Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py : 88%

Hot-keys on this page
r m x p toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
1# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
2#
3# This software is provided under under a slightly modified version
4# of the Apache Software License. See the accompanying LICENSE file
5# for more information.
6#
7# Author: Alberto Solino (@agsolino)
8#
9# Description:
10# [MS-SCMR] Interface implementation
11#
12# Best way to learn how to use these calls is to grab the protocol standard
13# so you understand what the call does, and then read the test case located
14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
15#
16# Some calls have helper functions, which makes it even easier to use.
17# They are located at the end of this file.
18# Helper functions start with "h"<name of the call>.
19# There are test cases for them too.
20#
22from impacket import system_errors
23from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \
24 GUID, PBOOL, WIDESTR
25from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION
26from impacket.dcerpc.v5.rpcrt import DCERPCException
27from impacket.uuid import uuidtup_to_bin
29MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))
31class DCERPCSessionError(DCERPCException):
32 def __init__(self, error_string=None, error_code=None, packet=None):
33 DCERPCException.__init__(self, error_string, error_code, packet)
35 def __str__( self ):
36 key = self.error_code
37 if key in system_errors.ERROR_MESSAGES: 37 ↛ 42line 37 didn't jump to line 42, because the condition on line 37 was never false
38 error_msg_short = system_errors.ERROR_MESSAGES[key][0]
39 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
40 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
41 else:
42 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code
44################################################################################
45# CONSTANTS
46################################################################################
48# Access codes
49SERVICE_ALL_ACCESS = 0X000F01FF
50SERVICE_CHANGE_CONFIG = 0X00000002
51SERVICE_ENUMERATE_DEPENDENTS = 0X00000008
52SERVICE_INTERROGATE = 0X00000080
53SERVICE_PAUSE_CONTINUE = 0X00000040
54SERVICE_QUERY_CONFIG = 0X00000001
55SERVICE_QUERY_STATUS = 0X00000004
56SERVICE_START = 0X00000010
57SERVICE_STOP = 0X00000020
58SERVICE_USER_DEFINED_CTRL = 0X00000100
59SERVICE_SET_STATUS = 0X00008000
61# Specific Access for SCM
62SC_MANAGER_LOCK = 0x00000008
63SC_MANAGER_CREATE_SERVICE = 0x00000002
64SC_MANAGER_ENUMERATE_SERVICE = 0x00000004
65SC_MANAGER_CONNECT = 0x00000001
66SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010
67SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020
69# Service Types
70SERVICE_KERNEL_DRIVER = 0x00000001
71SERVICE_FILE_SYSTEM_DRIVER = 0x00000002
72SERVICE_WIN32_OWN_PROCESS = 0x00000010
73SERVICE_WIN32_SHARE_PROCESS = 0x00000020
74SERVICE_INTERACTIVE_PROCESS = 0x00000100
75SERVICE_NO_CHANGE = 0xffffffff
77# Start Types
78SERVICE_BOOT_START = 0x00000000
79SERVICE_SYSTEM_START = 0x00000001
80SERVICE_AUTO_START = 0x00000002
81SERVICE_DEMAND_START = 0x00000003
82SERVICE_DISABLED = 0x00000004
83SERVICE_NO_CHANGE = 0xffffffff
85# Error Control
86SERVICE_ERROR_IGNORE = 0x00000000
87SERVICE_ERROR_NORMAL = 0x00000001
88SERVICE_ERROR_SEVERE = 0x00000002
89SERVICE_ERROR_CRITICAL = 0x00000003
90SERVICE_NO_CHANGE = 0xffffffff
92# Service Control Codes
93SERVICE_CONTROL_CONTINUE = 0x00000003
94SERVICE_CONTROL_INTERROGATE = 0x00000004
95SERVICE_CONTROL_PARAMCHANGE = 0x00000006
96SERVICE_CONTROL_PAUSE = 0x00000002
97SERVICE_CONTROL_STOP = 0x00000001
98SERVICE_CONTROL_NETBINDADD = 0x00000007
99SERVICE_CONTROL_NETBINDREMOVE = 0x00000008
100SERVICE_CONTROL_NETBINDENABLE = 0x00000009
101SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A
103# Service State
104SERVICE_ACTIVE = 0x00000001
105SERVICE_INACTIVE = 0x00000002
106SERVICE_STATE_ALL = 0x00000003
108# Current State
109SERVICE_CONTINUE_PENDING = 0x00000005
110SERVICE_PAUSE_PENDING = 0x00000006
111SERVICE_PAUSED = 0x00000007
112SERVICE_RUNNING = 0x00000004
113SERVICE_START_PENDING = 0x00000002
114SERVICE_STOP_PENDING = 0x00000003
115SERVICE_STOPPED = 0x00000001
117# Controls Accepted
118SERVICE_ACCEPT_PARAMCHANGE = 0x00000008
119SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002
120SERVICE_ACCEPT_SHUTDOWN = 0x00000004
121SERVICE_ACCEPT_STOP = 0x00000001
122SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020
123SERVICE_ACCEPT_POWEREVENT = 0x00000040
124SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080
125SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100
126SERVICE_ACCEPT_TIMECHANGE = 0x00000200
127ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400
129# Security Information
130DACL_SECURITY_INFORMATION = 0x4
131GROUP_SECURITY_INFORMATION = 0x2
132OWNER_SECURITY_INFORMATION = 0x1
133SACL_SECURITY_INFORMATION = 0x8
135# Service Config2 Info Levels
136SERVICE_CONFIG_DESCRIPTION = 0x00000001
137SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002
138SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003
139SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004
140SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005
141SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006
142SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007
143SERVICE_CONFIG_PREFERRED_NODE = 0x00000009
144SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A
146# SC_ACTIONS Types
147SC_ACTION_NONE = 0
148SC_ACTION_RESTART = 1
149SC_ACTION_REBOOT = 2
150SC_ACTION_RUN_COMMAND = 3
152# SERVICE_SID_INFO types
153SERVICE_SID_TYPE_NONE = 0x00000000
154SERVICE_SID_TYPE_RESTRICTED = 0x00000003
155SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001
157# SC_STATUS_TYPE types
158SC_STATUS_PROCESS_INFO = 0
160# Notify Mask
161SERVICE_NOTIFY_CREATED = 0x00000080
162SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010
163SERVICE_NOTIFY_DELETE_PENDING = 0x00000200
164SERVICE_NOTIFY_DELETED = 0x00000100
165SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020
166SERVICE_NOTIFY_PAUSED = 0x00000040
167SERVICE_NOTIFY_RUNNING = 0x00000008
168SERVICE_NOTIFY_START_PENDING = 0x00000002
169SERVICE_NOTIFY_STOP_PENDING = 0x00000004
170SERVICE_NOTIFY_STOPPED = 0x00000001
172# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons
173SERVICE_STOP_CUSTOM = 0x20000000
174SERVICE_STOP_PLANNED = 0x40000000
175SERVICE_STOP_UNPLANNED = 0x10000000
177# SERVICE_TRIGGER triggers
178SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001
179SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002
180SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003
181SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004
182SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005
183SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020
185# SERVICE_TRIGGER actions
186SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001
187SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002
189# SERVICE_TRIGGER subTypes
190DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809'
191DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1'
192FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09'
193FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524'
194MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0'
195NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245'
196NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335'
197USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50'
199# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes
200SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001
201SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002
203################################################################################
204# STRUCTURES
205################################################################################
207class BYTE_ARRAY(NDRUniConformantArray):
208 item = 'c'
210class SC_RPC_HANDLE(NDRSTRUCT):
211 structure = (
212 ('Data','20s=""'),
213 )
214 def getAlignment(self):
215 return 1
217SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE
219class SERVICE_STATUS(NDRSTRUCT):
220 structure = (
221 ('dwServiceType',DWORD),
222 ('dwCurrentState',DWORD),
223 ('dwControlsAccepted',DWORD),
224 ('dwWin32ExitCode',DWORD),
225 ('dwServiceSpecificExitCode',DWORD),
226 ('dwCheckPoint',DWORD),
227 ('dwWaitHint',DWORD),
228 )
230class QUERY_SERVICE_CONFIGW(NDRSTRUCT):
231 structure = (
232 ('dwServiceType',DWORD),
233 ('dwStartType',DWORD),
234 ('dwErrorControl',DWORD),
235 ('lpBinaryPathName', LPWSTR),
236 ('lpLoadOrderGroup',LPWSTR),
237 ('dwTagId',DWORD),
238 ('lpDependencies',LPWSTR),
239 ('lpServiceStartName',LPWSTR),
240 ('lpDisplayName',LPWSTR),
241 )
243class SC_RPC_LOCK(NDRSTRUCT):
244 structure = (
245 ('Data','20s=""'),
246 )
247 def getAlignment(self):
248 return 1
250class LPSERVICE_STATUS(NDRPOINTER):
251 referent = (
252 ('Data',SERVICE_STATUS),
253 )
255SECURITY_INFORMATION = ULONG
257BOUNDED_DWORD_256K = DWORD
259class LPBOUNDED_DWORD_256K(NDRPOINTER):
260 referent = (
261 ('Data', BOUNDED_DWORD_256K),
262 )
264SVCCTL_HANDLEW = LPWSTR
266class ENUM_SERVICE_STATUSW(NDRSTRUCT):
267 structure = (
268 ('lpServiceName',LPWSTR),
269 ('lpDisplayName',LPWSTR),
270 ('ServiceStatus',SERVICE_STATUS),
271 )
273class LPQUERY_SERVICE_CONFIGW(NDRPOINTER):
274 referent = (
275 ('Data', QUERY_SERVICE_CONFIGW),
276 )
278BOUNDED_DWORD_8K = DWORD
279BOUNDED_DWORD_4K = DWORD
281class STRING_PTRSW(NDRSTRUCT):
282 structure = (
283 ('Data',NDRUniConformantArray),
284 )
285 def __init__(self, data = None, isNDR64 = False):
286 NDR.__init__(self,None,isNDR64)
287 self.fields['Data'].item = LPWSTR
288 if data is not None: 288 ↛ 289line 288 didn't jump to line 289, because the condition on line 288 was never true
289 self.fromString(data)
291class UNIQUE_STRING_PTRSW(NDRPOINTER):
292 referent = (
293 ('Data', STRING_PTRSW),
294 )
296class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT):
297 structure = (
298 ('fIsLocked',DWORD),
299 ('lpLockOwner',LPWSTR),
300 ('dwLockDuration',DWORD),
301 )
303class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT):
304 structure = (
305 ('dwDescriptionOffset', DWORD),
306 )
308class SERVICE_DESCRIPTIONW(NDRSTRUCT):
309 structure = (
310 ('lpDescription', LPWSTR),
311 )
313class LPSERVICE_DESCRIPTIONW(NDRPOINTER):
314 referent = (
315 ('Data', SERVICE_DESCRIPTIONW),
316 )
318class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT):
319 structure = (
320 ('dwResetPeriod', DWORD),
321 ('dwRebootMsgOffset', DWORD),
322 ('dwCommandOffset', DWORD),
323 ('cActions', DWORD),
324 ('dwsaActionsOffset', DWORD),
325 )
327class SC_ACTION(NDRSTRUCT):
328 structure = (
329 ('Type', DWORD),
330 ('Delay', DWORD) ,
331 )
