Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py: 88%

# Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py : 88%

## 642 statements

Hot-keys on this page

r m x p toggle line displays

j k next/prev highlighted chunk

0 (zero) top of page

1 (one) first highlighted chunk

1# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.

2#

3# This software is provided under under a slightly modified version

4# of the Apache Software License. See the accompanying LICENSE file

5# for more information.

6#

7# Author: Alberto Solino (@agsolino)

8#

9# Description:

10# [MS-SCMR] Interface implementation

11#

12# Best way to learn how to use these calls is to grab the protocol standard

13# so you understand what the call does, and then read the test case located

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC

15#

16# Some calls have helper functions, which makes it even easier to use.

17# They are located at the end of this file.

18# Helper functions start with "h"<name of the call>.

19# There are test cases for them too.

20#

21

22 from impacket import system_errors

23 from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \

24 GUID, PBOOL, WIDESTR

25 from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION

26 from impacket.dcerpc.v5.rpcrt import DCERPCException

27 from impacket.uuid import uuidtup_to_bin

28

29 MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))

30

31 class DCERPCSessionError(DCERPCException):

32 def __init__(self, error_string=None, error_code=None, packet=None):

33 DCERPCException.__init__(self, error_string, error_code, packet)

34

35 def __str__( self ):

36 key = self.error_code

37 if key in system_errors.ERROR_MESSAGES: 37 ↛ 42line 37 didn't jump to line 42, because the condition on line 37 was never false

38 error_msg_short = system_errors.ERROR_MESSAGES[key][0]

39 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]

40 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)

41 else:

42 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code

43

44################################################################################

45# CONSTANTS

46################################################################################

