diff options
author | Bryan McNulty <bryanmcnulty@protonmail.com> | 2025-03-04 03:05:53 -0600 |
---|---|---|
committer | Bryan McNulty <bryanmcnulty@protonmail.com> | 2025-03-04 03:05:53 -0600 |
commit | a5c860b8ab24c198b7390fbde90044754e35c1c5 (patch) | |
tree | 3118b27b5c76cab44bb61d83df750a9f00b4be00 /pkg | |
parent | 5a3bf6315aab33e6488734a579977836042b4aa1 (diff) | |
parent | f98989334bbe227bbe9dc4c84a2d0e34aa2fb86f (diff) | |
download | goexec-a5c860b8ab24c198b7390fbde90044754e35c1c5.tar.gz goexec-a5c860b8ab24c198b7390fbde90044754e35c1c5.zip |
Simple fixes
Diffstat (limited to 'pkg')
-rw-r--r-- | pkg/client/dcerpc/client.go | 11 | ||||
-rw-r--r-- | pkg/client/dcerpc/dcerpc.go | 102 | ||||
-rw-r--r-- | pkg/client/dcerpc/smb.go | 13 | ||||
-rw-r--r-- | pkg/exec/exec.go | 38 | ||||
-rw-r--r-- | pkg/exec/scmr/exec.go | 224 | ||||
-rw-r--r-- | pkg/exec/scmr/module.go | 31 | ||||
-rw-r--r-- | pkg/exec/scmr/scmr.go | 238 | ||||
-rw-r--r-- | pkg/windows/const.go | 37 |
8 files changed, 0 insertions, 694 deletions
diff --git a/pkg/client/dcerpc/client.go b/pkg/client/dcerpc/client.go deleted file mode 100644 index 5b5b935..0000000 --- a/pkg/client/dcerpc/client.go +++ /dev/null @@ -1,11 +0,0 @@ -package dcerpc - -import ( - "context" - "github.com/bryanmcnulty/adauth" -) - -type Client interface { - Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target) error - Close(ctx context.Context) error -} diff --git a/pkg/client/dcerpc/dcerpc.go b/pkg/client/dcerpc/dcerpc.go deleted file mode 100644 index a22bff7..0000000 --- a/pkg/client/dcerpc/dcerpc.go +++ /dev/null @@ -1,102 +0,0 @@ -package dcerpc - -import ( - "context" - "errors" - "fmt" - "github.com/bryanmcnulty/adauth" - "github.com/bryanmcnulty/adauth/dcerpcauth" - "github.com/oiweiwei/go-msrpc/dcerpc" - "github.com/oiweiwei/go-msrpc/msrpc/epm/epm/v3" - "github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2" - "github.com/oiweiwei/go-msrpc/smb2" - "github.com/oiweiwei/go-msrpc/ssp/gssapi" - "github.com/rs/zerolog" -) - -const ( - DceDefaultProto string = "ncacn_np" - DceDefaultPort uint16 = 445 -) - -type DCEClient struct { - Port uint16 - Proto string - - log zerolog.Logger - conn dcerpc.Conn - opts []dcerpc.Option - authOpts dcerpcauth.Options -} - -func NewDCEClient(ctx context.Context, insecure bool, smbConfig *SmbConfig) (client *DCEClient) { - client = &DCEClient{ - Port: DceDefaultPort, - Proto: DceDefaultProto, - log: zerolog.Ctx(ctx).With().Str("client", "DCE").Logger(), - authOpts: dcerpcauth.Options{}, - } - client.opts = []dcerpc.Option{dcerpc.WithLogger(client.log)} - client.authOpts = dcerpcauth.Options{Debug: client.log.Trace().Msgf} - - if smbConfig != nil { - if smbConfig.Port != 0 { - client.Port = smbConfig.Port - client.opts = append(client.opts, dcerpc.WithSMBPort(int(smbConfig.Port))) - } - } - if insecure { - client.log.Debug().Msg("Using insecure DCERPC connection") - client.opts = append(client.opts, dcerpc.WithInsecure()) - } else { - client.log.Debug().Msg("Using secure DCERPC connection") - client.authOpts.SMBOptions = append(client.authOpts.SMBOptions, smb2.WithSeal()) - } - return -} - -func (client *DCEClient) OpenSvcctl(ctx context.Context) (ctl svcctl.SvcctlClient, err error) { - if client.conn == nil { - return nil, errors.New("DCE connection not open") - } - if ctl, err = svcctl.NewSvcctlClient(ctx, client.conn, dcerpc.WithInsecure()); err != nil { - client.log.Debug().Err(err).Msg("Failed to open Svcctl client") - } - return -} - -func (client *DCEClient) Connect(ctx context.Context, creds *adauth.Credential, target *adauth.Target, dialOpts ...dcerpc.Option) (err error) { - if creds != nil && target != nil { - authCtx := gssapi.NewSecurityContext(ctx) - - binding := fmt.Sprintf(`%s:%s`, client.Proto, target.AddressWithoutPort()) - mapper := epm.EndpointMapper(ctx, fmt.Sprintf("%s:%d", target.AddressWithoutPort(), client.Port), dcerpc.WithLogger(client.log)) - dceOpts := []dcerpc.Option{dcerpc.WithLogger(client.log), dcerpc.WithSeal()} - - if dceOpts, err = dcerpcauth.AuthenticationOptions(authCtx, creds, target, &client.authOpts); err == nil { - dceOpts = append(dceOpts, mapper) - dceOpts = append(dceOpts, client.opts...) - dceOpts = append(dceOpts, dialOpts...) - - if client.conn, err = dcerpc.Dial(authCtx, binding, dceOpts...); err == nil { - client.log.Debug().Msg("Bind successful") - return nil - } - client.log.Debug().Err(err).Msg("DCERPC bind failed") - return errors.New("bind failed") - } - return errors.New("unable to parse DCE authentication options") - } - return errors.New("invalid arguments") -} - -func (client *DCEClient) Close(ctx context.Context) (err error) { - if client.conn == nil { - client.log.Debug().Msg("Connection already closed") - } else if err = client.conn.Close(ctx); err == nil { - client.log.Debug().Msg("Connection closed successfully") - } else { - client.log.Error().Err(err).Msg("Failed to close connection") - } - return -} diff --git a/pkg/client/dcerpc/smb.go b/pkg/client/dcerpc/smb.go deleted file mode 100644 index cab82eb..0000000 --- a/pkg/client/dcerpc/smb.go +++ /dev/null @@ -1,13 +0,0 @@ -package dcerpc - -import "github.com/oiweiwei/go-msrpc/smb2" - -const ( - SmbDefaultPort = 445 -) - -type SmbConfig struct { - Port uint16 - FullSecurity bool - ForceDialect smb2.Dialect -} diff --git a/pkg/exec/exec.go b/pkg/exec/exec.go deleted file mode 100644 index 6e18378..0000000 --- a/pkg/exec/exec.go +++ /dev/null @@ -1,38 +0,0 @@ -package exec - -import ( - "context" - "github.com/bryanmcnulty/adauth" -) - -type ExecutionConfig struct { - ExecutableName string // ExecutableName represents the name of the executable; i.e. "notepad.exe", "calc" - ExecutablePath string // ExecutablePath represents the full path to the executable; i.e. `C:\Windows\explorer.exe` - ExecutableArgs string // ExecutableArgs represents the arguments to be passed to the executable during execution; i.e. "/C whoami" - - ExecutionMethod string // ExecutionMethod represents the specific execution strategy used by the module. - ExecutionMethodConfig interface{} - ExecutionOutput string // not implemented - ExecutionOutputConfig interface{} // not implemented -} - -type ShellConfig struct { - ShellName string // ShellName specifies the name of the shell executable; i.e. "cmd.exe", "powershell" - ShellPath string // ShellPath is the full Windows path to the shell executable; i.e. `C:\Windows\System32\cmd.exe` -} - -type Executor interface { - // Exec performs a single execution task without the need to call Init. - Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, config *ExecutionConfig) - - // Init assigns the provided TODO - //Init(ctx context.Context, creds *adauth.Credential, target *adauth.Target) - //Shell(ctx context.Context, input chan *ExecutionConfig, output chan []byte) -} - -func (cfg *ExecutionConfig) GetRawCommand() string { - if cfg.ExecutableArgs != "" { - return cfg.ExecutablePath + " " + cfg.ExecutableArgs - } - return cfg.ExecutablePath -} diff --git a/pkg/exec/scmr/exec.go b/pkg/exec/scmr/exec.go deleted file mode 100644 index b3c1531..0000000 --- a/pkg/exec/scmr/exec.go +++ /dev/null @@ -1,224 +0,0 @@ -package scmrexec - -import ( - "context" - "errors" - "fmt" - "github.com/bryanmcnulty/adauth" - "github.com/rs/zerolog" - "github.com/FalconOpsLLC/goexec/pkg/client/dcerpc" - "github.com/FalconOpsLLC/goexec/pkg/exec" - "github.com/FalconOpsLLC/goexec/pkg/windows" -) - -const ( - MethodCreate string = "create" - MethodModify string = "modify" - - ServiceModifyAccess uint32 = windows.SERVICE_QUERY_CONFIG | windows.SERVICE_CHANGE_CONFIG | windows.SERVICE_STOP | windows.SERVICE_START | windows.SERVICE_DELETE - ServiceCreateAccess uint32 = windows.SC_MANAGER_CREATE_SERVICE | windows.SERVICE_START | windows.SERVICE_STOP | windows.SERVICE_DELETE - ServiceAllAccess uint32 = ServiceCreateAccess | ServiceModifyAccess -) - -func (executor *Executor) createClients(ctx context.Context) (cleanup func(cCtx context.Context), err error) { - - cleanup = func(context.Context) { - if executor.dce != nil { - executor.log.Debug().Msg("Cleaning up clients") - if err := executor.dce.Close(ctx); err != nil { - executor.log.Error().Err(err).Msg("Failed to destroy DCE connection") - } - } - } - cleanup(ctx) - executor.dce = dcerpc.NewDCEClient(ctx, false, &dcerpc.SmbConfig{Port: 445}) - cleanup = func(context.Context) {} - - if err = executor.dce.Connect(ctx, executor.creds, executor.target); err != nil { - return nil, fmt.Errorf("connection to DCERPC failed: %w", err) - } - executor.ctl, err = executor.dce.OpenSvcctl(ctx) - return -} - -func (executor *Executor) Exec(ctx context.Context, creds *adauth.Credential, target *adauth.Target, ecfg *exec.ExecutionConfig) (err error) { - - vctx := context.WithoutCancel(ctx) - executor.log = zerolog.Ctx(ctx).With(). - Str("module", "scmr"). - Str("method", ecfg.ExecutionMethod).Logger() - executor.creds = creds - executor.target = target - - if ecfg.ExecutionMethod == MethodCreate { - if cfg, ok := ecfg.ExecutionMethodConfig.(MethodCreateConfig); !ok || cfg.ServiceName == "" { - return errors.New("invalid configuration") - } else { - if cleanup, err := executor.createClients(ctx); err != nil { - return fmt.Errorf("failed to create client: %w", err) - } else { - executor.log.Debug().Msg("Created clients") - defer cleanup(ctx) - } - svc := &service{ - createConfig: &cfg, - name: cfg.ServiceName, - } - scm, code, err := executor.openSCM(ctx) - if err != nil { - return fmt.Errorf("failed to open SCM with code %d: %w", code, err) - } - executor.log.Debug().Msg("Opened handle to SCM") - code, err = executor.createService(ctx, scm, svc, ecfg) - if err != nil { - return fmt.Errorf("failed to create service with code %d: %w", code, err) - } - executor.log.Info().Str("service", svc.name).Msg("Service created") - // From here on out, make sure the service is properly deleted, even if the connection drops or something fails. - if !cfg.NoDelete { - defer func() { - // TODO: stop service? - if code, err = executor.deleteService(ctx, scm, svc); err != nil { - executor.log.Error().Err(err).Msg("Failed to delete service") // TODO - } - executor.log.Info().Str("service", svc.name).Msg("Service deleted successfully") - }() - } - if code, err = executor.startService(ctx, scm, svc); err != nil { - if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) { - // In case of timeout or cancel, try to reestablish a connection to restore the service - executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful") - executor.log.Info().Msg("Reconnecting for cleanup procedure") - ctx = vctx - - if _, err = executor.createClients(ctx); err != nil { - executor.log.Error().Err(err).Msg("Reconnect failed") - - } else if scm, code, err = executor.openSCM(ctx); err != nil { - executor.log.Error().Err(err).Msg("Failed to reopen SCM") - - } else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil { - executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle") - - } else { - executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful") - } - } else { - executor.log.Error().Err(err).Msg("Failed to start service") - } - } else { - executor.log.Info().Str("service", svc.name).Msg("Execution successful") - } - } - } else if ecfg.ExecutionMethod == MethodModify { - // Use service modification method - if cfg, ok := ecfg.ExecutionMethodConfig.