Closed usiegl00 closed 2 years ago
I will make a pr to metasploit-framework that depends on this one.
Thanks for updating this @usiegl00 ! The code looks good to me. I tested against Windows 10 and Windows Server 2019 and verified the code was executed correctly.
❯ ruby examples/pwsh_service.rb --username smbtest2 --password 123456 --no-smbv1 --no-smbv2 192.168.144.224 "echo test-smbv3 > C:\\Users\\smbtest2\\Desktop\\test.txt"
SMB3 : (0x00000000) STATUS_SUCCESS: The operation completed successfully.
Binding to \svcctl...
Bound to \svcctl
Opening Service Control Manager
Full Command: %COMSPEC% /c start /b /min powershell.exe -nop -win hid -noni -en ZQBjAGgAbwAgAHQAZQBzAHQALQBzAG0AYgB2ADMAIAA+ACAAQwA6AFwAVQBzAGUAcgBzAFwAcwBtAGIAdABlAHMAdAAyAFwARABlAHMAawB0AG8AcABcAHQAZQBzAHQALgB0AHgAdAA=
Created new service
Opening the service
Starting the service
Service start timed out, OK if running a command or non-service executable...
Deleting the service
Closing Service Control Manager
Done
Before it lands, that would be great to have unit tests for this. This will ensure any future updates to ruby_smb
won't break anything. Would you mind adding specs?
This pr adds support for more svcctl packets.
The two new svcctl functions are create_service_w and delete_service.
I will update the smb_shadow metasploit module to use the new packets once this is merged.