47

48# Access codes

49 SERVICE_ALL_ACCESS = 0X000F01FF

50 SERVICE_CHANGE_CONFIG = 0X00000002

51 SERVICE_ENUMERATE_DEPENDENTS = 0X00000008

52 SERVICE_INTERROGATE = 0X00000080

53 SERVICE_PAUSE_CONTINUE = 0X00000040

54 SERVICE_QUERY_CONFIG = 0X00000001

55 SERVICE_QUERY_STATUS = 0X00000004

56 SERVICE_START = 0X00000010

57 SERVICE_STOP = 0X00000020

58 SERVICE_USER_DEFINED_CTRL = 0X00000100

59 SERVICE_SET_STATUS = 0X00008000

60

61# Specific Access for SCM

62 SC_MANAGER_LOCK = 0x00000008

63 SC_MANAGER_CREATE_SERVICE = 0x00000002

64 SC_MANAGER_ENUMERATE_SERVICE = 0x00000004

65 SC_MANAGER_CONNECT = 0x00000001

66 SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010

67 SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020

68

69# Service Types

70 SERVICE_KERNEL_DRIVER = 0x00000001

71 SERVICE_FILE_SYSTEM_DRIVER = 0x00000002

72 SERVICE_WIN32_OWN_PROCESS = 0x00000010

73 SERVICE_WIN32_SHARE_PROCESS = 0x00000020

74 SERVICE_INTERACTIVE_PROCESS = 0x00000100

75 SERVICE_NO_CHANGE = 0xffffffff

76

77# Start Types

78 SERVICE_BOOT_START = 0x00000000

79 SERVICE_SYSTEM_START = 0x00000001

80 SERVICE_AUTO_START = 0x00000002

81 SERVICE_DEMAND_START = 0x00000003

82 SERVICE_DISABLED = 0x00000004

83 SERVICE_NO_CHANGE = 0xffffffff

84

85# Error Control

86 SERVICE_ERROR_IGNORE = 0x00000000

87 SERVICE_ERROR_NORMAL = 0x00000001

88 SERVICE_ERROR_SEVERE = 0x00000002

89 SERVICE_ERROR_CRITICAL = 0x00000003

90 SERVICE_NO_CHANGE = 0xffffffff

91

92# Service Control Codes

93 SERVICE_CONTROL_CONTINUE = 0x00000003

94 SERVICE_CONTROL_INTERROGATE = 0x00000004

95 SERVICE_CONTROL_PARAMCHANGE = 0x00000006

96 SERVICE_CONTROL_PAUSE = 0x00000002

97 SERVICE_CONTROL_STOP = 0x00000001

98 SERVICE_CONTROL_NETBINDADD = 0x00000007

99 SERVICE_CONTROL_NETBINDREMOVE = 0x00000008

100 SERVICE_CONTROL_NETBINDENABLE = 0x00000009

101 SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A

102

103# Service State

104 SERVICE_ACTIVE = 0x00000001

105 SERVICE_INACTIVE = 0x00000002

106 SERVICE_STATE_ALL = 0x00000003

107

108# Current State

109 SERVICE_CONTINUE_PENDING = 0x00000005

110 SERVICE_PAUSE_PENDING = 0x00000006

111 SERVICE_PAUSED = 0x00000007

112 SERVICE_RUNNING = 0x00000004

113 SERVICE_START_PENDING = 0x00000002

114 SERVICE_STOP_PENDING = 0x00000003

115 SERVICE_STOPPED = 0x00000001

116

117# Controls Accepted

118 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008

119 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002

120 SERVICE_ACCEPT_SHUTDOWN = 0x00000004

121 SERVICE_ACCEPT_STOP = 0x00000001

122 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020

123 SERVICE_ACCEPT_POWEREVENT = 0x00000040

124 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080

125 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100

126 SERVICE_ACCEPT_TIMECHANGE = 0x00000200

127 ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400

128

129# Security Information

130 DACL_SECURITY_INFORMATION = 0x4

131 GROUP_SECURITY_INFORMATION = 0x2

132 OWNER_SECURITY_INFORMATION = 0x1

133 SACL_SECURITY_INFORMATION = 0x8

134

135# Service Config2 Info Levels

136 SERVICE_CONFIG_DESCRIPTION = 0x00000001

137 SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002

138 SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003

139 SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004

140 SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005

141 SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006

142 SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007

143 SERVICE_CONFIG_PREFERRED_NODE = 0x00000009

144 SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A

145

146# SC_ACTIONS Types

147 SC_ACTION_NONE = 0

148 SC_ACTION_RESTART = 1

149 SC_ACTION_REBOOT = 2

150 SC_ACTION_RUN_COMMAND = 3

151

152# SERVICE_SID_INFO types

153 SERVICE_SID_TYPE_NONE = 0x00000000

154 SERVICE_SID_TYPE_RESTRICTED = 0x00000003

155 SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001

156

157# SC_STATUS_TYPE types

158 SC_STATUS_PROCESS_INFO = 0

159

160# Notify Mask

161 SERVICE_NOTIFY_CREATED = 0x00000080

162 SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010

163 SERVICE_NOTIFY_DELETE_PENDING = 0x00000200

164 SERVICE_NOTIFY_DELETED = 0x00000100

165 SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020

166 SERVICE_NOTIFY_PAUSED = 0x00000040

167 SERVICE_NOTIFY_RUNNING = 0x00000008

168 SERVICE_NOTIFY_START_PENDING = 0x00000002

169 SERVICE_NOTIFY_STOP_PENDING = 0x00000004

170 SERVICE_NOTIFY_STOPPED = 0x00000001

171

172# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons

173 SERVICE_STOP_CUSTOM = 0x20000000

174 SERVICE_STOP_PLANNED = 0x40000000

175 SERVICE_STOP_UNPLANNED = 0x10000000

176

177# SERVICE_TRIGGER triggers

178 SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001

179 SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002

180 SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003

181 SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004

182 SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005

183 SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020

184

185# SERVICE_TRIGGER actions

186 SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001

187 SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002

188

189# SERVICE_TRIGGER subTypes

190 DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809'

191 DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1'

192 FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09'

193 FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524'

194 MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0'

195 NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245'

196 NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335'

197 USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50'

198

199# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes

200 SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001

201 SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002

202

203################################################################################

204# STRUCTURES

205################################################################################

206

207 class BYTE_ARRAY(NDRUniConformantArray):

208 item = 'c'

209

210 class SC_RPC_HANDLE(NDRSTRUCT):

211 structure = (

212 ('Data','20s=""'),

213 )

214 def getAlignment(self):

215 return 1

216

217 SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE

218

219 class SERVICE_STATUS(NDRSTRUCT):

220 structure = (

221 ('dwServiceType',DWORD),

222 ('dwCurrentState',DWORD),

223 ('dwControlsAccepted',DWORD),

224 ('dwWin32ExitCode',DWORD),

225 ('dwServiceSpecificExitCode',DWORD),

226 ('dwCheckPoint',DWORD),

227 ('dwWaitHint',DWORD),

228 )

229

230 class QUERY_SERVICE_CONFIGW(NDRSTRUCT):

231 structure = (

232 ('dwServiceType',DWORD),

233 ('dwStartType',DWORD),

234 ('dwErrorControl',DWORD),

235 ('lpBinaryPathName', LPWSTR),

236 ('lpLoadOrderGroup',LPWSTR),

237 ('dwTagId',DWORD),

238 ('lpDependencies',LPWSTR),

239 ('lpServiceStartName',LPWSTR),

240 ('lpDisplayName',LPWSTR),

241 )

242

243 class SC_RPC_LOCK(NDRSTRUCT):

244 structure = (

245 ('Data','20s=""'),

246 )

247 def getAlignment(self):