333class SC_ACTIONS(NDRSTRUCT):
334 structure = (
335 ('Data', NDRUniConformantArray),
336 )
337 def __init__(self, data = None, isNDR64 = False):
338 NDR.__init__(self,None,isNDR64)
339 self.fields['Data'].item = SC_ACTION
340 if data is not None:
341 self.fromString(data)
343class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT):
344 structure = (
345 ('dwResetPeriod', DWORD),
346 ('lpRebootMsg', LPWSTR) ,
347 ('lpCommand', LPWSTR) ,
348 ('cActions', DWORD) ,
349 ('lpsaActions', SC_ACTIONS) ,
350 )
352class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER):
353 referent = (
354 ('Data', SERVICE_FAILURE_ACTIONSW),
355 )
357class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT):
358 structure = (
359 ('fFailureActionsOnNonCrashFailures', BOOL),
360 )
362class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER):
363 referent = (
364 ('Data', SERVICE_FAILURE_ACTIONS_FLAG),
365 )
367class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT):
368 structure = (
369 ('fDelayedAutostart', BOOL),
370 )
372class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER):
373 referent = (
374 ('Data', SERVICE_DELAYED_AUTO_START_INFO),
375 )
377class SERVICE_SID_INFO(NDRSTRUCT):
378 structure = (
379 ('dwServiceSidType', DWORD),
380 )
382class LPSERVICE_SID_INFO(NDRPOINTER):
383 referent = (
384 ('Data', SERVICE_SID_INFO),
385 )
388class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT):
389 structure = (
390 ('cbRequiredPrivileges',DWORD),
391 ('pRequiredPrivileges',LPBYTE),
392 )
393 def getData(self, soFar = 0):
394 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges'])
395 return NDR.getData(self, soFar = 0)
398class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER):
399 referent = (
400 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
401 )
403class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT):
404 structure = (
405 ('dwRequiredPrivilegesOffset', DWORD),
406 )
408class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT):
409 structure = (
410 ('dwPreshutdownTimeout', DWORD),
411 )
413class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER):
414 referent = (
415 ('Data', SERVICE_PRESHUTDOWN_INFO),
416 )
418class SERVICE_STATUS_PROCESS(NDRSTRUCT):
419 structure = (
420 ('dwServiceType', DWORD),
421 ('dwCurrentState', DWORD),
422 ('dwControlsAccepted', DWORD),
423 ('dwWin32ExitCode', DWORD),
424 ('dwServiceSpecificExitCode', DWORD),
425 ('dwCheckPoint', DWORD),
426 ('dwWaitHint', DWORD),
427 ('dwProcessId', DWORD),
428 ('dwServiceFlags', DWORD),
429 )
431class UCHAR_16(NDRSTRUCT):
432 structure = (
433 ('Data', '16s=""'),
434 )
435 def getAlignment(self):
436 return 1
438class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT):
439 structure = (
440 ('ullThreadId',ULONGLONG),
441 ('dwNotifyMask',DWORD),
442 ('CallbackAddressArray',UCHAR_16),
443 ('CallbackParamAddressArray',UCHAR_16),
444 ('ServiceStatus', SERVICE_STATUS_PROCESS),
445 ('dwNotificationStatus',DWORD),
446 ('dwSequence',DWORD),
447 )
449class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT):
450 structure = (
451 ('ullThreadId',ULONGLONG),
452 ('dwNotifyMask',DWORD),
453 ('CallbackAddressArray',UCHAR_16),
454 ('CallbackParamAddressArray',UCHAR_16),
455 ('ServiceStatus',SERVICE_STATUS_PROCESS),
456 ('dwNotificationStatus',DWORD),
457 ('dwSequence',DWORD),
458 ('dwNotificationTriggered',DWORD),
459 ('pszServiceNames',LPWSTR),
460 )
462class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER):
463 referent = (
464 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
465 )
467class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER):
468 referent = (
469 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
470 )
472class SC_RPC_NOTIFY_PARAMS(NDRUNION):
473 union = {
474 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),
475 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),
476 }
478class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray):
479 item = SC_RPC_NOTIFY_PARAMS
481class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT):
482 structure = (
483 ('cElements',BOUNDED_DWORD_4K),
484 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY),
485 )
487class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT):
488 structure = (
489 ('dwReason', DWORD),
490 ('pszComment', LPWSTR),
491 )
493class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT):
494 structure = (
495 ('dwDataType',DWORD ),
496 ('cbData',DWORD),
497 ('pData', LPBYTE),
498 )
499 def getData(self, soFar = 0):
500 if self['pData'] != 0:
501 self['cbData'] = len(self['pData'])
502 return NDR.getData(self, soFar)
504class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray):
505 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM
507class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER):
508 referent = (
509 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY),
510 )
512class SERVICE_TRIGGER(NDRSTRUCT):
513 structure = (
514 ('dwTriggerType', DWORD),
515 ('dwAction', DWORD),
516 ('pTriggerSubtype', PGUID),
517 ('cDataItems', DWORD),
518 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM),
519 )
520 def getData(self, soFar = 0):
521 if self['pDataItems'] != 0:
522 self['cDataItems'] = len(self['pDataItems'])
523 return NDR.getData(self, soFar)
525class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray):
526 item = SERVICE_TRIGGER
528class PSERVICE_TRIGGER(NDRPOINTER):
