o
    j?B                  
   @   sv  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d d	lmZ G d
d dZedkr9ejjdu r]edeje_eej ejdddZejdddd ejdddd ejdddd ejdddZej dddZ!e!jd ddd!d" ej d#d$dZ"e"jd ddd!d" ej d%d&dZ#e#jd ddd!d" ej d'd(dZ$e$jd ddd!d" ej d)d*dZ%e%jd ddd!d" ej d+d,dZ&ej d-d.dZ'e'jd ddd!d" e'jd/ddd0d" e'jd1ddd2d" ej d3d4dZ'e'jd ddd!d" e'jd/dd5d0d" e'jd1dd5d2d" e'jd6dd5d7d" e'jd8dd5d9d" e'jd:dd5d;d" e'jd<dd5d=d" e(d>Z)e)jd?dd@dAdB e)jdCddDd e)jdEddFd e)jdGddHdIdB e(dJZ)e)jdKddLdMdB e)jdNddLdOdB e)jdPdQdRgdSdRdTdUdV e*ej+dWkre,  e-dW e. Z/e0e/j1e/j2 e
e/j3\Z4Z5Z6Z7e4du rdXZ4e/j8du re7e/_8e/j9durde/_:e6dXkre5dXkre/j;du re/j<d5u re/j9du rd dYl=m=Z= e=dZZ6ee5e6e4e/e>e/j?Z@z
e@Ae7e/j8 W dS  eBy8 ZC zeD jEejFkr&d dlGZGeGH  eIeJeC W Y dZC[CdS dZC[Cww dS )[    )division)print_functionN)logger)parse_target)version)	transportscmr)NULL)encryptSecretc                   @   s&   e Zd Zd	ddZdd Zdd ZdS )
SVCCTL  c                 C   st   || _ || _|| _|| _|j | _|| _d| _d| _	|j
| _|j| _|j| _|jd ur8|jd\| _| _	d S d S )N :)_SVCCTL__username_SVCCTL__password_SVCCTL__options_SVCCTL__portactionupper_SVCCTL__action_SVCCTL__domain_SVCCTL__lmhash_SVCCTL__nthashaesKey_SVCCTL__aesKeyk_SVCCTL__doKerberosdc_ip_SVCCTL__kdcHosthashessplit)selfusernamepassworddomainoptionsport r'   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/services.py__init__*   s   
zSVCCTL.__init__c                 C   s~   d| }t d|  t|}|| j || t|dr0|| j	| j
| j| j| j| j || j| j | | d S )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sset_credentials)loggingdebugr   DCERPCTransportFactory	set_dportr   setRemoteHosthasattrr*   r   r   r   r   r   r   set_kerberosr   r   doStuff)r!   
remoteName
remoteHoststringbindingrpctransportr'   r'   r(   run:   s   


