1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
package cmd
import (
"github.com/bryanmcnulty/adauth"
"github.com/spf13/cobra"
"github.com/FalconOpsLLC/goexec/pkg/exec"
scmrexec "github.com/FalconOpsLLC/goexec/pkg/exec/scmr"
"github.com/FalconOpsLLC/goexec/pkg/windows"
)
func scmrCmdInit() {
scmrCmd.PersistentFlags().StringVarP(&executablePath, "executable-path", "f", "", "Full path to remote Windows executable")
scmrCmd.PersistentFlags().StringVarP(&executableArgs, "args", "a", "", "Arguments to pass to executable")
scmrCmd.PersistentFlags().StringVarP(&scmrName, "service-name", "s", "", "Name of service to create or modify")
scmrCmd.MarkPersistentFlagRequired("executable-path")
scmrCmd.MarkPersistentFlagRequired("service-name")
scmrChangeCmdInit()
scmrCmd.AddCommand(scmrChangeCmd)
scmrCreateCmdInit()
scmrCmd.AddCommand(scmrCreateCmd)
}
func scmrChangeCmdInit() {
scmrChangeCmd.Flags().StringVarP(&scmrDisplayName, "display-name", "n", "", "Display name of service to create")
scmrChangeCmd.Flags().BoolVar(&scmrNoStart, "no-start", false, "Don't start service")
}
func scmrCreateCmdInit() {
scmrCreateCmd.Flags().BoolVar(&scmrNoDelete, "no-delete", false, "Don't delete service after execution")
}
var (
// scmr arguments
scmrName string
scmrDisplayName string
scmrNoDelete bool
scmrNoStart bool
creds *adauth.Credential
target *adauth.Target
scmrCmd = &cobra.Command{
Use: "scmr",
Short: "Establish execution via SCMR",
}
scmrCreateCmd = &cobra.Command{
Use: "create [target]",
Short: "Create & run a new Windows service to gain execution",
Args: needsTarget,
RunE: func(cmd *cobra.Command, args []string) (err error) {
if scmrNoDelete {
log.Warn().Msg("Service will not be deleted after execution")
}
if scmrDisplayName == "" {
scmrDisplayName = scmrName
log.Warn().Msg("No display name specified, using service name as display name")
}
module := scmrexec.Module{}
execCfg := &exec.ExecutionConfig{
ExecutablePath: executablePath,
ExecutableArgs: executableArgs,
ExecutionMethod: scmrexec.MethodCreate,
ExecutionMethodConfig: scmrexec.MethodCreateConfig{
NoDelete: scmrNoDelete,
ServiceName: scmrName,
DisplayName: scmrDisplayName,
ServiceType: windows.SERVICE_WIN32_OWN_PROCESS,
StartType: windows.SERVICE_DEMAND_START,
},
}
if err := module.Exec(log.WithContext(ctx), creds, target, execCfg); err != nil {
log.Fatal().Err(err).Msg("SCMR execution failed")
}
return nil
},
}
scmrChangeCmd = &cobra.Command{
Use: "change [target]",
Short: "Change an existing Windows service to gain execution",
Args: needsTarget,
Run: func(cmd *cobra.Command, args []string) {
executor := scmrexec.Module{}
execCfg := &exec.ExecutionConfig{
ExecutablePath: executablePath,
ExecutableArgs: executableArgs,
ExecutionMethod: scmrexec.MethodModify,
ExecutionMethodConfig: scmrexec.MethodModifyConfig{
NoStart: scmrNoStart,
ServiceName: scmrName,
},
}
if err := executor.Exec(log.WithContext(ctx), creds, target, execCfg); err != nil {
log.Fatal().Err(err).Msg("SCMR execution failed")
}
},
}
)
|