Initial commit +scmrexec

8 files changed, 694 insertions, 0 deletions

diff --git a/pkg/client/dcerpc/client.go b/pkg/client/dcerpc/client.go
new file mode 100644
index 0000000..5b5b935
--- /dev/null
+++ b/pkg/client/dcerpc/client.go
@@ -0,0 +1,11 @@
+package dcerpc
+
+import (
+	"context"
+	"github.com/bryanmcnulty/adauth"
+)
+
+type Client interface {
+	Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target) error
+	Close(ctx context.Context) error
+}
diff --git a/pkg/client/dcerpc/dcerpc.go b/pkg/client/dcerpc/dcerpc.go
new file mode 100644
index 0000000..a22bff7
--- /dev/null
+++ b/pkg/client/dcerpc/dcerpc.go
@@ -0,0 +1,102 @@
+package dcerpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/bryanmcnulty/adauth"
+	"github.com/bryanmcnulty/adauth/dcerpcauth"
+	"github.com/oiweiwei/go-msrpc/dcerpc"
+	"github.com/oiweiwei/go-msrpc/msrpc/epm/epm/v3"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+	"github.com/oiweiwei/go-msrpc/smb2"
+	"github.com/oiweiwei/go-msrpc/ssp/gssapi"
+	"github.com/rs/zerolog"
+)
+
+const (
+	DceDefaultProto string = "ncacn_np"
+	DceDefaultPort  uint16 = 445
+)
+
+type DCEClient struct {
+	Port  uint16
+	Proto string
+
+	log      zerolog.Logger
+	conn     dcerpc.Conn
+	opts     []dcerpc.Option
+	authOpts dcerpcauth.Options
+}
+
+func NewDCEClient(ctx context.Context, insecure bool, smbConfig *SmbConfig) (client *DCEClient) {
+	client = &DCEClient{
+		Port:     DceDefaultPort,
+		Proto:    DceDefaultProto,
+		log:      zerolog.Ctx(ctx).With().Str("client", "DCE").Logger(),
+		authOpts: dcerpcauth.Options{},
+	}
+	client.opts = []dcerpc.Option{dcerpc.WithLogger(client.log)}
+	client.authOpts = dcerpcauth.Options{Debug: client.log.Trace().Msgf}
+
+	if smbConfig != nil {
+		if smbConfig.Port != 0 {
+			client.Port = smbConfig.Port
+			client.opts = append(client.opts, dcerpc.WithSMBPort(int(smbConfig.Port)))
+		}
+	}
+	if insecure {
+		client.log.Debug().Msg("Using insecure DCERPC connection")
+		client.opts = append(client.opts, dcerpc.WithInsecure())
+	} else {
+		client.log.Debug().Msg("Using secure DCERPC connection")
+		client.authOpts.SMBOptions = append(client.authOpts.SMBOptions, smb2.WithSeal())
+	}
+	return
+}
+
+func (client *DCEClient) OpenSvcctl(ctx context.Context) (ctl svcctl.SvcctlClient, err error) {
+	if client.conn == nil {
+		return nil, errors.New("DCE connection not open")
+	}
+	if ctl, err = svcctl.NewSvcctlClient(ctx, client.conn, dcerpc.WithInsecure()); err != nil {
+		client.log.Debug().Err(err).Msg("Failed to open Svcctl client")
+	}
+	return
+}
+
+func (client *DCEClient) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target, dialOpts ...dcerpc.Option) (err error) {
+	if creds != nil && target != nil {
+		authCtx := gssapi.NewSecurityContext(ctx)
+
+		binding := fmt.Sprintf(`%s:%s`, client.Proto, target.AddressWithoutPort())
+		mapper := epm.EndpointMapper(ctx, fmt.Sprintf("%s:%d", target.AddressWithoutPort(), client.Port), dcerpc.WithLogger(client.log))
+		dceOpts := []dcerpc.Option{dcerpc.WithLogger(client.log), dcerpc.WithSeal()}
+
+		if dceOpts, err = dcerpcauth.AuthenticationOptions(authCtx, creds, target, &client.authOpts); err == nil {
+			dceOpts = append(dceOpts, mapper)
+			dceOpts = append(dceOpts, client.opts...)