(MethodModifyConfig); !ok || cfg.ServiceName == "" { - return errors.New("invalid configuration") - - } else { - // Ensure that a command (executable full path + args) is supplied - cmd := ecfg.GetRawCommand() - if cmd == "" { - return errors.New("no command provided") - } - - // Initialize protocol clients - if cleanup, err := executor.createClients(ctx); err != nil { - return fmt.Errorf("failed to create client: %w", err) - } else { - executor.log.Debug().Msg("Created clients") - defer cleanup(ctx) - } - svc := &service{modifyConfig: &cfg, name: cfg.ServiceName} - - // Open SCM handle - scm, code, err := executor.openSCM(ctx) - if err != nil { - return fmt.Errorf("failed to create service with code %d: %w", code, err) - } - executor.log.Debug().Msg("Opened handle to SCM") - - // Open service handle - if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil { - return fmt.Errorf("failed to open service with code %d: %w", code, err) - } - executor.log.Debug().Str("service", svc.name).Msg("Opened service") - - // Stop service before editing - if !cfg.NoStart { - if code, err = executor.stopService(ctx, scm, svc); err != nil { - executor.log.Warn().Err(err).Msg("Failed to stop existing service") - } else if code == windows.ERROR_SERVICE_NOT_ACTIVE { - executor.log.Debug().Str("service", svc.name).Msg("Service is not running") - } else { - executor.log.Info().Str("service", svc.name).Msg("Stopped existing service") - defer func() { - if code, err = executor.startService(ctx, scm, svc); err != nil { - executor.log.Error().Err(err).Msg("Failed to restore service state to running") - } - }() - } - } - if code, err = executor.queryServiceConfig(ctx, svc); err != nil { - return fmt.Errorf("failed to query service configuration with code %d: %w", code, err) - } - executor.log.Debug(). - Str("service", svc.name). - Str("command", svc.svcConfig.BinaryPathName).Msg("Fetched existing service configuration") - - // Change service configuration - if code, err = executor.changeServiceConfigBinary(ctx, svc, cmd); err != nil { - return fmt.Errorf("failed to edit service configuration with code %d: %w", code, err) - } - defer func() { - // Revert configuration - if code, err = executor.changeServiceConfigBinary(ctx, svc, svc.svcConfig.BinaryPathName); err != nil { - executor.log.Error().Err(err).Msg("Failed to restore service configuration") - } else { - executor.log.Info().Str("service", svc.name).Msg("Restored service configuration") - } - }() - executor.log.Info(). - Str("service", svc.name). - Str("command", cmd).Msg("Changed service configuration") - - // Start service - if !cfg.NoStart { - if code, err = executor.startService(ctx, scm, svc); err != nil { - if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) { - // In case of timeout or cancel, try to reestablish a connection to restore the service - executor.log.Info().Msg("Service start timeout/cancelled. Execution likely successful") - executor.log.Info().Msg("Reconnecting for cleanup procedure") - ctx = vctx - - if _, err = executor.createClients(ctx); err != nil { - executor.log.Error().Err(err).Msg("Reconnect failed") - - } else if scm, code, err = executor.openSCM(ctx); err != nil { - executor.log.Error().Err(err).Msg("Failed to reopen SCM") - - } else if svc.handle, code, err = executor.openService(ctx, scm, svc.name); err != nil { - executor.log.Error().Str("service", svc.name).Err(err).Msg("Failed to reopen service handle") - - } else { - executor.log.Debug().Str("service", svc.name).Msg("Reconnection successful") - } - } else { - executor.log.Error().Err(err).Msg("Failed to start service") - } - } else { - executor.log.Info().Str("service", svc.name).Msg("Started service") - } - defer func() { - // Stop service - if code, err = executor.stopService(ctx, scm, svc); err != nil { - executor.log.Error().Err(err).Msg("Failed to stop service") - } else { - executor.log.Info().Str("service", svc.name).Msg("Stopped service") - } - }() - } - } - } - return err -} diff --git a/pkg/exec/scmr/module.go b/pkg/exec/scmr/module.go deleted file mode 100644 index 1c855fb..0000000 --- a/pkg/exec/scmr/module.go +++ /dev/null @@ -1,31 +0,0 @@ -package scmrexec - -import ( - "github.com/bryanmcnulty/adauth" - "github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2" - "github.com/rs/zerolog" - "github.com/FalconOpsLLC/goexec/pkg/client/dcerpc" -) - -type Executor struct { - creds *adauth.Credential - target *adauth.Target - hostname string - - log zerolog.Logger - dce *dcerpc.DCEClient - ctl svcctl.SvcctlClient -} - -type MethodCreateConfig struct { - NoDelete bool - ServiceName string - DisplayName string - ServiceType uint32 - StartType uint32 -} - -type MethodModifyConfig struct { - NoStart bool - ServiceName string -} diff --git a/pkg/exec/scmr/scmr.go b/pkg/exec/scmr/scmr.go deleted file mode 100644 index fbbb108..0000000 --- a/pkg/exec/scmr/scmr.go +++ /dev/null @@ -1,238 +0,0 @@ -package scmrexec - -import ( - "context" - "errors" - "fmt" - "github.com/oiweiwei/go-msrpc/msrpc/scmr/svcctl/v2" - "github.com/FalconOpsLLC/goexec/internal/util" - "github.com/FalconOpsLLC/goexec/pkg/exec" - "github.com/FalconOpsLLC/goexec/pkg/windows" -) - -type service struct { - name string - exec string - createConfig *MethodCreateConfig - modifyConfig *MethodModifyConfig - - svcState uint32 - svcConfig *svcctl.QueryServiceConfigW - handle *svcctl.Handle -} - -// openSCM opens a handle to SCM via ROpenSCManagerW -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/dc84adb3-d51d-48eb-820d-ba1c6ca5faf2 -func (executor *Executor) openSCM(ctx context.Context) (scm *svcctl.Handle, code uint32, err error) { - if executor.ctl != nil { - - hostname := executor.hostname - if hostname == "" { - hostname = util.RandomHostname() - } - if response, err := executor.ctl.OpenSCMW(ctx, &svcctl.OpenSCMWRequest{ - MachineName: hostname + "\x00", // lpMachineName; The server's name (i.e. DC01, dc01.domain.local) - DatabaseName: "ServicesActive\x00", // lpDatabaseName; must be "ServicesActive" or "ServicesFailed" - DesiredAccess: ServiceModifyAccess, // dwDesiredAccess; requested access - appears to be ignored? - }); err != nil { - - if response != nil { - return nil, response.Return, fmt.Errorf("open scm response: %w", err) - } - return nil, 0, fmt.Errorf("open scm: %w", err) - } else { - return response.SCM, 0, nil - } - } - return nil, 0, errors.New("invalid arguments") -} - -// createService creates a service with the provided configuration via RCreateServiceW -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6a8ca926-9477-4dd4-b766-692fab07227e -func (executor *Executor) createService(ctx context.Context, scm *svcctl.Handle, scfg *service, ecfg *exec.ExecutionConfig) (code uint32, err error) { - if executor.ctl != nil && scm != nil && scfg != nil && scfg.createConfig != nil { - cfg := scfg.createConfig - if response, err := executor.ctl.CreateServiceW(ctx, &svcctl.CreateServiceWRequest{ - ServiceManager: scm, - ServiceName: cfg.ServiceName + "\x00", - DisplayName: cfg.DisplayName + "\x00", - BinaryPathName: ecfg.GetRawCommand() + "\x00", - ServiceType: cfg.ServiceType, - StartType: cfg.StartType, - DesiredAccess: ServiceCreateAccess, - }); err != nil { - - if response != nil { - return response.Return, fmt.Errorf("create service response: %w", err) - } - return 0, fmt.Errorf("create service: %w", err) - } else { - scfg.handle = response.Service - return response.Return, err - } - } - return 0, errors.New("invalid arguments") -} - -// openService opens a handle to a service given the service name (lpServiceName) -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6d0a4225-451b-4132-894d-7cef7aecfd2d -func (executor *Executor) openService(ctx context.Context, scm *svcctl.Handle, svcName string) (*svcctl.Handle, uint32, error) { - if executor.ctl != nil && scm != nil { - if openResponse, err := executor.ctl.OpenServiceW(ctx, &svcctl.OpenServiceWRequest{ - ServiceManager: scm, - ServiceName: svcName, - DesiredAccess: ServiceAllAccess, - }); err != nil { - if openResponse != nil { - if openResponse.Return == windows.ERROR_SERVICE_DOES_NOT_EXIST { - return nil, openResponse.Return, fmt.Errorf("remote service