dcerpc"
+	"github.com/FalconOpsLLC/goexec/internal/exec"
+	"github.com/FalconOpsLLC/goexec/internal/windows"
+	"github.com/RedTeamPentesting/adauth"
+	"github.com/rs/zerolog"
+)
+
+const (
+	MethodCreate string = "create"
+	MethodModify string = "modify"
+
+	ServiceModifyAccess uint32 = windows.SERVICE_QUERY_CONFIG | windows.SERVICE_CHANGE_CONFIG | windows.SERVICE_STOP | windows.SERVICE_START | windows.SERVICE_DELETE
+	ServiceCreateAccess uint32 = windows.SC_MANAGER_CREATE_SERVICE | windows.SERVICE_START | windows.SERVICE_STOP | windows.SERVICE_DELETE
+	ServiceAllAccess    uint32 = ServiceCreateAccess | ServiceModifyAccess
+)
+
+func (mod *Module) createClients(ctx context.Context) (cleanup func(cCtx context.Context), err error) {
+
+	cleanup = func(context.Context) {
+		if mod.dce != nil {
+			mod.log.Debug().Msg("Cleaning up clients")
+			if err := mod.dce.Close(ctx); err != nil {
+				mod.log.Error().Err(err).Msg("Failed to destroy DCE connection")
+			}
+		}
+	}
+	cleanup(ctx)
+	mod.dce = dcerpc2.NewDCEClient(ctx, false, &dcerpc2.SmbConfig{Port: 445})
+	cleanup = func(context.Context) {}
+
+	if err = mod.dce.Connect(ctx, mod.creds, mod.target); err != nil {
+		return nil, fmt.Errorf("connection to DCERPC failed: %w", err)
+	}
+	mod.ctl, err = mod.dce.OpenSvcctl(ctx)
+	return
+}
+
+func (mod *Module) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
+
+	vctx := context.WithoutCancel(ctx)
+	mod.log = zerolog.Ctx(ctx).With().
+		Str("module", "scmr").
+		Str("method", ecfg.ExecutionMethod).Logger()
+	mod.creds = creds
+	mod.target = target
+
+	if ecfg.ExecutionMethod == MethodCreate {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodCreateConfig); !ok || cfg.ServiceName == "" {
+			return errors.New("invalid configuration")
+		} else {
+			if cleanup, err := mod.createClients(ctx); err != nil {
+				return fmt.Errorf("failed to create client: %w", err)
+			} else {
+				mod.log.Debug().Msg("Created clients")
+				defer cleanup(ctx)
+			}
+			svc := &service{
+				createConfig: &cfg,
+				name:         cfg.ServiceName,
+			}
+			scm, code, err := mod.openSCM(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to open SCM with code %d: %w", code, err)
+			}
+			mod.log.Debug().Msg("Opened handle to SCM")
+			code, err = mod.createService(ctx, scm, svc, ecfg)
+			if err != nil {
+				return fmt.Errorf("failed to create service with code %d: %w", code, err)
+			}
+			mod.log.Info().Str("service", svc.name).Msg("Service created")
+			// From here on out, make sure the service is properly deleted, even if the connection drops or something fails.
+			if !cfg.NoDelete {
+				defer func() {
+					// TODO: stop service?
+					if code, err = mod.deleteService(ctx, scm, svc); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to delete service") // TODO
+					}
+					mod.log.Info().Str("service", svc.name).Msg("Service deleted successfully")
+				}()
+			}
+			if code, err = mod.startService(ctx, scm, svc); err != nil {
+				if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+					// In case of timeout or cancel, try to reestablish a connection to restore the service
+					mod.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+					mod.log.Info().Msg("Reconnecting for cleanup procedure")
+					ctx = vctx
+
+					if _, err = mod.createClients(ctx); err != nil {
+						mod.log.Error().Err(err).Msg("Reconnect failed")
+
+					} else if scm, code, err = mod.openSCM(ctx); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to reopen SCM")
+
+					} else if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
+						mod.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+
+					} else {
+						mod.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+					}
+				} else {
+					mod.log.Error().Err(err).Msg("Failed to start service")
+				}
+			} else {
+				mod.log.Info().Str("service", svc.name).Msg("Execution successful")
+			}
+		}
+	} else if ecfg.ExecutionMethod == MethodModify {
+		// Use service modification method
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodModifyConfig); !ok || cfg.ServiceName == "" {
+			return errors.New("invalid configuration")
+
+		} else {
+			// Ensure that a command (executable full path + args) is supplied
+			cmd := ecfg.GetRawCommand()
+			if cmd == "" {
+				return errors.New("no command provided")
+			}
+
+			// Initialize protocol clients
+			if cleanup, err := mod.createClients(ctx); err != nil {
+				return fmt.Errorf("failed to create client: %w", err)
+			} else {
+				mod.log.Debug().Msg("Created clients")
+				defer cleanup(ctx)
+			}
+			svc := &service{modifyConfig: &cfg, name: cfg.ServiceName}
+
+			// Open SCM handle
+			scm, code, err := mod.openSCM(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to create service with code %d: %w", code, err)
+			}
+			mod.log.Debug().Msg("Opened handle to SCM")
+
+			// Open service handle
+			if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
+				return fmt.Errorf("failed to open service with code %d: %w", code, err)
+			}
+			mod.log.Debug().Str("service", svc.name).Msg("Opened service")