+			dceOpts = append(dceOpts, dialOpts...)
+
+			if client.conn, err = dcerpc.Dial(authCtx, binding, dceOpts...); err == nil {
+				client.log.Debug().Msg("Bind successful")
+				return nil
+			}
+			client.log.Debug().Err(err).Msg("DCERPC bind failed")
+			return errors.New("bind failed")
+		}
+		return errors.New("unable to parse DCE authentication options")
+	}
+	return errors.New("invalid arguments")
+}
+
+func (client *DCEClient) Close(ctx context.Context) (err error) {
+	if client.conn == nil {
+		client.log.Debug().Msg("Connection already closed")
+	} else if err = client.conn.Close(ctx); err == nil {
+		client.log.Debug().Msg("Connection closed successfully")
+	} else {
+		client.log.Error().Err(err).Msg("Failed to close connection")
+	}
+	return
+}
diff --git a/pkg/client/dcerpc/smb.go b/pkg/client/dcerpc/smb.go
new file mode 100644
index 0000000..cab82eb
--- /dev/null
+++ b/pkg/client/dcerpc/smb.go
@@ -0,0 +1,13 @@
+package dcerpc
+
+import "github.com/oiweiwei/go-msrpc/smb2"
+
+const (
+	SmbDefaultPort = 445
+)
+
+type SmbConfig struct {
+	Port         uint16
+	FullSecurity bool
+	ForceDialect smb2.Dialect
+}
diff --git a/pkg/exec/exec.go b/pkg/exec/exec.go
new file mode 100644
index 0000000..6e18378
--- /dev/null
+++ b/pkg/exec/exec.go
@@ -0,0 +1,38 @@
+package exec
+
+import (
+	"context"
+	"github.com/bryanmcnulty/adauth"
+)
+
+type ExecutionConfig struct {
+	ExecutableName string // ExecutableName represents the name of the executable; i.e. "notepad.exe", "calc"
+	ExecutablePath string // ExecutablePath represents the full path to the executable; i.e. `C:\Windows\explorer.exe`
+	ExecutableArgs string // ExecutableArgs represents the arguments to be passed to the executable during execution; i.e. "/C whoami"
+
+	ExecutionMethod       string // ExecutionMethod represents the specific execution strategy used by the module.
+	ExecutionMethodConfig interface{}
+	ExecutionOutput       string      // not implemented
+	ExecutionOutputConfig interface{} // not implemented
+}
+
+type ShellConfig struct {
+	ShellName string // ShellName specifies the name of the shell executable; i.e. "cmd.exe", "powershell"
+	ShellPath string // ShellPath is the full Windows path to the shell executable; i.e. `C:\Windows\System32\cmd.exe`
+}
+
+type Executor interface {
+	// Exec performs a single execution task without the need to call Init.