does not exist: %s", svcName) - } - return nil, openResponse.Return, fmt.Errorf("open service response: %w", err) - } - return nil, 0, fmt.Errorf("open service: %w", err) - } else { - return openResponse.Service, 0, nil - } - } - return nil, 0, errors.New("invalid arguments") -} - -// deleteService deletes an existing service with RDeleteService -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/6744cdb8-f162-4be0-bb31-98996b6495be -func (executor *Executor) deleteService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) { - if executor.ctl != nil && scm != nil && svc != nil { - if deleteResponse, err := executor.ctl.DeleteService(ctx, &svcctl.DeleteServiceRequest{Service: svc.handle}); err != nil { - defer func() {}() - if deleteResponse != nil { - return deleteResponse.Return, fmt.Errorf("delete service response: %w", err) - } - return 0, fmt.Errorf("delete service: %w", err) - } - return 0, nil - } - return 0, errors.New("invalid arguments") -} - -// controlService sets the state of the provided process -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97 -func (executor *Executor) controlService(ctx context.Context, scm *svcctl.Handle, svc *service, control uint32) (code uint32, err error) { - if executor.ctl != nil && scm != nil && svc != nil { - if controlResponse, err := executor.ctl.ControlService(ctx, &svcctl.ControlServiceRequest{ - Service: svc.handle, - Control: control, - }); err != nil { - if controlResponse != nil { - return controlResponse.Return, fmt.Errorf("control service response: %w", err) - } - return 0, fmt.Errorf("control service: %w", err) - } - return 0, nil - } - return 0, errors.New("invalid arguments") -} - -// stopService sends stop signal to existing service using controlService -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/e1c478be-117f-4512-9b67-17c20a48af97 -func (executor *Executor) stopService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) { - if code, err = executor.controlService(ctx, scm, svc, windows.SERVICE_CONTROL_STOP); code == windows.ERROR_SERVICE_NOT_ACTIVE { - err = nil - } - return -} - -// startService starts the specified service with RStartServiceW -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/d9be95a2-cf01-4bdc-b30f-6fe4b37ada16 -func (executor *Executor) startService(ctx context.Context, scm *svcctl.Handle, svc *service) (code uint32, err error) { - if executor.ctl != nil && scm != nil && svc != nil { - if startResponse, err := executor.ctl.StartServiceW(ctx, &svcctl.StartServiceWRequest{Service: svc.handle}); err != nil { - if startResponse != nil { - // TODO: check if service is already running, return nil error if so - if startResponse.Return == windows.ERROR_SERVICE_REQUEST_TIMEOUT { - return 0, nil - } - return startResponse.Return, fmt.Errorf("start service response: %w", err) - } - return 0, fmt.Errorf("start service: %w", err) - } - return 0, nil - } - return 0, errors.New("invalid arguments") -} - -// closeService closes the specified service handle using RCloseServiceHandle -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/a2a4e174-09fb-4e55-bad3-f77c4b13245c -func (executor *Executor) closeService(ctx context.Context, svc *svcctl.Handle) (code uint32, err error) { - if executor.ctl != nil && svc != nil { - if closeResponse, err := executor.ctl.CloseService(ctx, &svcctl.CloseServiceRequest{ServiceObject: svc}); err != nil { - if closeResponse != nil { - return closeResponse.Return, fmt.Errorf("close service response: %w", err) - } - return 0, fmt.Errorf("close service: %w", err) - } - return 0, nil - } - return 0, errors.New("invalid arguments") -} - -// getServiceConfig fetches the configuration details of a service given a handle passed in a service{} structure. -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/89e2d5b1-19cf-44ca-969f-38eea9fe7f3c -func (executor *Executor) queryServiceConfig(ctx context.Context, svc *service) (code