+
+			// Stop service before editing
+			if !cfg.NoStart {
+				if code, err = mod.stopService(ctx, scm, svc); err != nil {
+					mod.log.Warn().Err(err).Msg("Failed to stop existing service")
+				} else if code == windows.ERROR_SERVICE_NOT_ACTIVE {
+					mod.log.Debug().Str("service", svc.name).Msg("Service is not running")
+				} else {
+					mod.log.Info().Str("service", svc.name).Msg("Stopped existing service")
+					defer func() {
+						if code, err = mod.startService(ctx, scm, svc); err != nil {
+							mod.log.Error().Err(err).Msg("Failed to restore service state to running")
+						}
+					}()
+				}
+			}
+			if code, err = mod.queryServiceConfig(ctx, svc); err != nil {
+				return fmt.Errorf("failed to query service configuration with code %d: %w", code, err)
+			}
+			mod.log.Debug().
+				Str("service", svc.name).
+				Str("command", svc.svcConfig.BinaryPathName).Msg("Fetched existing service configuration")
+
+			// Change service configuration
+			if code, err = mod.changeServiceConfigBinary(ctx, svc, cmd); err != nil {
+				return fmt.Errorf("failed to edit service configuration with code %d: %w", code, err)
+			}
+			defer func() {
+				// Revert configuration
+				if code, err = mod.changeServiceConfigBinary(ctx, svc, svc.svcConfig.BinaryPathName); err != nil {
+					mod.log.Error().Err(err).Msg("Failed to restore service configuration")
+				} else {
+					mod.log.Info().Str("service", svc.name).Msg("Restored service configuration")
+				}
+			}()
+			mod.log.Info().
+				Str("service", svc.name).
+				Str("command", cmd).Msg("Changed service configuration")
+
+			// Start service
+			if !cfg.NoStart {
+				if code, err = mod.startService(ctx, scm, svc); err != nil {
+					if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+						// In case of timeout or cancel, try to reestablish a connection to restore the service
+						mod.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+						mod.log.Info().Msg("Reconnecting for cleanup procedure")
+						ctx = vctx
+
+						if _, err = mod.createClients(ctx); err != nil {
+							mod.log.Error().Err(err).Msg("Reconnect failed")
+
+						} else if scm, code, err = mod.openSCM(ctx); err != nil {
+							mod.log.Error().Err(err).Msg("Failed to reopen SCM")
+
+						} else if svc.handle, code, err = mod.openService(ctx, scm, svc.name); err != nil {
+							mod.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+
+						} else {
+							mod.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+						}
+					} else {
+						mod.log.Error().Err(err).Msg("Failed to start service")
+					}
+				} else {
+					mod.log.Info().Str("service", svc.name).Msg("Started service")
+				}
+				defer func() {
+					// Stop service
+					if code, err = mod.stopService(ctx, scm, svc); err != nil {
+						mod.log.Error().Err(err).Msg("Failed to stop service")
+					} else {
+						mod.log.Info().Str("service", svc.name).Msg("Stopped service")
+					}
+				}()
+			}
+		}
+	} else {
+		return fmt.Errorf("invalid method: %s", ecfg.ExecutionMethod)
+	}
+	return err
+}
diff --git a/internal/exec/scmr/module.go b/internal/exec/scmr/module.go
new file mode 100644
index 0000000..95977b8
--- /dev/null
+++ b/internal/exec/scmr/module.go
@@ -0,0 +1,31 @@
+package scmrexec
+
+import (
+	"github.com/FalconOpsLLC/goexec/internal/client/dcerpc"
+	"github.com/RedTeamPentesting/adauth"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+	"github.com/rs/zerolog"
+)
+
+type Module struct {
+	creds    *adauth.Credential
+	target   *adauth.Target
+	hostname string
+
+	log zerolog.Logger
+	dce *dcerpc.DCEClient
+	ctl svcctl.SvcctlClient
+}
+
+type MethodCreateConfig struct {
+	NoDelete    bool
+	ServiceName string
+	DisplayName string
+	ServiceType uint32
+	StartType   uint32
+}
+
+type MethodModifyConfig struct {
+	NoStart     bool
+	ServiceName string
+}
diff --git a/internal/exec/scmr/scmr.go b/internal/exec/scmr/scmr.go
new file mode 100644
index 0000000..3a6ae08
--- /dev/null
+++ b/internal/exec/scmr/scmr.go
@@ -0,0 +1,238 @@
+package scmrexec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/FalconOpsLLC/goexec/internal/exec"
+	"github.com/FalconOpsLLC/goexec/internal/util"
+	"github.com/FalconOpsLLC/goexec/internal/windows"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+)
+
+type service struct {
+	name         string
+	exec         string
+	createConfig *MethodCreateConfig
+	modifyConfig *MethodModifyConfig
+
+	svcState  uint32
+	svcConfig *svcctl.QueryServiceConfigW
+	handle    *svcctl.Handle
+}
+
+// openSCM opens a handle to SCM via ROpenSCManagerW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/dc84adb3-d51d-48eb-820d-ba1c6ca5faf2
+func (mod *Module) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) {
+	if mod.ctl != nil {
+
+		hostname := mod.hostname
+		if hostname == "" {
+			hostname = util.RandomHostname()
+		}
+		if response, err := mod.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{
+			MachineName:   hostname + "\x00",    // lpMachineName; The server's name (i.e. DC01, dc01.domain.local)