248 return 1

249

250 class LPSERVICE_STATUS(NDRPOINTER):

251 referent = (

252 ('Data',SERVICE_STATUS),

253 )

254

255 SECURITY_INFORMATION = ULONG

256

257 BOUNDED_DWORD_256K = DWORD

258

259 class LPBOUNDED_DWORD_256K(NDRPOINTER):

260 referent = (

261 ('Data', BOUNDED_DWORD_256K),

262 )

263

264 SVCCTL_HANDLEW = LPWSTR

265

266 class ENUM_SERVICE_STATUSW(NDRSTRUCT):

267 structure = (

268 ('lpServiceName',LPWSTR),

269 ('lpDisplayName',LPWSTR),

270 ('ServiceStatus',SERVICE_STATUS),

271 )

272

273 class LPQUERY_SERVICE_CONFIGW(NDRPOINTER):

274 referent = (

275 ('Data', QUERY_SERVICE_CONFIGW),

276 )

277

278 BOUNDED_DWORD_8K = DWORD

279 BOUNDED_DWORD_4K = DWORD

280

281 class STRING_PTRSW(NDRSTRUCT):

282 structure = (

283 ('Data',NDRUniConformantArray),

284 )

285 def __init__(self, data = None, isNDR64 = False):

286 NDR.__init__(self,None,isNDR64)

287 self.fields['Data'].item = LPWSTR

288 if data is not None: 288 ↛ 289line 288 didn't jump to line 289, because the condition on line 288 was never true

289 self.fromString(data)

290

291 class UNIQUE_STRING_PTRSW(NDRPOINTER):

292 referent = (

293 ('Data', STRING_PTRSW),

294 )

295

296 class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT):

297 structure = (

298 ('fIsLocked',DWORD),

299 ('lpLockOwner',LPWSTR),

300 ('dwLockDuration',DWORD),

301 )

302

303 class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT):

304 structure = (

305 ('dwDescriptionOffset', DWORD),

306 )

307

308 class SERVICE_DESCRIPTIONW(NDRSTRUCT):

309 structure = (

310 ('lpDescription', LPWSTR),

311 )

312

313 class LPSERVICE_DESCRIPTIONW(NDRPOINTER):

314 referent = (

315 ('Data', SERVICE_DESCRIPTIONW),

316 )

317

318 class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT):

319 structure = (

320 ('dwResetPeriod', DWORD),

321 ('dwRebootMsgOffset', DWORD),

322 ('dwCommandOffset', DWORD),

323 ('cActions', DWORD),

324 ('dwsaActionsOffset', DWORD),

325 )

326

327 class SC_ACTION(NDRSTRUCT):

328 structure = (

329 ('Type', DWORD),

330 ('Delay', DWORD) ,

331 )

332

333 class SC_ACTIONS(NDRSTRUCT):

334 structure = (

335 ('Data', NDRUniConformantArray),

336 )

337 def __init__(self, data = None, isNDR64 = False):

338 NDR.__init__(self,None,isNDR64)

339 self.fields['Data'].item = SC_ACTION

340 if data is not None:

341 self.fromString(data)

342

343 class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT):

344 structure = (

345 ('dwResetPeriod', DWORD),

346 ('lpRebootMsg', LPWSTR) ,

347 ('lpCommand', LPWSTR) ,

348 ('cActions', DWORD) ,

349 ('lpsaActions', SC_ACTIONS) ,

350 )

351

352 class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER):

353 referent = (

354 ('Data', SERVICE_FAILURE_ACTIONSW),

355 )

356

357 class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT):

358 structure = (

359 ('fFailureActionsOnNonCrashFailures', BOOL),

360 )

361

362 class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER):

363 referent = (

364 ('Data', SERVICE_FAILURE_ACTIONS_FLAG),

365 )

366

367 class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT):

368 structure = (

369 ('fDelayedAutostart', BOOL),

370 )

371

372 class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER):

373 referent = (

374 ('Data', SERVICE_DELAYED_AUTO_START_INFO),

375 )

376

377 class SERVICE_SID_INFO(NDRSTRUCT):

378 structure = (

379 ('dwServiceSidType', DWORD),

380 )

381

382 class LPSERVICE_SID_INFO(NDRPOINTER):

383 referent = (

384 ('Data', SERVICE_SID_INFO),

385 )

386

387

388 class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT):

389 structure = (

390 ('cbRequiredPrivileges',DWORD),

391 ('pRequiredPrivileges',LPBYTE),

392 )

393 def getData(self, soFar = 0):

394 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges'])

395 return NDR.getData(self, soFar = 0)

396

397

398 class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER):

399 referent = (

400 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO),

401 )

402

403 class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT):