+	Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, config *ExecutionConfig)
+
+	// Init assigns the provided TODO
+	//Init(ctx context.Context, creds *adauth.Credential, target *adauth.Target)
+	//Shell(ctx context.Context, input chan *ExecutionConfig, output chan []byte)
+}
+
+func (cfg *ExecutionConfig) GetRawCommand() string {
+	if cfg.ExecutableArgs != "" {
+		return cfg.ExecutablePath + " " + cfg.ExecutableArgs
+	}
+	return cfg.ExecutablePath
+}
diff --git a/pkg/exec/scmr/exec.go b/pkg/exec/scmr/exec.go
new file mode 100644
index 0000000..b3c1531
--- /dev/null
+++ b/pkg/exec/scmr/exec.go
@@ -0,0 +1,224 @@
+package scmrexec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/bryanmcnulty/adauth"
+	"github.com/rs/zerolog"
+	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
+	"github.com/FalconOpsLLC/goexec/pkg/exec"
+	"github.com/FalconOpsLLC/goexec/pkg/windows"
+)
+
+const (
+	MethodCreate string = "create"
+	MethodModify string = "modify"
+
+	ServiceModifyAccess uint32 = windows.SERVICE_QUERY_CONFIG | windows.SERVICE_CHANGE_CONFIG | windows.SERVICE_STOP | windows.SERVICE_START | windows.SERVICE_DELETE
+	ServiceCreateAccess uint32 = windows.SC_MANAGER_CREATE_SERVICE | windows.SERVICE_START | windows.SERVICE_STOP | windows.SERVICE_DELETE
+	ServiceAllAccess    uint32 = ServiceCreateAccess | ServiceModifyAccess
+)
+
+func (executor *Executor) createClients(ctx context.Context) (cleanup func(cCtx context.Context), err error) {
+
+	cleanup = func(context.Context) {
+		if executor.dce != nil {
+			executor.log.Debug().Msg("Cleaning up clients")
+			if err := executor.dce.Close(ctx); err != nil {
+				executor.log.Error().Err(err).Msg("Failed to destroy DCE connection")
+			}
+		}
+	}
+	cleanup(ctx)
+	executor.dce = dcerpc.NewDCEClient(ctx, false, &dcerpc.SmbConfig{Port: 445})
+	cleanup = func(context.Context) {}
+
+	if err = executor.dce.Connect(ctx, executor.creds, executor.target); err != nil {
+		return nil, fmt.Errorf("connection to DCERPC failed: %w", err)
+	}
+	executor.ctl, err = executor.dce.OpenSvcctl(ctx)
+	return
+}
+
+func (executor *Executor) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) {
+
+	vctx := context.WithoutCancel(ctx)
+	executor.log = zerolog.Ctx(ctx).With().
+		Str("module", "scmr").
+		Str("method", ecfg.ExecutionMethod).Logger()
+	executor.creds = creds
+	executor.target = target
+
+	if ecfg.ExecutionMethod == MethodCreate {
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodCreateConfig); !ok || cfg.ServiceName == "" {
+			return errors.New("invalid configuration")
+		} else {
+			if cleanup, err := executor.createClients(ctx); err != nil {
+				return fmt.Errorf("failed to create client: %w", err)
+			} else {
+				executor.log.Debug().Msg("Created clients")
+				defer cleanup(ctx)
+			}
+			svc := &service{
+				createConfig: &cfg,
+				name:         cfg.ServiceName,
+			}
+			scm, code, err := executor.openSCM(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to open SCM with code %d: %w", code, err)
+			}
+			executor.log.Debug().Msg("Opened handle to SCM")
+			code, err = executor.createService(ctx, scm, svc, ecfg)
+			if err != nil {
+				return fmt.Errorf("failed to create service with code %d: %w", code, err)
+			}
+			executor.log.Info().Str("service", svc.name).Msg("Service created")
+			// From here on out, make sure the service is properly deleted, even if the connection drops or something fails.
+			if !cfg.NoDelete {
+				defer func() {
+					// TODO: stop service?