+			DatabaseName:  "ServicesActive\x00", // lpDatabaseName; must be "ServicesActive" or "ServicesFailed"
+			DesiredAccess: ServiceModifyAccess,  // dwDesiredAccess; requested access - appears to be ignored?
+		}); err != nil {
+
+			if response != nil {
+				return nil, response.Return, fmt.Errorf("open scm response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open scm: %w", err)
+		} else {
+			return response.SCM, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// createService creates a service with the provided configuration via RCreateServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6a8ca926-9477-4dd4-b766-692fab07227e
+func (mod *Module) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil {
+		cfg := scfg.createConfig
+		if response, err := mod.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    cfg.ServiceName + "\x00",
+			DisplayName:    cfg.DisplayName + "\x00",
+			BinaryPathName: ecfg.GetRawCommand() + "\x00",
+			ServiceType:    cfg.ServiceType,
+			StartType:      cfg.StartType,
+			DesiredAccess:  ServiceCreateAccess,
+		}); err != nil {
+
+			if response != nil {
+				return response.Return, fmt.Errorf("create service response: %w", err)
+			}
+			return 0, fmt.Errorf("create service: %w", err)
+		} else {
+			scfg.handle = response.Service
+			return response.Return, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// openService opens a handle to a service given the service name (lpServiceName)
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6d0a4225-451b-4132-894d-7cef7aecfd2d
+func (mod *Module) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) {
+	if mod.ctl != nil && scm != nil {
+		if openResponse, err := mod.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    svcName,
+			DesiredAccess:  ServiceAllAccess,
+		}); err != nil {
+			if openResponse != nil {
+				if openResponse.Return == windows.ERROR_SERVICE_DOES_NOT_EXIST {
+					return nil, openResponse.Return, fmt.Errorf("remote service does not exist: %s", svcName)
+				}
+				return nil, openResponse.Return, fmt.Errorf("open service response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open service: %w", err)
+		} else {
+			return openResponse.Service, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// deleteService deletes an existing service with RDeleteService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6744cdb8-f162-4be0-bb31-98996b6495be
+func (mod *Module) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if deleteResponse, err := mod.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil {
+			defer func() {}()
+			if deleteResponse != nil {
+				return deleteResponse.Return, fmt.Errorf("delete service response: %w", err)
+			}
+			return 0, fmt.Errorf("delete service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// controlService sets the state of the provided process
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (mod *Module) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if controlResponse, err := mod.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{
+			Service: svc.handle,
+			Control: control,
+		}); err != nil {
+			if controlResponse != nil {
+				return controlResponse.Return, fmt.Errorf("control service response: %w", err)
+			}
+			return 0, fmt.Errorf("control service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// stopService sends stop signal to existing service using controlService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (mod *Module) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if code, err = mod.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE {
+		err = nil
+	}
+	return
+}
+
+// startService starts the specified service with RStartServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/d9be95a2-cf01-4bdc-b30f-6fe4b37ada16
+func (mod *Module) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && scm != nil && svc != nil {
+		if startResponse, err := mod.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil {
+			if startResponse != nil {
+				// TODO: check if service is already running, return nil error if so
+				if startResponse.Return == windows.ERROR_SERVICE_REQUEST_TIMEOUT {
+					return 0, nil
+				}
+				return startResponse.Return, fmt.Errorf("start service response: %w", err)
+			}
+			return 0, fmt.Errorf("start service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// closeService closes the specified service handle using RCloseServiceHandle
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/a2a4e174-09fb-4e55-bad3-f77c4b13245c
+func (mod *Module) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil {
+		if closeResponse, err := mod.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil {
+			if closeResponse != nil {
+				return closeResponse.Return, fmt.Errorf("close service response: %w", err)
+			}
+			return 0, fmt.Errorf("close service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// getServiceConfig fetches the configuration details of a service given a handle passed in a service{} structure.