404 structure = (

405 ('dwRequiredPrivilegesOffset', DWORD),

406 )

407

408 class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT):

409 structure = (

410 ('dwPreshutdownTimeout', DWORD),

411 )

412

413 class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER):

414 referent = (

415 ('Data', SERVICE_PRESHUTDOWN_INFO),

416 )

417

418 class SERVICE_STATUS_PROCESS(NDRSTRUCT):

419 structure = (

420 ('dwServiceType', DWORD),

421 ('dwCurrentState', DWORD),

422 ('dwControlsAccepted', DWORD),

423 ('dwWin32ExitCode', DWORD),

424 ('dwServiceSpecificExitCode', DWORD),

425 ('dwCheckPoint', DWORD),

426 ('dwWaitHint', DWORD),

427 ('dwProcessId', DWORD),

428 ('dwServiceFlags', DWORD),

429 )

430

431 class UCHAR_16(NDRSTRUCT):

432 structure = (

433 ('Data', '16s=""'),

434 )

435 def getAlignment(self):

436 return 1

437

438 class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT):

439 structure = (

440 ('ullThreadId',ULONGLONG),

441 ('dwNotifyMask',DWORD),

442 ('CallbackAddressArray',UCHAR_16),

443 ('CallbackParamAddressArray',UCHAR_16),

444 ('ServiceStatus', SERVICE_STATUS_PROCESS),

445 ('dwNotificationStatus',DWORD),

446 ('dwSequence',DWORD),

447 )

448

449 class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT):

450 structure = (

451 ('ullThreadId',ULONGLONG),

452 ('dwNotifyMask',DWORD),

453 ('CallbackAddressArray',UCHAR_16),

454 ('CallbackParamAddressArray',UCHAR_16),

455 ('ServiceStatus',SERVICE_STATUS_PROCESS),

456 ('dwNotificationStatus',DWORD),

457 ('dwSequence',DWORD),

458 ('dwNotificationTriggered',DWORD),

459 ('pszServiceNames',LPWSTR),

460 )

461

462 class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER):

463 referent = (

464 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),

465 )

466

467 class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER):

468 referent = (

469 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),

470 )

471

472 class SC_RPC_NOTIFY_PARAMS(NDRUNION):

473 union = {

474 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),

475 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),

476 }

477

478 class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray):

479 item = SC_RPC_NOTIFY_PARAMS

480

481 class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT):

482 structure = (

483 ('cElements',BOUNDED_DWORD_4K),

484 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY),

485 )

486

487 class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT):

488 structure = (

489 ('dwReason', DWORD),

490 ('pszComment', LPWSTR),

491 )

492

493 class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT):

494 structure = (

495 ('dwDataType',DWORD ),

496 ('cbData',DWORD),

497 ('pData', LPBYTE),

498 )

499 def getData(self, soFar = 0):

500 if self['pData'] != 0:

501 self['cbData'] = len(self['pData'])

502 return NDR.getData(self, soFar)

503

504 class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray):

505 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM

506

507 class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER):

508 referent = (

509 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY),

510 )

511

512 class SERVICE_TRIGGER(NDRSTRUCT):

513 structure = (

514 ('dwTriggerType', DWORD),

515 ('dwAction', DWORD),

516 ('pTriggerSubtype', PGUID),

517 ('cDataItems', DWORD),

518 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM),

519 )

520 def getData(self, soFar = 0):

521 if self['pDataItems'] != 0:

522 self['cDataItems'] = len(self['pDataItems'])

523 return NDR.getData(self, soFar)

524

525 class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray):

526 item = SERVICE_TRIGGER

527

528 class PSERVICE_TRIGGER(NDRPOINTER):

529 referent = (

530 ('Data', SERVICE_TRIGGER_ARRAY),

531 )

532

533 class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT):

534 structure = (

535 ('ServiceStatus', SERVICE_STATUS_PROCESS),

536 )

537

538 class SERVICE_TRIGGER_INFO(NDRSTRUCT):

539 structure = (

540 ('cTriggers', DWORD),

541 ('pTriggers', PSERVICE_TRIGGER),

542 ('pReserved', NDRPOINTERNULL ),

543 )

544 def getData(self, soFar = 0):

545 if self['pTriggers'] != 0:

546 self['cTriggers'] = len(self['pTriggers'])

547 return NDR.getData(self, soFar)

548

549 class PSERVICE_TRIGGER_INFO(NDRPOINTER):

550 referent = (

551 ('Data', SERVICE_TRIGGER_INFO),

552 )

553

554 class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT):

555 structure = (

556 ('usPreferredNode', USHORT),

557 ('fDelete', BOOL),

558 )

559

560 class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER):

561 referent = (

562 ('Data', SERVICE_PREFERRED_NODE_INFO),

563 )