uint32, err error) { - if executor.ctl != nil && svc != nil && svc.handle != nil { - if getResponse, err := executor.ctl.QueryServiceConfigW(ctx, &svcctl.QueryServiceConfigWRequest{ - Service: svc.handle, - BufferLength: 1024 * 8, - }); err != nil { - if getResponse != nil { - return getResponse.Return, fmt.Errorf("get service config response: %w", err) - } - return 0, fmt.Errorf("get service config: %w", err) - } else { - svc.svcConfig = getResponse.ServiceConfig - return code, err - } - } - return 0, errors.New("invalid arguments") -} - -// queryServiceStatus fetches the state of the specified service -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/cf94d915-b4e1-40e5-872b-a9cb3ad09b46 -func (executor *Executor) queryServiceStatus(ctx context.Context, svc *service) (uint32, error) { - if executor.ctl != nil && svc != nil { - if queryResponse, err := executor.ctl.QueryServiceStatus(ctx, &svcctl.QueryServiceStatusRequest{Service: svc.handle}); err != nil { - if queryResponse != nil { - return queryResponse.Return, fmt.Errorf("query service status response: %w", err) - } - return 0, fmt.Errorf("query service status: %w", err) - } else { - svc.svcState = queryResponse.ServiceStatus.CurrentState - return 0, nil - } - } - return 0, errors.New("invalid arguments") -} - -// changeServiceConfigBinary edits the provided service's lpBinaryPathName -// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/61ea7ed0-c49d-4152-a164-b4830f16c8a4 -func (executor *Executor) changeServiceConfigBinary(ctx context.Context, svc *service, bin string) (code uint32, err error) { - if executor.ctl != nil && svc != nil && svc.handle != nil { - if changeResponse, err := executor.ctl.ChangeServiceConfigW(ctx, &svcctl.ChangeServiceConfigWRequest{ - Service: svc.handle, - ServiceType: svc.svcConfig.ServiceType, - StartType: svc.svcConfig.StartType, - ErrorControl: svc.svcConfig.ErrorControl, - BinaryPathName: bin + "\x00", - LoadOrderGroup: svc.svcConfig.LoadOrderGroup, - TagID: svc.svcConfig.TagID, - // Dependencies: svc.svcConfig.Dependencies // TODO - ServiceStartName: svc.svcConfig.ServiceStartName, - DisplayName: svc.svcConfig.DisplayName, - }); err != nil { - if changeResponse != nil { - return changeResponse.Return, fmt.Errorf("change service config response: %w", err) - } - return 0, fmt.Errorf("change service config: %w", err) - } - return - } - return 0, errors.New("invalid arguments") -} diff --git a/pkg/windows/const.go b/pkg/windows/const.go deleted file mode 100644 index 4c4fbe6..0000000 --- a/pkg/windows/const.go +++ /dev/null @@ -1,37 +0,0 @@ -package windows - -const ( - // Windows error codes - ERROR_FILE_NOT_FOUND uint32 = 0x00000002 - ERROR_SERVICE_REQUEST_TIMEOUT uint32 = 0x0000041d - ERROR_SERVICE_DOES_NOT_EXIST uint32 = 0x00000424 - ERROR_SERVICE_NOT_ACTIVE uint32 = 0x00000426 - - // Windows service/scm constants - SERVICE_BOOT_START uint32 = 0x00000000 - SERVICE_SYSTEM_START uint32 = 0x00000001 - SERVICE_AUTO_START uint32 = 0x00000002 - SERVICE_DEMAND_START uint32 = 0x00000003 - SERVICE_DISABLED uint32 = 0x00000004 - - // https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/4e91ff36-ab5f-49ed-a43d-a308e72b0b3c - SERVICE_CONTINUE_PENDING uint32 = 0x00000005 - SERVICE_PAUSE_PENDING uint32 = 0x00000006 - SERVICE_PAUSED uint32 = 0x00000007 - SERVICE_RUNNING uint32 = 0x00000004 - SERVICE_START_PENDING uint32 = 0x00000002 - SERVICE_STOP_PENDING uint32 = 0x00000003 - SERVICE_STOPPED uint32 = 0x00000001 - - SERVICE_WIN32_OWN_PROCESS uint32 = 0x00000010 - - SERVICE_CONTROL_STOP uint32 = 0x00000001 - SC_MANAGER_CREATE_SERVICE uint32 = 0x00000002 - - // https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights - SERVICE_QUERY_CONFIG uint32 = 0x00000001 - SERVICE_CHANGE_CONFIG uint32 = 0x00000002 - SERVICE_START uint32 = 0x00000010 - SERVICE_STOP uint32 = 0x00000020 - SERVICE_DELETE uint32 = 0x00010000 // special permission -) |