o
    àý°j?B  ã                
   @   sv  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d d	lmZ G d
d„ dƒZedk�r9ejjdu r]e d¡ejƒe_eejƒ ejddd�Zejdddd� ejdddd� ejdddd� ejddd�Zej ddd�Z!e!jd ddd!d"� ej d#d$d�Z"e"jd ddd!d"� ej d%d&d�Z#e#jd ddd!d"� ej d'd(d�Z$e$jd ddd!d"� ej d)d*d�Z%e%jd ddd!d"� ej d+d,d�Z&ej d-d.d�Z'e'jd ddd!d"� e'jd/ddd0d"� e'jd1ddd2d"� ej d3d4d�Z'e'jd ddd!d"� e'jd/dd5d0d"� e'jd1dd5d2d"� e'jd6dd5d7d"� e'jd8dd5d9d"� e'jd:dd5d;d"� e'jd<dd5d=d"� e (d>¡Z)e)jd?dd@dAdB� e)jdCddDd� e)jdEddFd� e)jdGddHdIdB� e (dJ¡Z)e)jdKddLdMdB� e)jdNddLdOdB� e)jdPdQdRgdSdRdTdUdV� e*ej+ƒdWk�r£e ,¡  e -dW¡ e .¡ Z/e 0e/j1e/j2¡ e
e/j3ƒ\Z4Z5Z6Z7e4du �r¿dXZ4e/j8du �rÈe7e/_8e/j9du�rÑde/_:e6dXk�r÷e5dXk�r÷e/j;du �r÷e/j<d5u �r÷e/j9du �r÷d dYl=m=Z= e=dZƒZ6ee5e6e4e/e>e/j?ƒƒZ@z
e@ Ae7e/j8¡ W dS  eB�y8 ZC ze D¡ jEejFk�r&d dlGZGeG H¡  e IeJeCƒ¡ W Y dZC[CdS dZC[Cww dS )[é    )Údivision)Úprint_functionN)Úlogger)Úparse_target)Úversion)Ú	transportÚscmr)ÚNULL)ÚencryptSecretc                   @   s&   e Zd Zd	dd„Zdd„ Zdd„ ZdS )
ÚSVCCTLé½  c                 C   st   || _ || _|| _|| _|j ¡ | _|| _d| _d| _	|j
| _|j| _|j| _|jd ur8|j d¡\| _| _	d S d S )NÚ ú:)Ú_SVCCTL__usernameÚ_SVCCTL__passwordÚ_SVCCTL__optionsÚ_SVCCTL__portÚactionÚupperÚ_SVCCTL__actionÚ_SVCCTL__domainÚ_SVCCTL__lmhashÚ_SVCCTL__nthashÚaesKeyÚ_SVCCTL__aesKeyÚkÚ_SVCCTL__doKerberosÚdc_ipÚ_SVCCTL__kdcHostÚhashesÚsplit)ÚselfÚusernameÚpasswordÚdomainÚoptionsÚport© r'   úˆ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/services.pyÚ__init__*   s   
ÿzSVCCTL.__init__c                 C   s~   d| }t  d| ¡ t |¡}| | j¡ | |¡ t|dƒr0| | j	| j
| j| j| j| j¡ | | j| j¡ |  |¡ d S )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sÚset_credentials)ÚloggingÚdebugr   ÚDCERPCTransportFactoryÚ	set_dportr   ÚsetRemoteHostÚhasattrr*   r   r   r   r   r   r   Úset_kerberosr   r   ÚdoStuff)r!   Ú
remoteNameÚ
remoteHostÚstringbindingÚrpctransportr'   r'   r(   Úrun:   s   


 z
SVCCTL.runc                 C   sæ  |  ¡ }| ¡  | tj¡ |}t |¡}|d }| jdkr2| jdkr2t ||| jj	d ¡}|d }| jdkrNt
 d| jj	 ¡ t ||¡ t ||¡ �n™| jdkrlt
 d	| jj	 ¡ t ||tj¡ t ||¡ �n{| jd
krˆt
 d| jj	 ¡ t ||¡ t ||¡ �n_| jdk�rãt