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/89e2d5b1-19cf-44ca-969f-38eea9fe7f3c
+func (mod *Module) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if getResponse, err := mod.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{
+			Service:      svc.handle,
+			BufferLength: 1024 * 8,
+		}); err != nil {
+			if getResponse != nil {
+				return getResponse.Return, fmt.Errorf("get service config response: %w", err)
+			}
+			return 0, fmt.Errorf("get service config: %w", err)
+		} else {
+			svc.svcConfig = getResponse.ServiceConfig
+			return code, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// queryServiceStatus fetches the state of the specified service
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/cf94d915-b4e1-40e5-872b-a9cb3ad09b46
+func (mod *Module) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) {
+	if mod.ctl != nil && svc != nil {
+		if queryResponse, err := mod.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil {
+			if queryResponse != nil {
+				return queryResponse.Return, fmt.Errorf("query service status response: %w", err)
+			}
+			return 0, fmt.Errorf("query service status: %w", err)
+		} else {
+			svc.svcState = queryResponse.ServiceStatus.CurrentState
+			return 0, nil
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// changeServiceConfigBinary edits the provided service's lpBinaryPathName
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/61ea7ed0-c49d-4152-a164-b4830f16c8a4
+func (mod *Module) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) {
+	if mod.ctl != nil && svc != nil && svc.handle != nil {
+		if changeResponse, err := mod.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{
+			Service:        svc.handle,
+			ServiceType:    svc.svcConfig.ServiceType,
+			StartType:      svc.svcConfig.StartType,
+			ErrorControl:   svc.svcConfig.ErrorControl,
+			BinaryPathName: bin + "\x00",
+			LoadOrderGroup: svc.svcConfig.LoadOrderGroup,
+			TagID:          svc.svcConfig.TagID,
+			// Dependencies: svc.svcConfig.Dependencies // TODO
+			ServiceStartName: svc.svcConfig.ServiceStartName,
+			DisplayName:      svc.svcConfig.DisplayName,
+		}); err != nil {
+			if changeResponse != nil {
+				return changeResponse.Return, fmt.Errorf("change service config response: %w", err)
+			}
+			return 0, fmt.Errorf("change service config: %w", err)
+		}
+		return
+	}
+	return 0, errors.New("invalid arguments")
+}
diff --git a/internal/exec/tsch/exec.go b/internal/exec/tsch/exec.go
new file mode 100644
index 0000000..51f157c
--- /dev/null
+++ b/internal/exec/tsch/exec.go
@@ -0,0 +1,289 @@
+package tschexec
+
+import (
+	"context"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	dcerpc2 "github.com/FalconOpsLLC/goexec/internal/client/dcerpc"
+	"github.com/FalconOpsLLC/goexec/internal/exec"
+	"github.com/FalconOpsLLC/goexec/internal/util"
+	"github.com/RedTeamPentesting/adauth"
+	"github.com/oiweiwei/go-msrpc/dcerpc"
+	"github.com/oiweiwei/go-msrpc/msrpc/tsch/itaskschedulerservice/v1"
+	"github.com/rs/zerolog"
+	"regexp"
+	"time"
+)
+
+const (
+	TaskXMLDurationFormat = "2006-01-02T15:04:05.9999999Z"
+	TaskXMLHeader         = `<?xml version="1.0" encoding="UTF-16"?>`
+)
+
+var (
+	TaskPathRegex = regexp.MustCompile(`^\\[^ :/\\][^:/]*$`) // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/fa8809c8-4f0f-4c6d-994a-6c10308757c1
+	TaskNameRegex = regexp.MustCompile(`^[^ :/\\][^:/\\]*$`)
+)
+
+// *very* simple implementation of xs:duration - only accepts +seconds
+func xmlDuration(dur time.Duration) string {
+	if s := int(dur.Seconds()); s >= 0 {
+		return fmt.Sprintf(`PT%dS`, s)
+	}
+	return `PT0S`
+}
+
+// Connect to the target & initialize DCE & TSCH clients
+func (mod *Module) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target) (err error) {
+	if mod.dce == nil {
+		mod.dce = dcerpc2.NewDCEClient(ctx, false, &dcerpc2.SmbConfig{})
+		if err = mod.dce.Connect(ctx, creds, target); err != nil {
+			return fmt.Errorf("DCE connect: %w", err)
+		} else if mod.tsch, err = itaskschedulerservice.NewTaskSchedulerServiceClient(ctx, mod.dce.DCE(), dcerpc.WithSecurityLevel(dcerpc.AuthLevelPktPrivacy)); err != nil {
+			return fmt.Errorf("init MS-TSCH client: %w", err)
+		}
+		mod.log.Info().Msg("DCE connection successful")
+	}
+	return
+}
+
+func (mod *Module) Cleanup(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ccfg *exec.CleanupConfig) (err error) {
+	mod.log = zerolog.Ctx(ctx).With().