 z
SVCCTL.runc                 C   s  |  }|  |tj |}t|}|d }| jdkr2| jdkr2t||| jj	d }|d }| jdkrNt
d| jj	  t|| t|| n| jdkrlt
d	| jj	  t||tj t|| n{| jd
krt
d| jj	  t|| t|| n_| jdkrt
d| jj	  t||}td|d d  dd |d d d@ rtddd |d d d@ rtddd |d d d@ rtddd |d d d@ rtddd |d d d@ rtddd td td|d d  dd |d d d krtd! n<|d d dkrtd" n.|d d dkr)td# n |d d d$kr7td% n|d d d&krEtd' ntd( td)|d d*  dd |d d* d krctd+ n.|d d* dkrqtd, n |d d* dkrtd- n|d d* d$krtd. ntd( td/|d d0 d d1   td2|d d3 d d1   td4|d d5   td6|d d7 d d1   td8|d d9 d d1   td:|d d; d d1   n| jd<kratd=| jj	  t||}td>| jj	 dd |d? d@ }|tjkrtdA n|tjkrtdB n|tjkr+tdC n|tjkr7tdD n|tjkrCtdE n|tjkrOtdF n|tjkr[tdG ntd( n| jdkrt
dH t||}tt|D ]}}	tdI||	 dJ d d1 ||	 d7 d d1 f dd ||	 dK d@ }|tjkrtdA qx|tjkrtdB qx|tjkrtdC qx|tjkrtdD qx|tjkrtdE qx|tjkrtdF qx|tjkrtdG qxtd( qxtdLt|  n| jdkr%t
dM| jj	  tj||| jj	d | jjd | jj d dN n| jdOkrt
dP| jj	  | jj!d urBt"| jj!}
ntj#}
| jj$d urSt"| jj$}ntj#}| jjd urd| jjd }nt%}| jj d urt| jj d }nt%}| jj&d ur| jj&d }nt%}| jj'd ur|( }|) }z| jj'd *dQ}W n t+y   d d l,}| jj'd -|. *dQ}Y nw t/||}nt%}t0||||
tj1|t%t%t%d ||d | t|| nt
2dR| j  t|| |3  d S )SN
lpScHandleLISTCREATE lpServiceHandleSTARTzStarting service %sSTOPzStopping service %sDELETEzDeleting service %sCONFIGzQuerying service config for %szTYPE              : %2d - lpServiceConfigdwServiceType )end   zSERVICE_KERNEL_DRIVER    zSERVICE_FILE_SYSTEM_DRIVER    zSERVICE_WIN32_OWN_PROCESS     zSERVICE_WIN32_SHARE_PROCESS    zSERVICE_INTERACTIVE_PROCESS r   zSTART_TYPE        : %2d - dwStartTyper   z
BOOT STARTzSYSTEM STARTz
AUTO START   zDEMAND START   DISABLEDUNKNOWNzERROR_CONTROL     : %2d - dwErrorControlIGNORENORMALSEVERECRITICALzBINARY_PATH_NAME  : %slpBinaryPathNamezLOAD_ORDER_GROUP  : %slpLoadOrderGroupzTAG               : %ddwTagIdzDISPLAY_NAME      : %slpDisplayNamezDEPENDENCIES      : %slpDependencieszSERVICE_START_NAME: %slpServiceStartNameSTATUSzQuerying status for %sz%30s - lpServiceStatusdwCurrentStatezCONTINUE PENDINGzPAUSE PENDINGPAUSEDRUNNINGzSTART PENDINGzSTOP PENDINGSTOPPEDz$Listing services available on targetz%30s - %70s - lpServiceNameServiceStatuszTotal Services: %dzCreating service %s)rT   CHANGEzChanging service config for %szutf-16lezUnknown action %s)4get_dce_rpcconnectbindr   MSRPC_UUID_SCMRhROpenSCManagerWr   hROpenServiceWr   namer+   infohRStartServiceWhRCloseServiceHandlehRControlServiceSERVICE_CONTROL_STOPhRDeleteServicehRQueryServiceConfigWprinthRQueryServiceStatusSERVICE_CONTINUE_PENDINGSERVICE_PAUSE_PENDINGSERVICE_PAUSEDSERVICE_RUNNINGSERVICE_START_PENDINGSERVICE_STOP_PENDINGSERVICE_STOPPEDhREnumServicesStatusWrangelenhRCreateServiceWdisplaypath
start_typeintSERVICE_NO_CHANGEservice_typer	   
start_namer#   get_smb_connectiongetSessionKeyencodeUnicodeDecodeErrorsysdecodegetfilesystemencodingr
   hRChangeServiceConfigWSERVICE_ERROR_IGNOREerror
disconnect)r!   r6   dcerpcansscManagerHandleserviceHandlerespstateir   r   r   r   r   skeyr#   r   r'   r'   r(   r2   H   s&  












 
4
 zSVCCTL.doStuffN)r   )__name__
__module____qualname__r)   r7   r2   r'   r'   r'   r(   r   (   s    
r   __main__utf8Tz$Windows Service manipulation script.)add_helpdescriptiontargetstorez6[[domain/]username[:password]@]<targetName or address>)r   helpz-debug
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputactionsr   )r   deststartzstarts the service)r   z-namezservice name)r   requiredr   stopzstops the servicedeletezdeletes the servicestatuszreturns service statusconfigzreturns service configurationlistzlist available servicescreatezcreate a servicez-displayzdisplay namez-pathzbinary pathchangezchange a service configurationFz-service_typezservice typez-start_typezservice start typez-start_namezPstring that specifies the name of the account under which the service should runz	-passwordzestring that contains the password of the account whose name was specified by the start_name parameterauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)
connectionz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz
-target-ipzIP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-port139445?zdestination portz)Destination port to connect to SMB Server)choicesnargsdefaultr   r   rE   r   )getpassz	Password:)K
__future__r   r   r   argparser+   codecsimpacket.examplesr   impacket.examples.utilsr   impacketr   impacket.dcerpc.v5r   r   impacket.dcerpc.v5.ndrr	   impacket.cryptor
   r   r   stdoutencoding	getwriterrr   BANNERArgumentParserparseradd_argumentadd_subparsers
subparsers
add_parserstart_parserstop_parserdelete_parserstatus_parserconfig_parserlist_parsercreate_parseradd_argument_groupgroupr}   argv
print_helpexit
parse_argsr%   inittsr,   r   r$   r"   r#   r3   	target_ipr   r   r   no_passr   r   r&   servicesr7   	Exceptione	getLoggerlevelDEBUG	traceback	print_excr   strr'   r'   r'   r(   <module>   s    
T




8