+					if code, err = executor.deleteService(ctx, scm, svc); err != nil {
+						executor.log.Error().Err(err).Msg("Failed to delete service") // TODO
+					}
+					executor.log.Info().Str("service", svc.name).Msg("Service deleted successfully")
+				}()
+			}
+			if code, err = executor.startService(ctx, scm, svc); err != nil {
+				if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+					// In case of timeout or cancel, try to reestablish a connection to restore the service
+					executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+					executor.log.Info().Msg("Reconnecting for cleanup procedure")
+					ctx = vctx
+
+					if _, err = executor.createClients(ctx); err != nil {
+						executor.log.Error().Err(err).Msg("Reconnect failed")
+
+					} else if scm, code, err = executor.openSCM(ctx); err != nil {
+						executor.log.Error().Err(err).Msg("Failed to reopen SCM")
+
+					} else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
+						executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+
+					} else {
+						executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+					}
+				} else {
+					executor.log.Error().Err(err).Msg("Failed to start service")
+				}
+			} else {
+				executor.log.Info().Str("service", svc.name).Msg("Execution successful")
+			}
+		}
+	} else if ecfg.ExecutionMethod == MethodModify {
+		// Use service modification method
+		if cfg, ok := ecfg.ExecutionMethodConfig.(MethodModifyConfig); !ok || cfg.ServiceName == "" {
+			return errors.New("invalid configuration")
+
+		} else {
+			// Ensure that a command (executable full path + args) is supplied
+			cmd := ecfg.GetRawCommand()
+			if cmd == "" {
+				return errors.New("no command provided")
+			}
+
+			// Initialize protocol clients
+			if cleanup, err := executor.createClients(ctx); err != nil {
+				return fmt.Errorf("failed to create client: %w", err)
+			} else {
+				executor.log.Debug().Msg("Created clients")
+				defer cleanup(ctx)
+			}
+			svc := &service{modifyConfig: &cfg, name: cfg.ServiceName}
+
+			// Open SCM handle
+			scm, code, err := executor.openSCM(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to create service with code %d: %w", code, err)
+			}
+			executor.log.Debug().Msg("Opened handle to SCM")
+
+			// Open service handle
+			if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
+				return fmt.Errorf("failed to open service with code %d: %w", code, err)
+			}
+			executor.log.Debug().Str("service", svc.name).Msg("Opened service")
+
+			// Stop service before editing
+			if !cfg.NoStart {
+				if code, err = executor.stopService(ctx, scm, svc); err != nil {
+					executor.log.Warn().Err(err).Msg("Failed to stop existing service")
+				} else if code == windows.ERROR_SERVICE_NOT_ACTIVE {
+					executor.log.Debug().Str("service", svc.name).Msg("Service is not running")
+				} else {
+					executor.log.Info().Str("service", svc.name).Msg("Stopped existing service")
+					defer func() {
+						if code, err = executor.startService(ctx, scm, svc); err != nil {
+							executor.log.Error().Err(err).Msg("Failed to restore service state to running")
+						}
+					}()
+				}
+			}
+			if code, err = executor.queryServiceConfig(ctx, svc); err != nil {
+				return fmt.Errorf("failed to query service configuration with code %d: %w", code, err)
+			}
+			executor.log.Debug().
+				Str("service", svc.name).
+				Str("command", svc.svcConfig.BinaryPathName).Msg("Fetched existing service configuration")
+
+			// Change service configuration
+			if code, err = executor.changeServiceConfigBinary(ctx, svc, cmd); err != nil {
+				return fmt.Errorf("failed to edit service configuration with code %d: %w", code, err)
+			}
+			defer func() {
+				// Revert configuration
+				if code, err = executor.changeServiceConfigBinary(ctx, svc, svc.svcConfig.BinaryPathName); err != nil {
+					executor.log.Error().Err(err).Msg("Failed to restore service configuration")
+				} else {
+					executor.log.Info().Str("service", svc.name).Msg("Restored service configuration")
+				}
+			}()
+			executor.log.Info().
+				Str("service", svc.name).