+		Str("module", "tsch").
+		Str("method", ccfg.CleanupMethod).Logger()
+	mod.creds = creds
+	mod.target = target
+
+	if ccfg.CleanupMethod == MethodDelete {
+		if cfg, ok := ccfg.CleanupMethodConfig.(MethodDeleteConfig); !ok {
+			return errors.New("invalid configuration")
+		} else {
+			if err = mod.Connect(ctx, creds, target); err != nil {
+				return fmt.Errorf("connect: %w", err)
+			} else if _, err = mod.tsch.Delete(ctx, &itaskschedulerservice.DeleteRequest{
+				Path:  cfg.TaskPath,
+				Flags: 0,
+			}); err != nil {
+				mod.log.Error().Err(err).Str("task", cfg.TaskPath).Msg("Failed to delete task")
+				return fmt.Errorf("delete task: %w", err)
+			} else {
+				mod.log.Info().Str("task", cfg.TaskPath).Msg("Task deleted successfully")
+			}
+		}
+	} else {
+		return fmt.Errorf("method not implemented: %s", ccfg.CleanupMethod)
+	}
+	return
+}
+
+func (mod *Module) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
+
+	mod.log = zerolog.Ctx(ctx).With().
+		Str("module", "tsch").
+		Str("method", ecfg.ExecutionMethod).Logger()
+	mod.creds = creds
+	mod.target = target
+
+	if ecfg.ExecutionMethod == MethodRegister {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodRegisterConfig); !ok {
+			return errors.New("invalid configuration")
+
+		} else {
+			startTime := time.Now().UTC().Add(cfg.StartDelay)
+			stopTime := startTime.Add(cfg.StopDelay)
+
+			task := &task{
+				TaskVersion:   "1.2",                                                   // static
+				TaskNamespace: "http://schemas.microsoft.com/windows/2004/02/mit/task", // static
+				TimeTriggers: []taskTimeTrigger{
+					{
+						StartBoundary: startTime.Format(TaskXMLDurationFormat),
+						Enabled:       true,
+					},
+				},
+				Principals: defaultPrincipals,
+				Settings:   defaultSettings,
+				Actions: actions{
+					Context: defaultPrincipals.Principals[0].ID,
+					Exec: []actionExec{
+						{
+							Command:   ecfg.ExecutableName,
+							Arguments: ecfg.ExecutableArgs,
+						},
+					},
+				},
+			}
+			if !cfg.NoDelete && !cfg.CallDelete {
+				if cfg.StopDelay == 0 {
+					// EndBoundary cannot be >= StartBoundary
+					cfg.StopDelay = 1 * time.Second
+				}
+				task.Settings.DeleteExpiredTaskAfter = xmlDuration(cfg.DeleteDelay)
+				task.TimeTriggers[0].EndBoundary = stopTime.Format(TaskXMLDurationFormat)
+			}
+
+			if doc, err := xml.Marshal(task); err != nil {
+				return fmt.Errorf("marshal task XML: %w", err)
+
+			} else {
+				mod.log.Debug().Str("task", string(doc)).Msg("Task XML generated")
+				docStr := TaskXMLHeader + string(doc)
+
+				taskPath := cfg.TaskPath
+				taskName := cfg.TaskName
+
+				if taskName == "" {
+					taskName = util.RandomString()
+				}
+				if taskPath == "" {
+					taskPath = `\` + taskName
+				}
+
+				if err = mod.Connect(ctx, creds, target); err != nil {
+					return fmt.Errorf("connect: %w", err)
+				}
+				defer func() {
+					if err = mod.dce.Close(ctx); err != nil {
+						mod.log.Warn().Err(err).Msg("Failed to dispose dce client")
+					} else {
+						mod.log.Debug().Msg("Disposed DCE client")
+					}
+				}()
+				var response *itaskschedulerservice.RegisterTaskResponse
+				if response, err = mod.tsch.RegisterTask(ctx, &itaskschedulerservice.RegisterTaskRequest{
+					Path:       taskPath,
+					XML:        docStr,
+					Flags:      0, // TODO
+					LogonType:  0, // TASK_LOGON_NONE
+					CredsCount: 0,
+					Creds:      nil,
+				}); err != nil {
+					return err
+
+				} else {
+					mod.log.Info().Str("path", response.ActualPath).Msg("Task registered successfully")
+
+					if !cfg.NoDelete {
+						if cfg.CallDelete {
