<s> import random <EOL> import string <EOL> from impacket . dcerpc . v5 import transport , srvs , scmr <EOL> from impacket import smb , smb3 , LOG <EOL> from impacket . smbconnection import SMBConnection <EOL> class ServiceInstall : <EOL> def __init__ ( self , SMBObject , exeFile ) : <EOL> self . _rpctransport = <NUM_LIT:0> <EOL> self . __service_name = '<STR_LIT>' . join ( [ random . choice ( string . letters ) for i in range ( <NUM_LIT:4> ) ] ) <EOL> self . __binary_service_name = '<STR_LIT>' . join ( [ random . choice ( string . letters ) for i in range ( <NUM_LIT:8> ) ] ) + '<STR_LIT>' <EOL> self . __exeFile = exeFile <EOL> if isinstance ( SMBObject , smb . SMB ) or isinstance ( SMBObject , smb3 . SMB3 ) : <EOL> self . connection = SMBConnection ( existingConnection = SMBObject ) <EOL> else : <EOL> self . connection = SMBObject <EOL> self . share = '<STR_LIT>' <EOL> def getShare ( self ) : <EOL> return self . share <EOL> def getShares ( self ) : <EOL> LOG . info ( "<STR_LIT>" % ( self . connection . getRemoteHost ( ) ) ) <EOL> try : <EOL> self . _rpctransport = transport . SMBTransport ( self . connection . getRemoteHost ( ) , self . connection . getRemoteHost ( ) , filename = r'<STR_LIT>' , smb_connection = self . connection ) <EOL> dce_srvs = self . _rpctransport . get_dce_rpc ( ) <EOL> dce_srvs . connect ( ) <EOL> dce_srvs . bind ( srvs . MSRPC_UUID_SRVS ) <EOL> resp = srvs . hNetrShareEnum ( dce_srvs , <NUM_LIT:1> ) <EOL> return resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> except : <EOL> LOG . critical ( "<STR_LIT>" % ( self . connection . getRemoteHost ( ) ) ) <EOL> raise <EOL> def createService ( self , handle , share , path ) : <EOL> LOG . info ( "<STR_LIT>" % ( self . __service_name , self . connection . getRemoteHost ( ) ) ) <EOL> try : <EOL> resp = scmr . hROpenServiceW ( self . rpcsvc , handle , self . __service_name + '<STR_LIT:\x00>' ) <EOL> except Exception , e : <EOL> if str ( e ) . find ( '<STR_LIT>' ) >= <NUM_LIT:0> : <EOL> pass <EOL> else : <EOL> raise e <EOL> else : <EOL> scmr . hRDeleteService ( self . rpcsvc , resp [ '<STR_LIT>' ] ) <EOL> scmr . hRCloseServiceHandle ( self . rpcsvc , resp [ '<STR_LIT>' ] ) <EOL> command = '<STR_LIT>' % ( path , self . __binary_service_name ) <EOL> try : <EOL> resp = scmr . hRCreateServiceW ( self . rpcsvc , handle , self . __service_name + '<STR_LIT:\x00>' , self . __service_name + '<STR_LIT:\x00>' , lpBinaryPathName = command + '<STR_LIT:\x00>' ) <EOL> except : <EOL> LOG . critical ( "<STR_LIT>" % ( self . __service_name , self . connection . getRemoteHost ( ) ) ) <EOL> raise <EOL> else : <EOL> return resp [ '<STR_LIT>' ] <EOL> def openSvcManager ( self ) : <EOL> LOG . info ( "<STR_LIT>" % self . connection . getRemoteHost ( ) ) <EOL> self . _rpctransport = transport . SMBTransport ( self . connection . getRemoteHost ( ) , self . connection . getRemoteHost ( ) , filename = r'<STR_LIT>' , smb_connection = self . connection ) <EOL> self . rpcsvc = self . _rpctransport . get_dce_rpc ( ) <EOL> self . rpcsvc . connect ( ) <EOL> self . rpcsvc . bind ( scmr . MSRPC_UUID_SCMR ) <EOL> try : <EOL> resp = scmr . hROpenSCManagerW ( self . rpcsvc ) <EOL> except : <EOL> LOG . critical ( "<STR_LIT>" % self . connection . getRemoteHost ( ) ) <EOL> raise Exception ( '<STR_LIT>' ) <EOL> else : <EOL> return resp [ '<STR_LIT>' ] <EOL> def copy_file ( self , src , tree , dst ) : <EOL> LOG . info ( "<STR_LIT>" % dst ) <EOL> if isinstance ( src , str ) : <EOL> fh = open ( src , '<STR_LIT:rb>' ) <EOL> else : <EOL> fh = src <EOL> f = dst <EOL> pathname = string . replace ( f , '<STR_LIT:/>' , '<STR_LIT:\\>' ) <EOL> try : <EOL> self . connection . putFile ( tree , pathname , fh . read ) <EOL> except : <EOL> LOG . critical ( "<STR_LIT>" % dst ) <EOL> raise <EOL> fh . close ( ) <EOL> def