564

565 class SERVICE_RUNLEVEL_INFO(NDRSTRUCT):

566 structure = (

567 ('eLowestRunLevel', DWORD),

568 )

569

570 class PSERVICE_RUNLEVEL_INFO(NDRPOINTER):

571 referent = (

572 ('Data', SERVICE_RUNLEVEL_INFO),

573 )

574

575 class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT):

576 structure = (

577 ('fIsManagedAccount', DWORD),

578 )

579

580 class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER):

581 referent = (

582 ('Data', SERVICE_MANAGEDACCOUNT_INFO),

583 )

584

585 class SC_RPC_CONFIG_INFOW_UNION(NDRUNION):

586 commonHdr = (

587 ('tag', ULONG),

588 )

589

590 union = {

591 1: ('psd', LPSERVICE_DESCRIPTIONW),

592 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ),

593 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO),

594 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG),

595 5: ('pssid',LPSERVICE_SID_INFO),

596 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO),

597 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO),

598 8: ('psti',PSERVICE_TRIGGER_INFO),

599 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO),

600 10: ('psri',PSERVICE_RUNLEVEL_INFO),

601 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO),

602 }

603

604 class SC_RPC_CONFIG_INFOW(NDRSTRUCT):

605 structure = (

606 ('dwInfoLevel', DWORD),

607 ('Union', SC_RPC_CONFIG_INFOW_UNION),

608 )

609

610################################################################################

611# RPC CALLS

612################################################################################

613

614 class RCloseServiceHandle(NDRCALL):

615 opnum = 0

616 structure = (

617 ('hSCObject',SC_RPC_HANDLE),

618 )

619

620 class RCloseServiceHandleResponse(NDRCALL):

621 structure = (

622 ('hSCObject',SC_RPC_HANDLE),

623 ('ErrorCode', DWORD),

624 )

625

626 class RControlService(NDRCALL):

627 opnum = 1

628 structure = (

629 ('hService',SC_RPC_HANDLE),

630 ('dwControl',DWORD),

631 )

632

633 class RControlServiceResponse(NDRCALL):

634 structure = (

635 ('lpServiceStatus',SERVICE_STATUS),

636 ('ErrorCode', DWORD),

637 )

638

639 class RDeleteService(NDRCALL):

640 opnum = 2

641 structure = (

642 ('hService',SC_RPC_HANDLE),

643 )

644

645 class RDeleteServiceResponse(NDRCALL):

646 structure = (

647 ('ErrorCode', DWORD),

648 )

649

650 class RLockServiceDatabase(NDRCALL):

651 opnum = 3

652 structure = (

653 ('hSCManager',SC_RPC_HANDLE),

654 )

655

656 class RLockServiceDatabaseResponse(NDRCALL):

657 structure = (

658 ('lpLock',SC_RPC_LOCK),

659 ('ErrorCode', DWORD),

660 )

661

662 class RQueryServiceObjectSecurity(NDRCALL):

663 opnum = 4

664 structure = (

665 ('hService',SC_RPC_HANDLE),

666 ('dwSecurityInformation',SECURITY_INFORMATION),

667 ('cbBufSize',DWORD),

668 )

669

670 class RQueryServiceObjectSecurityResponse(NDRCALL):

671 structure = (

672 ('lpSecurityDescriptor', BYTE_ARRAY),

673 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

674 ('ErrorCode', DWORD),

675 )

676

677 class RSetServiceObjectSecurity(NDRCALL):

678 opnum = 5

679 structure = (

680 ('hService',SC_RPC_HANDLE),

681 ('dwSecurityInformation',SECURITY_INFORMATION),

682 ('lpSecurityDescriptor',LPBYTE),

683 ('cbBufSize',DWORD),

684 )

685

686 class RSetServiceObjectSecurityResponse(NDRCALL):

687 structure = (

688 ('ErrorCode', DWORD),

689 )

690

691 class RQueryServiceStatus(NDRCALL):

692 opnum = 6

693 structure = (

694 ('hService',SC_RPC_HANDLE),

695 )

696

697 class RQueryServiceStatusResponse(NDRCALL):

698 structure = (

699 ('lpServiceStatus',SERVICE_STATUS),

700 ('ErrorCode', DWORD),

701 )

702

703 class RSetServiceStatus(NDRCALL):

704 opnum = 7

705 structure = (

706 ('hServiceStatus',SC_RPC_HANDLE),

707 ('lpServiceStatus',SERVICE_STATUS),

708 )

709

710 class RSetServiceStatusResponse(NDRCALL):

711 structure = (

712 ('ErrorCode', DWORD),

713 )

714

715 class RUnlockServiceDatabase(NDRCALL):