+				Str("command", cmd).Msg("Changed service configuration")
+
+			// Start service
+			if !cfg.NoStart {
+				if code, err = executor.startService(ctx, scm, svc); err != nil {
+					if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+						// In case of timeout or cancel, try to reestablish a connection to restore the service
+						executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful")
+						executor.log.Info().Msg("Reconnecting for cleanup procedure")
+						ctx = vctx
+
+						if _, err = executor.createClients(ctx); err != nil {
+							executor.log.Error().Err(err).Msg("Reconnect failed")
+
+						} else if scm, code, err = executor.openSCM(ctx); err != nil {
+							executor.log.Error().Err(err).Msg("Failed to reopen SCM")
+
+						} else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil {
+							executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle")
+
+						} else {
+							executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful")
+						}
+					} else {
+						executor.log.Error().Err(err).Msg("Failed to start service")
+					}
+				} else {
+					executor.log.Info().Str("service", svc.name).Msg("Started service")
+				}
+				defer func() {
+					// Stop service
+					if code, err = executor.stopService(ctx, scm, svc); err != nil {
+						executor.log.Error().Err(err).Msg("Failed to stop service")
+					} else {
+						executor.log.Info().Str("service", svc.name).Msg("Stopped service")
+					}
+				}()
+			}
+		}
+	}
+	return err
+}
diff --git a/pkg/exec/scmr/module.go b/pkg/exec/scmr/module.go
new file mode 100644
index 0000000..1c855fb
--- /dev/null
+++ b/pkg/exec/scmr/module.go
@@ -0,0 +1,31 @@
+package scmrexec
+
+import (
+	"github.com/bryanmcnulty/adauth"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+	"github.com/rs/zerolog"
+	"github.com/FalconOpsLLC/goexec/pkg/client/dcerpc"
+)
+
+type Executor struct {
+	creds    *adauth.Credential
+	target   *adauth.Target
+	hostname string
+
+	log zerolog.Logger
+	dce *dcerpc.DCEClient
+	ctl svcctl.SvcctlClient
+}
+
+type MethodCreateConfig struct {
+	NoDelete    bool
+	ServiceName string
+	DisplayName string
+	ServiceType uint32
+	StartType   uint32
+}
+
+type MethodModifyConfig struct {
+	NoStart     bool
+	ServiceName string
+}
diff --git a/pkg/exec/scmr/scmr.go b/pkg/exec/scmr/scmr.go
new file mode 100644
index 0000000..fbbb108
--- /dev/null
+++ b/pkg/exec/scmr/scmr.go
@@ -0,0 +1,238 @@
+package scmrexec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2"
+	"github.com/FalconOpsLLC/goexec/internal/util"
+	"github.com/FalconOpsLLC/goexec/pkg/exec"
+	"github.com/FalconOpsLLC/goexec/pkg/windows"
+)
+
+type service struct {
+	name         string
+	exec         string
+	createConfig *MethodCreateConfig
+	modifyConfig *MethodModifyConfig
+
+	svcState  uint32
+	svcConfig *svcctl.QueryServiceConfigW
+	handle    *svcctl.Handle
+}
+
+// openSCM opens a handle to SCM via ROpenSCManagerW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/dc84adb3-d51d-48eb-820d-ba1c6ca5faf2
+func (executor *Executor) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) {
+	if executor.ctl != nil {
+
+		hostname := executor.hostname
+		if hostname == "" {
+			hostname = util.RandomHostname()
+		}
+		if response, err := executor.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{
+			MachineName:   hostname + "\x00",    // lpMachineName; The server's name (i.e. DC01, dc01.domain.local)
+			DatabaseName:  "ServicesActive\x00", // lpDatabaseName; must be "ServicesActive" or "ServicesFailed"
+			DesiredAccess: ServiceModifyAccess,  // dwDesiredAccess; requested access - appears to be ignored?