+							defer func() {
+								if err = mod.Cleanup(ctx, creds, target, &exec.CleanupConfig{
+									CleanupMethod:       MethodDelete,
+									CleanupMethodConfig: MethodDeleteConfig{TaskPath: taskPath},
+								}); err != nil {
+									mod.log.Error().Err(err).Msg("Failed to delete task")
+								}
+							}()
+							mod.log.Info().Dur("ms", cfg.StartDelay).Msg("Waiting for task to run")
+							select {
+							case <-ctx.Done():
+								mod.log.Warn().Msg("Cancelling execution")
+								return err
+							case <-time.After(cfg.StartDelay + (time.Second * 2)): // + two seconds
+								// TODO: check if task is running yet; delete if the wait period is over
+								break
+							}
+							return err
+						} else {
+							mod.log.Info().Time("when", stopTime).Msg("Task is scheduled to delete")
+						}
+					}
+				}
+			}
+		}
+	} else if ecfg.ExecutionMethod == MethodDemand {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodDemandConfig); !ok {
+			return errors.New("invalid configuration")
+
+		} else {
+			taskPath := cfg.TaskPath
+			taskName := cfg.TaskName
+
+			if taskName == "" {
+				mod.log.Debug().Msg("Task name not defined. Using random string")
+				taskName = util.RandomString()
+			}
+			if taskPath == "" {
+				taskPath = `\` + taskName
+			}
+			if !TaskNameRegex.MatchString(taskName) {
+				return fmt.Errorf("invalid task name: %s", taskName)
+			}
+			if !TaskPathRegex.MatchString(taskPath) {
+				return fmt.Errorf("invalid task path: %s", taskPath)
+			}
+
+			mod.log.Debug().Msg("Using demand method")
+			settings := defaultSettings
+			settings.AllowStartOnDemand = true
+			task := &task{
+				TaskVersion:   "1.2",                                                   // static
+				TaskNamespace: "http://schemas.microsoft.com/windows/2004/02/mit/task", // static
+				Principals:    defaultPrincipals,
+				Settings:      defaultSettings,
+				Actions: actions{
+					Context: defaultPrincipals.Principals[0].ID,
+					Exec: []actionExec{
+						{
+							Command:   ecfg.ExecutableName,
+							Arguments: ecfg.ExecutableArgs,
+						},
+					},
+				},
+			}
+			if doc, err := xml.Marshal(task); err != nil {
+				return fmt.Errorf("marshal task: %w", err)
+			} else {
+				docStr := TaskXMLHeader + string(doc)
+
+				if err = mod.Connect(ctx, creds, target); err != nil {
+					return fmt.Errorf("connect: %w", err)
+				}
+				defer func() {
+					if err = mod.dce.Close(ctx); err != nil {
+						mod.log.Warn().Err(err).Msg("Failed to dispose dce client")
+					} else {
+						mod.log.Debug().Msg("Disposed DCE client")
+					}
+				}()
+
+				var response *itaskschedulerservice.RegisterTaskResponse
+				if response, err = mod.tsch.RegisterTask(ctx, &itaskschedulerservice.RegisterTaskRequest{
+					Path:       taskPath,
+					XML:        docStr,
+					Flags:      0, // TODO
+					LogonType:  0, // TASK_LOGON_NONE
+					CredsCount: 0,
+					Creds:      nil,
+				}); err != nil {
+					return fmt.Errorf("register task: %w", err)
+
+				} else {
+					mod.log.Info().Str("task", response.ActualPath).Msg("Task registered successfully")
+					if !cfg.NoDelete {
+						defer func() {
+							if err = mod.Cleanup(ctx, creds, target, &exec.CleanupConfig{
+								CleanupMethod:       MethodDelete,
+								CleanupMethodConfig: MethodDeleteConfig{TaskPath: taskPath},
+							}); err != nil {
+								mod.log.Error().Err(err).Msg("Failed to delete task")
+							}
+						}()
+					}
+					if _, err = mod.tsch.Run(ctx, &itaskschedulerservice.RunRequest{
+						Path:  response.ActualPath,
+						Flags: 0, // Maybe we want to use these?