716 opnum = 8

717 structure = (

718 ('Lock',SC_RPC_LOCK),

719 )

720

721 class RUnlockServiceDatabaseResponse(NDRCALL):

722 structure = (

723 ('Lock',SC_RPC_LOCK),

724 ('ErrorCode', DWORD),

725 )

726

727 class RNotifyBootConfigStatus(NDRCALL):

728 opnum = 9

729 structure = (

730 ('lpMachineName',SVCCTL_HANDLEW),

731 ('BootAcceptable',DWORD),

732 )

733

734 class RNotifyBootConfigStatusResponse(NDRCALL):

735 structure = (

736 ('ErrorCode', DWORD),

737 )

738

739 class RChangeServiceConfigW(NDRCALL):

740 opnum = 11

741 structure = (

742 ('hService',SC_RPC_HANDLE),

743 ('dwServiceType',DWORD),

744 ('dwStartType',DWORD),

745 ('dwErrorControl',DWORD),

746 ('lpBinaryPathName',LPWSTR),

747 ('lpLoadOrderGroup',LPWSTR),

748 ('lpdwTagId',LPDWORD),

749 ('lpDependencies',LPBYTE),

750 ('dwDependSize',DWORD),

751 ('lpServiceStartName',LPWSTR),

752 ('lpPassword',LPBYTE),

753 ('dwPwSize',DWORD),

754 ('lpDisplayName',LPWSTR),

755 )

756

757 class RChangeServiceConfigWResponse(NDRCALL):

758 structure = (

759 ('lpdwTagId',LPDWORD),

760 ('ErrorCode', DWORD),

761 )

762

763 class RCreateServiceW(NDRCALL):

764 opnum = 12

765 structure = (

766 ('hSCManager',SC_RPC_HANDLE),

767 ('lpServiceName',WSTR),

768 ('lpDisplayName',LPWSTR),

769 ('dwDesiredAccess',DWORD),

770 ('dwServiceType',DWORD),

771 ('dwStartType',DWORD),

772 ('dwErrorControl',DWORD),

773 ('lpBinaryPathName',WSTR),

774 ('lpLoadOrderGroup',LPWSTR),

775 ('lpdwTagId',LPDWORD),

776 ('lpDependencies',LPBYTE),

777 ('dwDependSize',DWORD),

778 ('lpServiceStartName',LPWSTR),

779 ('lpPassword',LPBYTE),

780 ('dwPwSize',DWORD),

781 )

782

783 class RCreateServiceWResponse(NDRCALL):

784 structure = (

785 ('lpdwTagId',LPWSTR),

786 ('lpServiceHandle',SC_RPC_HANDLE),

787 ('ErrorCode', DWORD),

788 )

789

790 class REnumDependentServicesW(NDRCALL):

791 opnum = 13

792 structure = (

793 ('hService',SC_RPC_HANDLE),

794 ('dwServiceState',DWORD),

795 ('cbBufSize',DWORD),

796 )

797

798 class REnumDependentServicesWResponse(NDRCALL):

799 structure = (

800 ('lpServices',NDRUniConformantArray),

801 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

802 ('lpServicesReturned',BOUNDED_DWORD_256K),

803 ('ErrorCode', DWORD),

804 )

805

806 class REnumServicesStatusW(NDRCALL):

807 opnum = 14

808 structure = (

809 ('hSCManager',SC_RPC_HANDLE),

810 ('dwServiceType',DWORD),

811 ('dwServiceState',DWORD),

812 ('cbBufSize',DWORD),

813 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

814 )

815

816 class REnumServicesStatusWResponse(NDRCALL):

817 structure = (

818 ('lpBuffer',NDRUniConformantArray),

819 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

820 ('lpServicesReturned',BOUNDED_DWORD_256K),

821 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

822 ('ErrorCode', DWORD),

823 )

824

825 class ROpenSCManagerW(NDRCALL):

826 opnum = 15

827 structure = (

828 ('lpMachineName',SVCCTL_HANDLEW),

829 ('lpDatabaseName',LPWSTR),

830 ('dwDesiredAccess',DWORD),

831 )

832

833 class ROpenSCManagerWResponse(NDRCALL):

834 structure = (

835 ('lpScHandle',SC_RPC_HANDLE),

836 ('ErrorCode', DWORD),

837 )

838

839 class ROpenServiceW(NDRCALL):

840 opnum = 16

841 structure = (

842 ('hSCManager',SC_RPC_HANDLE),

843 ('lpServiceName',WSTR),

844 ('dwDesiredAccess',DWORD),

845 )

846

847 class ROpenServiceWResponse(NDRCALL):

848 structure = (

849 ('lpServiceHandle',SC_RPC_HANDLE),

850 ('ErrorCode', DWORD),

851 )