+		}); err != nil {
+
+			if response != nil {
+				return nil, response.Return, fmt.Errorf("open scm response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open scm: %w", err)
+		} else {
+			return response.SCM, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// createService creates a service with the provided configuration via RCreateServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6a8ca926-9477-4dd4-b766-692fab07227e
+func (executor *Executor) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) {
+	if executor.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil {
+		cfg := scfg.createConfig
+		if response, err := executor.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    cfg.ServiceName + "\x00",
+			DisplayName:    cfg.DisplayName + "\x00",
+			BinaryPathName: ecfg.GetRawCommand() + "\x00",
+			ServiceType:    cfg.ServiceType,
+			StartType:      cfg.StartType,
+			DesiredAccess:  ServiceCreateAccess,
+		}); err != nil {
+
+			if response != nil {
+				return response.Return, fmt.Errorf("create service response: %w", err)
+			}
+			return 0, fmt.Errorf("create service: %w", err)
+		} else {
+			scfg.handle = response.Service
+			return response.Return, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// openService opens a handle to a service given the service name (lpServiceName)
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6d0a4225-451b-4132-894d-7cef7aecfd2d
+func (executor *Executor) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) {
+	if executor.ctl != nil && scm != nil {
+		if openResponse, err := executor.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{
+			ServiceManager: scm,
+			ServiceName:    svcName,
+			DesiredAccess:  ServiceAllAccess,
+		}); err != nil {
+			if openResponse != nil {
+				if openResponse.Return == windows.ERROR_SERVICE_DOES_NOT_EXIST {
+					return nil, openResponse.Return, fmt.Errorf("remote service does not exist: %s", svcName)
+				}
+				return nil, openResponse.Return, fmt.Errorf("open service response: %w", err)
+			}
+			return nil, 0, fmt.Errorf("open service: %w", err)
+		} else {
+			return openResponse.Service, 0, nil
+		}
+	}
+	return nil, 0, errors.New("invalid arguments")
+}
+
+// deleteService deletes an existing service with RDeleteService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6744cdb8-f162-4be0-bb31-98996b6495be
+func (executor *Executor) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if executor.ctl != nil && scm != nil && svc != nil {
+		if deleteResponse, err := executor.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil {
+			defer func() {}()
+			if deleteResponse != nil {
+				return deleteResponse.Return, fmt.Errorf("delete service response: %w", err)
+			}
+			return 0, fmt.Errorf("delete service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// controlService sets the state of the provided process
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (executor *Executor) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) {
+	if executor.ctl != nil && scm != nil && svc != nil {
+		if controlResponse, err := executor.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{
+			Service: svc.handle,
+			Control: control,
+		}); err != nil {
+			if controlResponse != nil {
+				return controlResponse.Return, fmt.Errorf("control service response: %w", err)
+			}
+			return 0, fmt.Errorf("control service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// stopService sends stop signal to existing service using controlService
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97
+func (executor *Executor) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if code, err = executor.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE {
+		err = nil
+	}
+	return
+}
+
+// startService starts the specified service with RStartServiceW
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/d9be95a2-cf01-4bdc-b30f-6fe4b37ada16
+func (executor *Executor) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) {
+	if executor.ctl != nil && scm != nil && svc != nil {
+		if startResponse, err := executor.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil {
+			if startResponse != nil {
+				// TODO: check if service is already running, return nil error if so
+				if startResponse.Return == windows.ERROR_SERVICE_REQUEST_TIMEOUT {
+					return 0, nil
+				}
+				return startResponse.Return, fmt.Errorf("start service response: %w", err)
+			}
+			return 0, fmt.Errorf("start service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// closeService closes the specified service handle using RCloseServiceHandle
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/a2a4e174-09fb-4e55-bad3-f77c4b13245c
+func (executor *Executor) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) {
+	if executor.ctl != nil && svc != nil {
+		if closeResponse, err := executor.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil {
+			if closeResponse != nil {
+				return closeResponse.Return, fmt.Errorf("close service response: %w", err)
+			}
+			return 0, fmt.Errorf("close service: %w", err)
+		}
+		return 0, nil
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// getServiceConfig fetches the configuration details of a service given a handle passed in a service{} structure.