findWritableShare ( self , shares ) : <EOL> for i in shares [ '<STR_LIT>' ] : <EOL> if i [ '<STR_LIT>' ] == srvs . STYPE_DISKTREE or i [ '<STR_LIT>' ] == srvs . STYPE_SPECIAL : <EOL> share = i [ '<STR_LIT>' ] [ : - <NUM_LIT:1> ] <EOL> try : <EOL> self . connection . createDirectory ( share , '<STR_LIT>' ) <EOL> except : <EOL> LOG . critical ( "<STR_LIT>" % share ) <EOL> pass <EOL> else : <EOL> LOG . info ( '<STR_LIT>' % share ) <EOL> self . connection . deleteDirectory ( share , '<STR_LIT>' ) <EOL> return str ( share ) <EOL> return None <EOL> def install ( self ) : <EOL> if self . connection . isGuestSession ( ) : <EOL> LOG . critical ( "<STR_LIT>" ) <EOL> self . connection . logoff ( ) <EOL> del self . connection <EOL> else : <EOL> fileCopied = False <EOL> serviceCreated = False <EOL> try : <EOL> shares = self . getShares ( ) <EOL> self . share = self . findWritableShare ( shares ) <EOL> self . copy_file ( self . __exeFile , self . share , self . __binary_service_name ) <EOL> fileCopied = True <EOL> svcManager = self . openSvcManager ( ) <EOL> if svcManager != <NUM_LIT:0> : <EOL> serverName = self . connection . getServerName ( ) <EOL> if self . share . lower ( ) == '<STR_LIT>' : <EOL> path = '<STR_LIT>' <EOL> else : <EOL> if serverName != '<STR_LIT>' : <EOL> path = '<STR_LIT>' % ( serverName , self . share ) <EOL> else : <EOL> path = '<STR_LIT>' + self . share <EOL> service = self . createService ( svcManager , self . share , path ) <EOL> serviceCreated = True <EOL> if service != <NUM_LIT:0> : <EOL> LOG . info ( '<STR_LIT>' % self . __service_name ) <EOL> try : <EOL> scmr . hRStartServiceW ( self . rpcsvc , service ) <EOL> except : <EOL> pass <EOL> scmr . hRCloseServiceHandle ( self . rpcsvc , service ) <EOL> scmr . hRCloseServiceHandle ( self . rpcsvc , svcManager ) <EOL> return True <EOL> except Exception , e : <EOL> LOG . critical ( "<STR_LIT>" % e ) <EOL> try : <EOL> scmr . hRControlService ( self . rpcsvc , service , scmr . SERVICE_CONTROL_STOP ) <EOL> except : <EOL> pass <EOL> if fileCopied is True : <EOL> try : <EOL> self . connection . deleteFile ( self . share , self . __binary_service_name ) <EOL> except : <EOL> pass <EOL> if serviceCreated is True : <EOL> try : <EOL> scmr . hRDeleteService ( self . rpcsvc , service ) <EOL> except : <EOL> pass <EOL> return False <EOL> def uninstall ( self ) : <EOL> fileCopied = True <EOL> serviceCreated = True <EOL> try : <EOL> svcManager = self . openSvcManager ( ) <EOL> if svcManager != <NUM_LIT:0> : <EOL> resp = scmr . hROpenServiceW ( self . rpcsvc , svcManager , self . __service_name + '<STR_LIT:\x00>' ) <EOL> service = resp [ '<STR_LIT>' ] <EOL> LOG . info ( '<STR_LIT>' % self . __service_name ) <EOL> try : <EOL> scmr . hRControlService ( self . rpcsvc , service , scmr . SERVICE_CONTROL_STOP ) <EOL> except : <EOL> pass <EOL> LOG . info ( '<STR_LIT>' % self . __service_name ) <EOL> scmr . hRDeleteService ( self . rpcsvc , service ) <EOL> scmr . hRCloseServiceHandle ( self . rpcsvc , service ) <EOL> scmr . hRCloseServiceHandle ( self . rpcsvc , svcManager ) <EOL> LOG . info ( '<STR_LIT>' % self . __binary_service_name ) <EOL> self . connection . deleteFile ( self . share , self . __binary_service_name ) <EOL> except Exception : <EOL> LOG . critical ( "<STR_LIT>" ) <EOL> try : <EOL> scmr . hRControlService ( self . rpcsvc , service , scmr . SERVICE_CONTROL_STOP ) <EOL> except : <EOL> pass <EOL> if fileCopied is True : <EOL> try : <EOL> self . connection . deleteFile ( self . share , self . __binary_service_name ) <EOL> except : <EOL> try : <EOL> self . connection . deleteFile ( self . share , self . __binary_service_name ) <EOL> except : <EOL> pass <EOL> pass <EOL> if serviceCreated is True : <EOL> try : <EOL> scmr . hRDeleteService ( self . rpcsvc , service ) <EOL> except : <EOL> pass </s>