 d| jj	 ¡ t ||¡}td|d d  dd� |d d d@ r·tddd� |d d d@ rÅtddd� |d d d@ rÓtddd� |d d d@ rátddd� |d d d@ rïtddd� tdƒ td|d d  dd� |d d d k�rtd!ƒ n<|d d dk�rtd"ƒ n.|d d dk�r)td#ƒ n |d d d$k�r7td%ƒ n|d d d&k�rEtd'ƒ ntd(ƒ td)|d d*  dd� |d d* d k�rctd+ƒ n.|d d* dk�rqtd,ƒ n |d d* dk�rtd-ƒ n|d d* d$k�r�td.ƒ ntd(ƒ td/|d d0 d d1…  ƒ td2|d d3 d d1…  ƒ td4|d d5  ƒ td6|d d7 d d1…  ƒ td8|d d9 d d1…  ƒ td:|d d; d d1…  ƒ �n| jd<k�ratd=| jj	 ƒ t ||¡}td>| jj	 dd� |d? d@ }|tjk�rtdAƒ �nÔ|tjk�rtdBƒ �nÈ|tjk�r+tdCƒ �n¼|tjk�r7tdDƒ �n°|tjk�rCtdEƒ �n¤|tjk�rOtdFƒ �n˜|tjk�r[tdGƒ �nŒtd(ƒ �n†| jdk�rÿt
 dH¡ t ||¡}tt|ƒƒD ]}}	tdI||	 dJ d d1… ||	 d7 d d1… f dd� ||	 dK d@ }|tjk�r¨tdAƒ �qx|tjk�r´tdBƒ �qx|tjk�rÀtdCƒ �qx|tjk�rÌtdDƒ �qx|tjk�rØtdEƒ �qx|tjk�rätdFƒ �qx|tjk�rðtdGƒ �qxtd(ƒ �qxtdLt|ƒ ƒ nè| jdk�r%t
 dM| jj	 ¡ tj||| jj	d | jjd | jj d dN� nÂ| jdOk�rßt
 dP| jj	 ¡ | jj!d u�rBt"| jj!ƒ}
ntj#}
| jj$d u�rSt"| jj$ƒ}ntj#}| jjd u�rd| jjd }nt%}| jj d u�rt| jj d }nt%}| jj&d u�r„| jj&d }nt%}| jj'd u�rÃ| (¡ }| )¡ }z| jj'd  *dQ¡}W n t+�y¼   d d l,}| jj'd  -| .¡ ¡ *dQ¡}Y nw t/||ƒ}nt%}t 0||||
tj1|t%t%t%d ||d |¡ t ||¡ nt
 2dR| j ¡ t ||¡ | 3¡  d S )SNÚ
lpScHandleÚLISTÚCREATEú ÚlpServiceHandleÚSTARTzStarting service %sÚSTOPzStopping service %sÚDELETEzDeleting service %sÚCONFIGzQuerying service config for %szTYPE              : %2d - ÚlpServiceConfigÚdwServiceTypeú )Úendé   zSERVICE_KERNEL_DRIVER é   zSERVICE_FILE_SYSTEM_DRIVER é   zSERVICE_WIN32_OWN_PROCESS é    zSERVICE_WIN32_SHARE_PROCESS é   zSERVICE_INTERACTIVE_PROCESS r   zSTART_TYPE        : %2d - ÚdwStartTyper   z
BOOT STARTzSYSTEM STARTz
AUTO STARTé   zDEMAND STARTé   ÚDISABLEDÚUNKNOWNzERROR_CONTROL     : %2d - ÚdwErrorControlÚIGNOREÚNORMALÚSEVEREÚCRITICALzBINARY_PATH_NAME  : %sÚlpBinaryPathNameéÿÿÿÿzLOAD_ORDER_GROUP  : %sÚlpLoadOrderGroupzTAG               : %dÚdwTagIdzDISPLAY_NAME      : %sÚlpDisplayNamezDEPENDENCIES      : %sÚlpDependencieszSERVICE_START_NAME: %sÚlpServiceStartNameÚSTATUSzQuerying status for %sz%30s - ÚlpServiceStatusÚdwCurrentStatezCONTINUE PENDINGzPAUSE PENDINGÚPAUSEDÚRUNNINGzSTART PENDINGzSTOP PENDINGÚSTOPPEDz$Listing services available on targetz%30s - %70s - ÚlpServiceNameÚServiceStatuszTotal Services: %dzCreating service %s)rT   ÚCHANGEzChanging service config for %szutf-16lezUnknown action %s)4Úget_dce_rpcÚconnectÚbindr   ÚMSRPC_UUID_SCMRÚhROpenSCManagerWr   ÚhROpenServiceWr   Únamer+   ÚinfoÚhRStartServiceWÚhRCloseServiceHandleÚhRControlServiceÚSERVICE_CONTROL_STOPÚhRDeleteServiceÚhRQueryServiceConfigWÚprintÚhRQueryServiceStatusÚSERVICE_CONTINUE_PENDINGÚSERVICE_PAUSE_PENDINGÚSERVICE_PAUSEDÚSERVICE_RUNNINGÚSERVICE_START_PENDINGÚSERVICE_STOP_PENDINGÚSERVICE_STOPPEDÚhREnumServicesStatusWÚrangeÚlenÚhRCreateServiceWÚdisplayÚpathÚ