+					}); err != nil {
+						return err
+					} else {
+						mod.log.Info().Str("task", response.ActualPath).Msg("Started task")
+					}
+				}
+			}
+		}
+	} else {
+		return fmt.Errorf("method not implemented: %s", ecfg.ExecutionMethod)
+	}
+
+	return nil
+}
diff --git a/internal/exec/tsch/module.go b/internal/exec/tsch/module.go
new file mode 100644
index 0000000..dbd9ade
--- /dev/null
+++ b/internal/exec/tsch/module.go
@@ -0,0 +1,48 @@
+package tschexec
+
+import (
+	"github.com/FalconOpsLLC/goexec/internal/client/dcerpc"
+	"github.com/RedTeamPentesting/adauth"
+	"github.com/oiweiwei/go-msrpc/msrpc/tsch/itaskschedulerservice/v1"
+	"github.com/rs/zerolog"
+	"time"
+)
+
+type Module struct {
+	creds  *adauth.Credential
+	target *adauth.Target
+
+	log  zerolog.Logger
+	dce  *dcerpc.DCEClient
+	tsch itaskschedulerservice.TaskSchedulerServiceClient
+}
+
+type MethodRegisterConfig struct {
+	NoDelete    bool
+	CallDelete  bool
+	TaskName    string
+	TaskPath    string
+	StartDelay  time.Duration
+	StopDelay   time.Duration
+	DeleteDelay time.Duration
+}
+
+type MethodDemandConfig struct {
+	NoDelete    bool
+	CallDelete  bool
+	TaskName    string
+	TaskPath    string
+	StopDelay   time.Duration
+	DeleteDelay time.Duration
+}
+
+type MethodDeleteConfig struct {
+	TaskPath string
+}
+
+const (
+	MethodRegister string = "register"
+	MethodDemand   string = "demand"
+	MethodDelete   string = "delete"
+	MethodChange   string = "update"
+)
diff --git a/internal/exec/tsch/tsch.go b/internal/exec/tsch/tsch.go
new file mode 100644
index 0000000..bc3ed0b
--- /dev/null
+++ b/internal/exec/tsch/tsch.go
@@ -0,0 +1,102 @@
+package tschexec
+
+import (
+	"encoding/xml"
+)
+
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/0d6383e4-de92-43e7-b0bb-a60cfa36379f
+
+type taskTimeTrigger struct {
+	XMLName       xml.Name `xml:"TimeTrigger"`
+	StartBoundary string   `xml:"StartBoundary,omitempty"` // Derived from time.Time
+	EndBoundary   string   `xml:"EndBoundary,omitempty"`   // Derived from time.Time; must be > StartBoundary
+	Enabled       bool     `xml:"Enabled"`
+}
+
+type idleSettings struct {
+	StopOnIdleEnd bool `xml:"StopOnIdleEnd"`
+	RestartOnIdle bool `xml:"RestartOnIdle"`
+}
+
+type settings struct {
+	XMLName                    xml.Name     `xml:"Settings"`
+	Enabled                    bool         `xml:"Enabled"`
+	Hidden                     bool         `xml:"Hidden"`
+	DisallowStartIfOnBatteries bool         `xml:"DisallowStartIfOnBatteries"`
+	StopIfGoingOnBatteries     bool         `xml:"StopIfGoingOnBatteries"`
+	AllowHardTerminate         bool         `xml:"AllowHardTerminate"`
+	RunOnlyIfNetworkAvailable  bool         `xml:"RunOnlyIfNetworkAvailable"`
+	AllowStartOnDemand         bool         `xml:"AllowStartOnDemand"`
+	WakeToRun                  bool         `xml:"WakeToRun"`
+	RunOnlyIfIdle              bool         `xml:"RunOnlyIfIdle"`
+	StartWhenAvailable         bool         `xml:"StartWhenAvailable"`
+	Priority                   int          `xml:"Priority,omitempty"` // 1 to 10 inclusive
+	MultipleInstancesPolicy    string       `xml:"MultipleInstancesPolicy,omitempty"`
+	ExecutionTimeLimit         string       `xml:"ExecutionTimeLimit,omitempty"`
+	DeleteExpiredTaskAfter     string       `xml:"DeleteExpiredTaskAfter,omitempty"` // Derived from time.Duration