852

853 class RQueryServiceConfigW(NDRCALL):

854 opnum = 17

855 structure = (

856 ('hService',SC_RPC_HANDLE),

857 ('cbBufSize',DWORD),

858 )

859

860 class RQueryServiceConfigWResponse(NDRCALL):

861 structure = (

862 ('lpServiceConfig',QUERY_SERVICE_CONFIGW),

863 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

864 ('ErrorCode', DWORD),

865 )

866

867 class RQueryServiceLockStatusW(NDRCALL):

868 opnum = 18

869 structure = (

870 ('hSCManager',SC_RPC_HANDLE),

871 ('cbBufSize',DWORD),

872 )

873

874 class RQueryServiceLockStatusWResponse(NDRCALL):

875 structure = (

876 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW),

877 ('pcbBytesNeeded',BOUNDED_DWORD_4K),

878 ('ErrorCode', DWORD),

879 )

880

881 class RStartServiceW(NDRCALL):

882 opnum = 19

883 structure = (

884 ('hService',SC_RPC_HANDLE),

885 ('argc',DWORD),

886 ('argv',UNIQUE_STRING_PTRSW),

887 )

888

889 class RStartServiceWResponse(NDRCALL):

890 structure = (

891 ('ErrorCode', DWORD),

892 )

893

894 class RGetServiceDisplayNameW(NDRCALL):

895 opnum = 20

896 structure = (

897 ('hSCManager',SC_RPC_HANDLE),

898 ('lpServiceName',WSTR),

899 ('lpcchBuffer',DWORD),

900 )

901

902 class RGetServiceDisplayNameWResponse(NDRCALL):

903 structure = (

904 ('lpDisplayName',WSTR),

905 ('lpcchBuffer',DWORD),

906 ('ErrorCode', DWORD),

907 )

908

909 class RGetServiceKeyNameW(NDRCALL):

910 opnum = 21

911 structure = (

912 ('hSCManager',SC_RPC_HANDLE),

913 ('lpDisplayName',WSTR),

914 ('lpcchBuffer',DWORD),

915 )

916

917 class RGetServiceKeyNameWResponse(NDRCALL):

918 structure = (

919 ('lpDisplayName',WSTR),

920 ('lpcchBuffer',DWORD),

921 ('ErrorCode', DWORD),

922 )

923

924 class REnumServiceGroupW(NDRCALL):

925 opnum = 35

926 structure = (

927 ('hSCManager',SC_RPC_HANDLE),

928 ('dwServiceType',DWORD),

929 ('dwServiceState',DWORD),

930 ('cbBufSize',DWORD),

931 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

932 ('pszGroupName',LPWSTR),

933 )

934

935 class REnumServiceGroupWResponse(NDRCALL):

936 structure = (

937 ('lpBuffer',LPBYTE),

938 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

939 ('lpServicesReturned',BOUNDED_DWORD_256K),

940 ('lpResumeIndex',BOUNDED_DWORD_256K),

941 ('ErrorCode', DWORD),

942 )

943

944 class RChangeServiceConfig2W(NDRCALL):

945 opnum = 37

946 structure = (

947 ('hService',SC_RPC_HANDLE),

948 ('Info',SC_RPC_CONFIG_INFOW),

949 )

950

951 class RChangeServiceConfig2WResponse(NDRCALL):

952 structure = (

953 ('ErrorCode', DWORD),

954 )

955

956 class RQueryServiceConfig2W(NDRCALL):

957 opnum = 39

958 structure = (

959 ('hService',SC_RPC_HANDLE),

960 ('dwInfoLevel',DWORD),

961 ('cbBufSize',DWORD),

962 )

963

964 class RQueryServiceConfig2WResponse(NDRCALL):

965 structure = (

966 ('lpBuffer',NDRUniConformantArray),

967 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

968 ('ErrorCode', DWORD),

969 )

970

971 class RQueryServiceStatusEx(NDRCALL):

972 opnum = 40

973 structure = (

974 ('hService',SC_RPC_HANDLE),

975 ('InfoLevel',DWORD),

976 ('cbBufSize',DWORD),

977 )

978

979 class RQueryServiceStatusExResponse(NDRCALL):

980 structure = (

981 ('lpBuffer',NDRUniConformantArray),

982 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

983 ('ErrorCode', DWORD),

984 )

985

986 class REnumServicesStatusExW(NDRCALL):

987 opnum = 42

988 structure = (

989 ('hSCManager',SC_RPC_HANDLE),

990 ('InfoLevel',DWORD),

991 ('dwServiceType',DWORD),

992 ('dwServiceState',DWORD),

993 ('cbBufSize',DWORD),

994 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

995 ('pszGroupName',LPWSTR),

996 )