start_typeÚintÚSERVICE_NO_CHANGEÚservice_typer	   Ú
start_namer#   Úget_smb_connectionÚgetSessionKeyÚencodeÚUnicodeDecodeErrorÚsysÚdecodeÚgetfilesystemencodingr
   ÚhRChangeServiceConfigWÚSERVICE_ERROR_IGNOREÚerrorÚ
disconnect)r!   r6   ÚdceÚrpcÚansÚscManagerHandleÚserviceHandleÚrespÚstateÚir�   r„   r   r€   r…   ÚsÚkeyr#   rŠ   r'   r'   r(   r2   H   s&  












 
4
ÿ þÿzSVCCTL.doStuffN)r   )Ú__name__Ú
__module__Ú__qualname__r)   r7   r2   r'   r'   r'   r(   r   (   s    
r   Ú__main__Úutf8Tz$Windows Service manipulation script.)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)r   Úhelpz-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputÚactionsr   )r¤   ÚdestÚstartzstarts the service)r¤   z-namezservice name)r   Úrequiredr¤   Ústopzstops the serviceÚdeletezdeletes the serviceÚstatuszreturns service statusÚconfigzreturns service configurationÚlistzlist available servicesÚcreatezcreate a servicez-displayzdisplay namez-pathzbinary pathÚchangezchange a service configurationFz-service_typezservice typez-start_typezservice start typez-start_namezPstring that specifies the name of the account under which the service should runz	-passwordzestring that contains the password of the account whose name was specified by the start_name parameterÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   Úmetavarr¤   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz
-target-ipz£IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)ÚchoicesÚnargsÚdefaultr²   r¤   rE   r   )Úgetpassz	Password:)KÚ
__future__r   r   rŠ   Úargparser+   ÚcodecsÚimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacketr   Úimpacket.dcerpc.v5r   r   Úimpacket.dcerpc.v5.ndrr	   Úimpacket.cryptor
   r   r›   ÚstdoutÚencodingÚ	getwriterrr   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_subparsersÚ
subparsersÚ
add_parserÚstart_parserÚstop_parserÚdelete_parserÚstatus_parserÚconfig_parserÚlist_parserÚcreate_parserÚadd_argument_groupÚgroupr}   ÚargvÚ
print_helpÚexitÚ
parse_argsr%   ÚinitÚtsr,   r¢   r$   r"   r#   r3   Ú	target_ipr   r   r   Úno_passrº   r‚   r&   Úservicesr7   Ú	ExceptionÚeÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr�   Ústrr'   r'   r'   r(   Ú<module>   s¦    
T


ÿ

8€ü›