+	IdleSettings               idleSettings `xml:"IdleSettings,omitempty"`
+}
+
+type actionExec struct {
+	XMLName   xml.Name `xml:"Exec"`
+	Command   string   `xml:"Command"`
+	Arguments string   `xml:"Arguments"`
+}
+
+type actions struct {
+	XMLName xml.Name     `xml:"Actions"`
+	Context string       `xml:"Context,attr"`
+	Exec    []actionExec `xml:"Exec,omitempty"`
+}
+
+type principals struct {
+	XMLName    xml.Name    `xml:"Principals"`
+	Principals []principal `xml:"Principal"`
+}
+
+type principal struct {
+	XMLName  xml.Name `xml:"Principal"`
+	ID       string   `xml:"id,attr"`
+	UserID   string   `xml:"UserId"`
+	RunLevel string   `xml:"RunLevel"`
+}
+
+type task struct {
+	XMLName       xml.Name          `xml:"Task"`
+	TaskVersion   string            `xml:"version,attr"`
+	TaskNamespace string            `xml:"xmlns,attr"`
+	TimeTriggers  []taskTimeTrigger `xml:"Triggers>TimeTrigger,omitempty"`
+	Actions       actions           `xml:"Actions"`
+	Principals    principals        `xml:"Principals"`
+	Settings      settings          `xml:"Settings"`
+}
+
+var (
+	defaultSettings = settings{
+		MultipleInstancesPolicy:    "IgnoreNew",
+		DisallowStartIfOnBatteries: false,
+		StopIfGoingOnBatteries:     false,
+		AllowHardTerminate:         true,
+		RunOnlyIfNetworkAvailable:  false,
+		IdleSettings: idleSettings{
+			StopOnIdleEnd: true,
+			RestartOnIdle: false,
+		},
+		AllowStartOnDemand: true,
+		Enabled:            true,
+		Hidden:             true,
+		RunOnlyIfIdle:      false,
+		WakeToRun:          false,
+		Priority:           7, // 7 is a pretty standard value for scheduled tasks
+		StartWhenAvailable: true,
+	}
+	defaultPrincipals = principals{
+		Principals: []principal{
+			{
+				ID:       "SYSTEM",
+				UserID:   "S-1-5-18",
+				RunLevel: "HighestAvailable",
+			},
+		},
+	}
+)
diff --git a/internal/windows/const.go b/internal/windows/const.go
new file mode 100644
index 0000000..4c4fbe6
--- /dev/null
+++ b/internal/windows/const.go
@@ -0,0 +1,37 @@
+package windows
+
+const (
+	// Windows error codes
+	ERROR_FILE_NOT_FOUND          uint32 = 0x00000002
+	ERROR_SERVICE_REQUEST_TIMEOUT uint32 = 0x0000041d
+	ERROR_SERVICE_DOES_NOT_EXIST  uint32 = 0x00000424
+	ERROR_SERVICE_NOT_ACTIVE      uint32 = 0x00000426
+
+	// Windows service/scm constants
+	SERVICE_BOOT_START   uint32 = 0x00000000
+	SERVICE_SYSTEM_START uint32 = 0x00000001
+	SERVICE_AUTO_START   uint32 = 0x00000002
+	SERVICE_DEMAND_START uint32 = 0x00000003
+	SERVICE_DISABLED     uint32 = 0x00000004
+
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/4e91ff36-ab5f-49ed-a43d-a308e72b0b3c
+	SERVICE_CONTINUE_PENDING uint32 = 0x00000005
+	SERVICE_PAUSE_PENDING    uint32 = 0x00000006
+	SERVICE_PAUSED           uint32 = 0x00000007
+	SERVICE_RUNNING          uint32 = 0x00000004
+	SERVICE_START_PENDING    uint32 = 0x00000002
+	SERVICE_STOP_PENDING     uint32 = 0x00000003
+	SERVICE_STOPPED          uint32 = 0x00000001
+
+	SERVICE_WIN32_OWN_PROCESS uint32 = 0x00000010
+
+	SERVICE_CONTROL_STOP      uint32 = 0x00000001
+	SC_MANAGER_CREATE_SERVICE uint32 = 0x00000002
+
+	// https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights
+	SERVICE_QUERY_CONFIG  uint32 = 0x00000001
+	SERVICE_CHANGE_CONFIG uint32 = 0x00000002
+	SERVICE_START         uint32 = 0x00000010
+	SERVICE_STOP          uint32 = 0x00000020
+	SERVICE_DELETE        uint32 = 0x00010000 // special permission
+)