529 referent = (
530 ('Data', SERVICE_TRIGGER_ARRAY),
531 )
533class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT):
534 structure = (
535 ('ServiceStatus', SERVICE_STATUS_PROCESS),
536 )
538class SERVICE_TRIGGER_INFO(NDRSTRUCT):
539 structure = (
540 ('cTriggers', DWORD),
541 ('pTriggers', PSERVICE_TRIGGER),
542 ('pReserved', NDRPOINTERNULL ),
543 )
544 def getData(self, soFar = 0):
545 if self['pTriggers'] != 0:
546 self['cTriggers'] = len(self['pTriggers'])
547 return NDR.getData(self, soFar)
549class PSERVICE_TRIGGER_INFO(NDRPOINTER):
550 referent = (
551 ('Data', SERVICE_TRIGGER_INFO),
552 )
554class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT):
555 structure = (
556 ('usPreferredNode', USHORT),
557 ('fDelete', BOOL),
558 )
560class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER):
561 referent = (
562 ('Data', SERVICE_PREFERRED_NODE_INFO),
563 )
565class SERVICE_RUNLEVEL_INFO(NDRSTRUCT):
566 structure = (
567 ('eLowestRunLevel', DWORD),
568 )
570class PSERVICE_RUNLEVEL_INFO(NDRPOINTER):
571 referent = (
572 ('Data', SERVICE_RUNLEVEL_INFO),
573 )
575class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT):
576 structure = (
577 ('fIsManagedAccount', DWORD),
578 )
580class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER):
581 referent = (
582 ('Data', SERVICE_MANAGEDACCOUNT_INFO),
583 )
585class SC_RPC_CONFIG_INFOW_UNION(NDRUNION):
586 commonHdr = (
587 ('tag', ULONG),
588 )
590 union = {
591 1: ('psd', LPSERVICE_DESCRIPTIONW),
592 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ),
593 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO),
594 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG),
595 5: ('pssid',LPSERVICE_SID_INFO),
596 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO),
597 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO),
598 8: ('psti',PSERVICE_TRIGGER_INFO),
599 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO),
600 10: ('psri',PSERVICE_RUNLEVEL_INFO),
601 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO),
602 }
604class SC_RPC_CONFIG_INFOW(NDRSTRUCT):
605 structure = (
606 ('dwInfoLevel', DWORD),
607 ('Union', SC_RPC_CONFIG_INFOW_UNION),
608 )
610################################################################################
611# RPC CALLS
612################################################################################
614class RCloseServiceHandle(NDRCALL):
615 opnum = 0
616 structure = (
617 ('hSCObject',SC_RPC_HANDLE),
618 )
620class RCloseServiceHandleResponse(NDRCALL):
621 structure = (
622 ('hSCObject',SC_RPC_HANDLE),
623 ('ErrorCode', DWORD),
624 )
626class RControlService(NDRCALL):
627 opnum = 1
628 structure = (
629 ('hService',SC_RPC_HANDLE),
630 ('dwControl',DWORD),
631 )
633class RControlServiceResponse(NDRCALL):
634 structure = (
635 ('lpServiceStatus',SERVICE_STATUS),
636 ('ErrorCode', DWORD),
637 )
639class RDeleteService(NDRCALL):
640 opnum = 2
641 structure = (
642 ('hService',SC_RPC_HANDLE),
643 )
645class RDeleteServiceResponse(NDRCALL):
646 structure = (
647 ('ErrorCode', DWORD),
648 )
650class RLockServiceDatabase(NDRCALL):
651 opnum = 3
652 structure = (
653 ('hSCManager',SC_RPC_HANDLE),
654 )
656class RLockServiceDatabaseResponse(NDRCALL):
657 structure = (
658 ('lpLock',SC_RPC_LOCK),
659 ('ErrorCode', DWORD),
660 )
662class RQueryServiceObjectSecurity(NDRCALL):
663 opnum = 4
664 structure = (
665 ('hService',SC_RPC_HANDLE),
666 ('dwSecurityInformation',SECURITY_INFORMATION),
667 ('cbBufSize',DWORD),
668 )
670class RQueryServiceObjectSecurityResponse(NDRCALL):
671 structure = (
672 ('lpSecurityDescriptor', BYTE_ARRAY),
673 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
674 ('ErrorCode', DWORD),
675 )
677class RSetServiceObjectSecurity(NDRCALL):
678 opnum = 5
679 structure = (
680 ('hService',SC_RPC_HANDLE),
681 ('dwSecurityInformation',SECURITY_INFORMATION),
682 ('lpSecurityDescriptor',LPBYTE),
683 ('cbBufSize',DWORD),
684 )
686class RSetServiceObjectSecurityResponse(NDRCALL):
687 structure = (
688 ('ErrorCode', DWORD),
689 )
691class RQueryServiceStatus(NDRCALL):
692 opnum = 6
693 structure = (
694 ('hService',SC_RPC_HANDLE),
695 )
697class RQueryServiceStatusResponse(NDRCALL):
698 structure = (
699 ('lpServiceStatus',SERVICE_STATUS),
700 ('ErrorCode', DWORD),
701 )
703class RSetServiceStatus(NDRCALL):
704 opnum = 7
705 structure = (
706 ('hServiceStatus',SC_RPC_HANDLE),
707 ('lpServiceStatus',SERVICE_STATUS),
708 )
710class RSetServiceStatusResponse(NDRCALL):
711 structure = (
712 ('ErrorCode', DWORD),
713 )
715class RUnlockServiceDatabase(NDRCALL):
716 opnum = 8
717 structure = (
718 ('Lock',SC_RPC_LOCK),
719 )
721class RUnlockServiceDatabaseResponse(NDRCALL):
722 structure = (
723 ('Lock',SC_RPC_LOCK),
724 ('ErrorCode', DWORD),
725 )
727class RNotifyBootConfigStatus(NDRCALL):
728 opnum = 9
729 structure = (
730 ('lpMachineName',SVCCTL_HANDLEW),
731 ('BootAcceptable',DWORD),
732 )
734class RNotifyBootConfigStatusResponse(NDRCALL):
735 structure = (
736 ('ErrorCode', DWORD),
737 )
739class RChangeServiceConfigW(NDRCALL):
740 opnum = 11
741 structure = (
742 ('hService',SC_RPC_HANDLE),
743 ('dwServiceType',DWORD),
744 ('dwStartType',DWORD),
745 ('dwErrorControl',DWORD),
746 ('lpBinaryPathName',LPWSTR),
747 ('lpLoadOrderGroup',LPWSTR),
748 ('lpdwTagId',LPDWORD),
749 ('lpDependencies',LPBYTE),
750 ('dwDependSize',DWORD),
751 ('lpServiceStartName',LPWSTR),