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/89e2d5b1-19cf-44ca-969f-38eea9fe7f3c
+func (executor *Executor) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) {
+	if executor.ctl != nil && svc != nil && svc.handle != nil {
+		if getResponse, err := executor.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{
+			Service:      svc.handle,
+			BufferLength: 1024 * 8,
+		}); err != nil {
+			if getResponse != nil {
+				return getResponse.Return, fmt.Errorf("get service config response: %w", err)
+			}
+			return 0, fmt.Errorf("get service config: %w", err)
+		} else {
+			svc.svcConfig = getResponse.ServiceConfig
+			return code, err
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// queryServiceStatus fetches the state of the specified service
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/cf94d915-b4e1-40e5-872b-a9cb3ad09b46
+func (executor *Executor) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) {
+	if executor.ctl != nil && svc != nil {
+		if queryResponse, err := executor.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil {
+			if queryResponse != nil {
+				return queryResponse.Return, fmt.Errorf("query service status response: %w", err)
+			}
+			return 0, fmt.Errorf("query service status: %w", err)
+		} else {
+			svc.svcState = queryResponse.ServiceStatus.CurrentState
+			return 0, nil
+		}
+	}
+	return 0, errors.New("invalid arguments")
+}
+
+// changeServiceConfigBinary edits the provided service's lpBinaryPathName
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/61ea7ed0-c49d-4152-a164-b4830f16c8a4
+func (executor *Executor) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) {
+	if executor.ctl != nil && svc != nil && svc.handle != nil {
+		if changeResponse, err := executor.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{
+			Service:        svc.handle,
+			ServiceType:    svc.svcConfig.ServiceType,
+			StartType:      svc.svcConfig.StartType,
+			ErrorControl:   svc.svcConfig.ErrorControl,
+			BinaryPathName: bin + "\x00",
+			LoadOrderGroup: svc.svcConfig.LoadOrderGroup,
+			TagID:          svc.svcConfig.TagID,
+			// Dependencies: svc.svcConfig.Dependencies // TODO
+			ServiceStartName: svc.svcConfig.ServiceStartName,
+			DisplayName:      svc.svcConfig.DisplayName,
+		}); err != nil {
+			if changeResponse != nil {
+				return changeResponse.Return, fmt.Errorf("change service config response: %w", err)
+			}
+			return 0, fmt.Errorf("change service config: %w", err)
+		}
+		return
+	}
+	return 0, errors.New("invalid arguments")
+}
diff --git a/pkg/windows/const.go b/pkg/windows/const.go
new file mode 100644
index 0000000..4c4fbe6
--- /dev/null
+++ b/pkg/windows/const.go
@@ -0,0 +1,37 @@
+package windows
+
+const (
+	// Windows error codes
+	ERROR_FILE_NOT_FOUND          uint32 = 0x00000002
+	ERROR_SERVICE_REQUEST_TIMEOUT uint32 = 0x0000041d
+	ERROR_SERVICE_DOES_NOT_EXIST  uint32 = 0x00000424
+	ERROR_SERVICE_NOT_ACTIVE      uint32 = 0x00000426
+
+	// Windows service/scm constants
+	SERVICE_BOOT_START   uint32 = 0x00000000
+	SERVICE_SYSTEM_START uint32 = 0x00000001
+	SERVICE_AUTO_START   uint32 = 0x00000002
+	SERVICE_DEMAND_START uint32 = 0x00000003
+	SERVICE_DISABLED     uint32 = 0x00000004
+
+	// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/4e91ff36-ab5f-49ed-a43d-a308e72b0b3c
+	SERVICE_CONTINUE_PENDING uint32 = 0x00000005
+	SERVICE_PAUSE_PENDING    uint32 = 0x00000006
+	SERVICE_PAUSED           uint32 = 0x00000007
+	SERVICE_RUNNING          uint32 = 0x00000004
+	SERVICE_START_PENDING    uint32 = 0x00000002
+	SERVICE_STOP_PENDING     uint32 = 0x00000003
+	SERVICE_STOPPED          uint32 = 0x00000001
+
+	SERVICE_WIN32_OWN_PROCESS uint32 = 0x00000010
+
+	SERVICE_CONTROL_STOP      uint32 = 0x00000001
+	SC_MANAGER_CREATE_SERVICE uint32 = 0x00000002
+
+	// https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights
+	SERVICE_QUERY_CONFIG  uint32 = 0x00000001
+	SERVICE_CHANGE_CONFIG uint32 = 0x00000002
+	SERVICE_START         uint32 = 0x00000010
+	SERVICE_STOP          uint32 = 0x00000020
+	SERVICE_DELETE        uint32 = 0x00010000 // special permission
+)