752 ('lpPassword',LPBYTE),
753 ('dwPwSize',DWORD),
754 ('lpDisplayName',LPWSTR),
755 )
757class RChangeServiceConfigWResponse(NDRCALL):
758 structure = (
759 ('lpdwTagId',LPDWORD),
760 ('ErrorCode', DWORD),
761 )
763class RCreateServiceW(NDRCALL):
764 opnum = 12
765 structure = (
766 ('hSCManager',SC_RPC_HANDLE),
767 ('lpServiceName',WSTR),
768 ('lpDisplayName',LPWSTR),
769 ('dwDesiredAccess',DWORD),
770 ('dwServiceType',DWORD),
771 ('dwStartType',DWORD),
772 ('dwErrorControl',DWORD),
773 ('lpBinaryPathName',WSTR),
774 ('lpLoadOrderGroup',LPWSTR),
775 ('lpdwTagId',LPDWORD),
776 ('lpDependencies',LPBYTE),
777 ('dwDependSize',DWORD),
778 ('lpServiceStartName',LPWSTR),
779 ('lpPassword',LPBYTE),
780 ('dwPwSize',DWORD),
781 )
783class RCreateServiceWResponse(NDRCALL):
784 structure = (
785 ('lpdwTagId',LPWSTR),
786 ('lpServiceHandle',SC_RPC_HANDLE),
787 ('ErrorCode', DWORD),
788 )
790class REnumDependentServicesW(NDRCALL):
791 opnum = 13
792 structure = (
793 ('hService',SC_RPC_HANDLE),
794 ('dwServiceState',DWORD),
795 ('cbBufSize',DWORD),
796 )
798class REnumDependentServicesWResponse(NDRCALL):
799 structure = (
800 ('lpServices',NDRUniConformantArray),
801 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
802 ('lpServicesReturned',BOUNDED_DWORD_256K),
803 ('ErrorCode', DWORD),
804 )
806class REnumServicesStatusW(NDRCALL):
807 opnum = 14
808 structure = (
809 ('hSCManager',SC_RPC_HANDLE),
810 ('dwServiceType',DWORD),
811 ('dwServiceState',DWORD),
812 ('cbBufSize',DWORD),
813 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
814 )
816class REnumServicesStatusWResponse(NDRCALL):
817 structure = (
818 ('lpBuffer',NDRUniConformantArray),
819 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
820 ('lpServicesReturned',BOUNDED_DWORD_256K),
821 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
822 ('ErrorCode', DWORD),
823 )
825class ROpenSCManagerW(NDRCALL):
826 opnum = 15
827 structure = (
828 ('lpMachineName',SVCCTL_HANDLEW),
829 ('lpDatabaseName',LPWSTR),
830 ('dwDesiredAccess',DWORD),
831 )
833class ROpenSCManagerWResponse(NDRCALL):
834 structure = (
835 ('lpScHandle',SC_RPC_HANDLE),
836 ('ErrorCode', DWORD),
837 )
839class ROpenServiceW(NDRCALL):
840 opnum = 16
841 structure = (
842 ('hSCManager',SC_RPC_HANDLE),
843 ('lpServiceName',WSTR),
844 ('dwDesiredAccess',DWORD),
845 )
847class ROpenServiceWResponse(NDRCALL):
848 structure = (
849 ('lpServiceHandle',SC_RPC_HANDLE),
850 ('ErrorCode', DWORD),
851 )
853class RQueryServiceConfigW(NDRCALL):
854 opnum = 17
855 structure = (
856 ('hService',SC_RPC_HANDLE),
857 ('cbBufSize',DWORD),
858 )
860class RQueryServiceConfigWResponse(NDRCALL):
861 structure = (
862 ('lpServiceConfig',QUERY_SERVICE_CONFIGW),
863 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
864 ('ErrorCode', DWORD),
865 )
867class RQueryServiceLockStatusW(NDRCALL):
868 opnum = 18
869 structure = (
870 ('hSCManager',SC_RPC_HANDLE),
871 ('cbBufSize',DWORD),
872 )
874class RQueryServiceLockStatusWResponse(NDRCALL):
875 structure = (
876 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW),
877 ('pcbBytesNeeded',BOUNDED_DWORD_4K),
878 ('ErrorCode', DWORD),
879 )
881class RStartServiceW(NDRCALL):
882 opnum = 19
883 structure = (
884 ('hService',SC_RPC_HANDLE),
885 ('argc',DWORD),
886 ('argv',UNIQUE_STRING_PTRSW),
887 )
889class RStartServiceWResponse(NDRCALL):
890 structure = (
891 ('ErrorCode', DWORD),
892 )
894class RGetServiceDisplayNameW(NDRCALL):
895 opnum = 20
896 structure = (
897 ('hSCManager',SC_RPC_HANDLE),
898 ('lpServiceName',WSTR),
899 ('lpcchBuffer',DWORD),
900 )
902class RGetServiceDisplayNameWResponse(NDRCALL):
903 structure = (
904 ('lpDisplayName',WSTR),
905 ('lpcchBuffer',DWORD),
906 ('ErrorCode', DWORD),
907 )
909class RGetServiceKeyNameW(NDRCALL):
910 opnum = 21
911 structure = (
912 ('hSCManager',SC_RPC_HANDLE),
913 ('lpDisplayName',WSTR),
914 ('lpcchBuffer',DWORD),
915 )
917class RGetServiceKeyNameWResponse(NDRCALL):
918 structure = (
919 ('lpDisplayName',WSTR),
920 ('lpcchBuffer',DWORD),
921 ('ErrorCode', DWORD),
922 )
924class REnumServiceGroupW(NDRCALL):
925 opnum = 35
926 structure = (
927 ('hSCManager',SC_RPC_HANDLE),
928 ('dwServiceType',DWORD),
929 ('dwServiceState',DWORD),
930 ('cbBufSize',DWORD),
931 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
932 ('pszGroupName',LPWSTR),
933 )
935class REnumServiceGroupWResponse(NDRCALL):
936 structure = (
937 ('lpBuffer',LPBYTE),
938 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
939 ('lpServicesReturned',BOUNDED_DWORD_256K),
940 ('lpResumeIndex',BOUNDED_DWORD_256K),
941 ('ErrorCode', DWORD),
942 )
944class RChangeServiceConfig2W(NDRCALL):
945 opnum = 37
946 structure = (
947 ('hService',SC_RPC_HANDLE),
948 ('Info',SC_RPC_CONFIG_INFOW),
949 )
951class RChangeServiceConfig2WResponse(NDRCALL):
952 structure = (
953 ('ErrorCode', DWORD),
954 )
956class RQueryServiceConfig2W(NDRCALL):
957 opnum = 39
958 structure = (
959 ('hService',SC_RPC_HANDLE),
960 ('dwInfoLevel',DWORD),
961 ('cbBufSize',DWORD),
962 )
964class RQueryServiceConfig2WResponse(NDRCALL):
965 structure = (
966 ('lpBuffer',NDRUniConformantArray),
967 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
968 ('ErrorCode', DWORD),
969 )
971class RQueryServiceStatusEx(NDRCALL):
972 opnum = 40
973 structure = (
974 ('hService',SC_RPC_HANDLE),
975 ('InfoLevel',DWORD),
976 ('cbBufSize',DWORD),
977 )
979class RQueryServiceStatusExResponse(NDRCALL):
980 structure = (
981 ('lpBuffer',NDRUniConformantArray),
982 ('pcbBytesNeeded',BOUNDED_DWORD_8K),
983 ('ErrorCode', DWORD),
984 )
986class REnumServicesStatusExW(NDRCALL):
987 opnum = 42
988 structure = (
989 ('hSCManager',SC_RPC_HANDLE),
990 ('InfoLevel',DWORD),
991 ('dwServiceType',DWORD),
992 ('dwServiceState',DWORD),
993 ('cbBufSize',DWORD),
994 ('lpResumeIndex',LPBOUNDED_DWORD_256K),
995 ('pszGroupName',LPWSTR),
996 )
998class REnumServicesStatusExWResponse(NDRCALL):
999 structure = (
1000 ('lpBuffer',NDRUniConformantArray),
1001 ('pcbBytesNeeded',BOUNDED_DWORD_256K),
1002 ('lpServicesReturned',BOUNDED_DWORD_256K),
1003 ('lpResumeIndex',BOUNDED_DWORD_256K),
1004 ('ErrorCode', DWORD),
1005 )
1007class RCreateServiceWOW64W(NDRCALL):
1008 opnum = 45
1009 structure = (
1010 ('hSCManager',SC_RPC_HANDLE),
1011 ('lpServiceName',WSTR),
1012 ('lpDisplayName',LPWSTR),
1013 ('dwDesiredAccess',DWORD),
1014 ('dwServiceType',DWORD),
1015 ('dwStartType',DWORD),
1016 ('dwErrorControl',DWORD),
1017 ('lpBinaryPathName',WSTR),
1018 ('lpLoadOrderGroup',LPWSTR),
1019 ('lpdwTagId',LPDWORD),
1020 ('lpDependencies',LPBYTE),
1021 ('dwDependSize',DWORD),
1022 ('lpServiceStartName',LPWSTR),
1023 ('lpPassword',LPBYTE),
1024 ('dwPwSize',DWORD),
1025 )
1027class RCreateServiceWOW64WResponse(NDRCALL):
1028 structure = (
1029 ('lpdwTagId',LPWSTR),
1030 ('lpServiceHandle',SC_RPC_HANDLE),
1031 ('ErrorCode', DWORD),
1032 )
1034# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here
1035class RNotifyServiceStatusChange(NDRCALL):
1036 opnum = 47
1037 structure = (
1038 ('hService',SC_RPC_HANDLE),
1039 ('NotifyParams',SC_RPC_NOTIFY_PARAMS),
1040 ('pClientProcessGuid',GUID),
1041 )
1043class RNotifyServiceStatusChangeResponse(NDRCALL):
1044 structure = (
1045 ('pSCMProcessGuid',GUID),
1046 ('pfCreateRemoteQueue',PBOOL),
1047 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1048 ('ErrorCode', DWORD),
1049 )
1051# Not working, until I don't fix the previous one
1052class RGetNotifyResults(NDRCALL):
1053 opnum = 48
1054 structure = (
1055 ('hNotify',SC_NOTIFY_RPC_HANDLE),
1056 )
1058class RGetNotifyResultsResponse(NDRCALL):
1059 structure = (
1060 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST),
1061 ('ErrorCode', DWORD),
1062 )
1064# Not working, until I don't fix the previous ones
1065class RCloseNotifyHandle(NDRCALL):
1066 opnum = 49
1067 structure = (
1068 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1069 )
1071class RCloseNotifyHandleResponse(NDRCALL):
1072 structure = (
1073 ('phNotify',SC_NOTIFY_RPC_HANDLE),
1074 ('pfApcFired',PBOOL),
1075 ('ErrorCode', DWORD),
1076 )
1078# Not working, returning bad_stub_data
1079class RControlServiceExW(NDRCALL):
1080 opnum = 51
1081 structure = (
1082 ('hService',SC_RPC_HANDLE),
1083 ('dwControl',DWORD),
1084 ('dwInfoLevel',DWORD),
1085 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW),
1086 )
1088class RControlServiceExWResponse(NDRCALL):
1089 structure = (
1090 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS),
1091 ('ErrorCode', DWORD),
1092 )
1094class RQueryServiceConfigEx(NDRCALL):
1095 opnum = 56
1096 structure = (
1097 ('hService',SC_RPC_HANDLE),
1098 ('dwInfoLevel',DWORD),
1099 )
1101class RQueryServiceConfigExResponse(NDRCALL):
1102 structure = (
1103 ('pInfo',SC_RPC_CONFIG_INFOW),
1104 ('ErrorCode', DWORD),
1105 )
1107################################################################################
1108# OPNUMs and their corresponding structures
1109################################################################################
1110OPNUMS = {
1111 0 : (RCloseServiceHandle, RCloseServiceHandleResponse),
1112 1 : (RControlService, RControlServiceResponse),
1113 2 : (RDeleteService, RDeleteServiceResponse),
1114 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse),
1115 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse),
1116 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse),
1117 6 : (RQueryServiceStatus, RQueryServiceStatusResponse),
1118 7 : (RSetServiceStatus, RSetServiceStatusResponse),
1119 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse),
1120 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse),
112111 : (RChangeServiceConfigW, RChangeServiceConfigWResponse),
112212 : (RCreateServiceW, RCreateServiceWResponse),
112313 : (REnumDependentServicesW, REnumDependentServicesWResponse),
112414 : (REnumServicesStatusW, REnumServicesStatusWResponse),
112515 : (ROpenSCManagerW, ROpenSCManagerWResponse),
112616 : (ROpenServiceW, ROpenServiceWResponse),
112717 : (RQueryServiceConfigW, RQueryServiceConfigWResponse),
112818 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse),
112919 : (RStartServiceW, RStartServiceWResponse),
113020 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse),
113121 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse),
113235 : (REnumServiceGroupW, REnumServiceGroupWResponse),
113337 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse),
113439 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse),
113540 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse),
113642 : (REnumServicesStatusExW, REnumServicesStatusExWResponse),
113745 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse),
113847 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse),
113948 : (RGetNotifyResults, RGetNotifyResultsResponse),
114049 : (RCloseNotifyHandle, RCloseNotifyHandleResponse),
114151 : (RControlServiceExW, RControlServiceExWResponse),
114256 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse),
1143}
1145################################################################################
1146# HELPER FUNCTIONS
1147################################################################################
1148def checkNullString(string):
1149 if string == NULL:
1150 return string
1152 if string[-1:] != '\x00':
1153 return string + '\x00'
1154 else:
1155 return string
1157def hRCloseServiceHandle(dce, hSCObject):
1158 request = RCloseServiceHandle()
1159 request['hSCObject'] = hSCObject
1160 return dce.request(request)
1162def hRControlService(dce, hService, dwControl):
1163 request = RControlService()
1164 request['hService'] = hService
1165 request['dwControl'] = dwControl
1166 return dce.request(request)
1168def hRDeleteService(dce, hService):
1169 request = RDeleteService()
1170 request ['hService'] = hService
1171 return dce.request(request)
1173def hRLockServiceDatabase(dce, hSCManager):
1174 request = RLockServiceDatabase()
1175 request['hSCManager'] = hSCManager
1176 return dce.request(request)
1179def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0):
1180 request = RQueryServiceObjectSecurity()
1181 request['hService'] = hService
1182 request['dwSecurityInformation'] = dwSecurityInformation
1183 request['cbBufSize'] = cbBufSize
1184 try:
1185 resp = dce.request(request)
1186 except DCERPCSessionError as e:
1187 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:
1188 resp = e.get_packet()
1189 request['cbBufSize'] = resp['pcbBytesNeeded']
1190 resp = dce.request(request)
1191 else:
1192 raise
1193 return resp
1195def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ):
1196 request = RSetServiceObjectSecurity()
1197 request['hService'] = hService
1198 request['dwSecurityInformation'] = dwSecurityInformation
1199 request['cbBufSize'] = cbBufSize
1200 return dce.request(request)
1202def hRQueryServiceStatus(dce, hService ):
1203 request = RQueryServiceStatus()
1204 request['hService'] = hService
1205 return dce.request(request)
1207def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ):
1208 request = RSetServiceStatus()
1209 request['hServiceStatus'] = hServiceStatus
1210 request['lpServiceStatus'] = lpServiceStatus
1211 return dce.request(request)
1213def hRUnlockServiceDatabase(dce, Lock ):
1214 request = RUnlockServiceDatabase()
1215 request['Lock'] = Lock
1216 return dce.request(request)
1218def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ):
1219 request = RNotifyBootConfigStatus()
1220 request['lpMachineName'] = lpMachineName
1221 request['BootAcceptable'] = BootAcceptable
1222 return dce.request(request)
1224def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL):
1225 changeServiceConfig = RChangeServiceConfigW()
1226 changeServiceConfig['hService'] = hService
1227 changeServiceConfig['dwServiceType'] = dwServiceType
1228 changeServiceConfig['dwStartType'] = dwStartType
1229 changeServiceConfig['dwErrorControl'] = dwErrorControl
1230 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
1231 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
1232 changeServiceConfig['lpdwTagId'] = lpdwTagId
1233 changeServiceConfig['lpDependencies'] = lpDependencies
1234 # Strings MUST be NULL terminated for lpDependencies
1235 changeServiceConfig['dwDependSize'] = dwDependSize
1236 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName)
1237 changeServiceConfig['lpPassword'] = lpPassword
1238 changeServiceConfig['dwPwSize'] = dwPwSize
1239 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName)
1240 return dce.request(changeServiceConfig)
1242def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0):
1243 createService = RCreateServiceW()
1244 createService['hSCManager'] = hSCManager
1245 createService['lpServiceName'] = checkNullString(lpServiceName)
1246 createService['lpDisplayName'] = checkNullString(lpDisplayName)
1247 createService['dwDesiredAccess'] = dwDesiredAccess
1248 createService['dwServiceType'] = dwServiceType
1249 createService['dwStartType'] = dwStartType
1250 createService['dwErrorControl'] = dwErrorControl
1251 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName)
1252 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)
1253 createService['lpdwTagId'] = lpdwTagId
1254 # Strings MUST be NULL terminated for lpDependencies
1255 createService['lpDependencies'] = lpDependencies
1256 createService['dwDependSize'] = dwDependSize
1257 createService['lpServiceStartName'] = checkNullString(lpServiceStartName)
1258 createService['lpPassword'] = lpPassword
1259 createService['dwPwSize'] = dwPwSize
1260 return dce.request(createService)
1262def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ):
1263 enumDependentServices = REnumDependentServicesW()
1264 enumDependentServices['hService'] = hService
1265 enumDependentServices['dwServiceState'] = dwServiceState
1266 enumDependentServices['cbBufSize'] = cbBufSize
1267 return dce.request(enumDependentServices)
1269def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL):
1270 class ENUM_SERVICE_STATUSW2(NDRSTRUCT):
1271 # This is a little trick, since the original structure is slightly different
1272 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid
1273 # of the NDR library, although the pointers are swapped from the original specification.
1274 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory
1275 # where the pointers are actually POINTING to the data.
1276 # Sadly, the pointers are not aligned based on the services records, so we gotta do this
1277 # It should be easier in C of course.
1278 class STR(NDRPOINTER):
1279 referent = (
1280 ('Data', WIDESTR),
1281 )
1282 structure = (
1283 ('lpServiceName',STR),
1284 ('lpDisplayName',STR),
1285 ('ServiceStatus',SERVICE_STATUS),
1286 )
1288 enumServicesStatus = REnumServicesStatusW()
1289 enumServicesStatus['hSCManager'] = hSCManager
1290 enumServicesStatus['dwServiceType'] = dwServiceType
1291 enumServicesStatus['dwServiceState'] = dwServiceState
1292 enumServicesStatus['cbBufSize'] = 0
1293 enumServicesStatus['lpResumeIndex'] = NULL
1295 try:
1296 resp = dce.request(enumServicesStatus)
1297 except DCERPCSessionError as e:
1298 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1298 ↛ 1303line 1298 didn't jump to line 1303, because the condition on line 1298 was never false
1299 resp = e.get_packet()
1300 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded']
1301 resp = dce.request(enumServicesStatus)
1302 else:
1303 raise
1305 # Now we're supposed to have all services returned. Now we gotta parse them
1307 enumArray = NDRUniConformantArray()
1308 enumArray.item = ENUM_SERVICE_STATUSW2
1310 enumArray.setArraySize(resp['lpServicesReturned'])
1312 data = b''.join(resp['lpBuffer'])
1313 enumArray.fromString(data)
1314 data = data[4:]
1315 # Since the pointers here are pointing to the actual data, we have to reparse
1316 # the referents
1317 for record in enumArray['Data']:
1318 offset = record.fields['lpDisplayName'].fields['ReferentID']-4
1319 name = WIDESTR(data[offset:])
1320 record['lpDisplayName'] = name['Data']
1321 offset = record.fields['lpServiceName'].fields['ReferentID']-4
1322 name = WIDESTR(data[offset:])
1323 record['lpServiceName'] = name['Data']
1325 return enumArray['Data']
1327def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE):
1328 openSCManager = ROpenSCManagerW()
1329 openSCManager['lpMachineName'] = checkNullString(lpMachineName)
1330 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName)
1331 openSCManager['dwDesiredAccess'] = dwDesiredAccess
1332 return dce.request(openSCManager)
1334def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS):
1335 openService = ROpenServiceW()
1336 openService['hSCManager'] = hSCManager
1337 openService['lpServiceName'] = checkNullString(lpServiceName)
1338 openService['dwDesiredAccess'] = dwDesiredAccess
1339 return dce.request(openService)
1341def hRQueryServiceConfigW(dce, hService):
1342 queryService = RQueryServiceConfigW()
1343 queryService['hService'] = hService
1344 queryService['cbBufSize'] = 0
1345 try:
1346 resp = dce.request(queryService)
1347 except DCERPCSessionError as e:
1348 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 1348 ↛ 1353line 1348 didn't jump to line 1353, because the condition on line 1348 was never false
1349 resp = e.get_packet()
1350 queryService['cbBufSize'] = resp['pcbBytesNeeded']
1351 resp = dce.request(queryService)
1352 else:
1353 raise
1355 return resp
1357def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ):
1358 queryServiceLock = RQueryServiceLockStatusW()
1359 queryServiceLock['hSCManager'] = hSCManager
1360 queryServiceLock['cbBufSize'] = cbBufSize
1361 return dce.request(queryServiceLock)
1363def hRStartServiceW(dce, hService, argc=0, argv=NULL ):
1364 startService = RStartServiceW()
1365 startService['hService'] = hService
1366 startService['argc'] = argc
1367 if argc == 0:
1368 startService['argv'] = NULL
1369 else:
1370 for item in argv:
1371 itemn = LPWSTR()
1372 itemn['Data'] = checkNullString(item)
1373 startService['argv'].append(itemn)
1374 return dce.request(startService)
1376def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ):
1377 getServiceDisplay = RGetServiceDisplayNameW()
1378 getServiceDisplay['hSCManager'] = hSCManager
1379 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName)
1380 getServiceDisplay['lpcchBuffer'] = lpcchBuffer
1381 return dce.request(getServiceDisplay)
1383def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ):
1384 getServiceKeyName = RGetServiceKeyNameW()
1385 getServiceKeyName['hSCManager'] = hSCManager
1386 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName)
1387 getServiceKeyName['lpcchBuffer'] = lpcchBuffer
1388 return dce.request(getServiceKeyName)
1390def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ):
1391 enumServiceGroup = REnumServiceGroupW()
1392 enumServiceGroup['hSCManager'] = hSCManager
1393 enumServiceGroup['dwServiceType'] = dwServiceType
1394 enumServiceGroup['dwServiceState'] = dwServiceState
1395 enumServiceGroup['cbBufSize'] = cbBufSize
1396 enumServiceGroup['lpResumeIndex'] = lpResumeIndex
1397 enumServiceGroup['pszGroupName'] = pszGroupName
1398 return dce.request(enumServiceGroup)