997

998 class REnumServicesStatusExWResponse(NDRCALL):

999 structure = (

1000 ('lpBuffer',NDRUniConformantArray),

1001 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

1002 ('lpServicesReturned',BOUNDED_DWORD_256K),

1003 ('lpResumeIndex',BOUNDED_DWORD_256K),

1004 ('ErrorCode', DWORD),

1005 )

1006

1007 class RCreateServiceWOW64W(NDRCALL):

1008 opnum = 45

1009 structure = (

1010 ('hSCManager',SC_RPC_HANDLE),

1011 ('lpServiceName',WSTR),

1012 ('lpDisplayName',LPWSTR),

1013 ('dwDesiredAccess',DWORD),

1014 ('dwServiceType',DWORD),

1015 ('dwStartType',DWORD),

1016 ('dwErrorControl',DWORD),

1017 ('lpBinaryPathName',WSTR),

1018 ('lpLoadOrderGroup',LPWSTR),

1019 ('lpdwTagId',LPDWORD),

1020 ('lpDependencies',LPBYTE),

1021 ('dwDependSize',DWORD),

1022 ('lpServiceStartName',LPWSTR),

1023 ('lpPassword',LPBYTE),

1024 ('dwPwSize',DWORD),

1025 )

1026

1027 class RCreateServiceWOW64WResponse(NDRCALL):

1028 structure = (

1029 ('lpdwTagId',LPWSTR),

1030 ('lpServiceHandle',SC_RPC_HANDLE),

1031 ('ErrorCode', DWORD),

1032 )

1033

1034# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here

1035 class RNotifyServiceStatusChange(NDRCALL):

1036 opnum = 47

1037 structure = (

1038 ('hService',SC_RPC_HANDLE),

1039 ('NotifyParams',SC_RPC_NOTIFY_PARAMS),

1040 ('pClientProcessGuid',GUID),

1041 )

1042

1043 class RNotifyServiceStatusChangeResponse(NDRCALL):

1044 structure = (

1045 ('pSCMProcessGuid',GUID),

1046 ('pfCreateRemoteQueue',PBOOL),

1047 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1048 ('ErrorCode', DWORD),

1049 )

1050

1051# Not working, until I don't fix the previous one

1052 class RGetNotifyResults(NDRCALL):

1053 opnum = 48

1054 structure = (

1055 ('hNotify',SC_NOTIFY_RPC_HANDLE),

1056 )

1057

1058 class RGetNotifyResultsResponse(NDRCALL):

1059 structure = (

1060 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST),

1061 ('ErrorCode', DWORD),

1062 )

1063

1064# Not working, until I don't fix the previous ones

1065 class RCloseNotifyHandle(NDRCALL):

1066 opnum = 49

1067 structure = (

1068 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1069 )

1070

1071 class RCloseNotifyHandleResponse(NDRCALL):

1072 structure = (

1073 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1074 ('pfApcFired',PBOOL),

1075 ('ErrorCode', DWORD),

1076 )

1077

1078# Not working, returning bad_stub_data

1079 class RControlServiceExW(NDRCALL):

1080 opnum = 51

1081 structure = (

1082 ('hService',SC_RPC_HANDLE),

1083 ('dwControl',DWORD),

1084 ('dwInfoLevel',DWORD),

1085 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW),

1086 )

1087

1088 class RControlServiceExWResponse(NDRCALL):

1089 structure = (

1090 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS),

1091 ('ErrorCode', DWORD),

1092 )

1093

1094 class RQueryServiceConfigEx(NDRCALL):

1095 opnum = 56

1096 structure = (

1097 ('hService',SC_RPC_HANDLE),

1098 ('dwInfoLevel',DWORD),

1099 )

1100

1101 class RQueryServiceConfigExResponse(NDRCALL):

1102 structure = (

1103 ('pInfo',SC_RPC_CONFIG_INFOW),

1104 ('ErrorCode', DWORD),

1105 )

1106

1107################################################################################

1108# OPNUMs and their corresponding structures

1109################################################################################

1110 OPNUMS = {

1111 0 : (RCloseServiceHandle, RCloseServiceHandleResponse),

1112 1 : (RControlService, RControlServiceResponse),

1113 2 : (RDeleteService, RDeleteServiceResponse),

1114 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse),

1115 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse),

1116 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse),

1117 6 : (RQueryServiceStatus, RQueryServiceStatusResponse),

1118 7 : (RSetServiceStatus, RSetServiceStatusResponse),

1119 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse),

1120 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse),

1121 11 : (RChangeServiceConfigW, RChangeServiceConfigWResponse),

1122 12 : (RCreateServiceW, RCreateServiceWResponse),

1123 13 : (REnumDependentServicesW, REnumDependentServicesWResponse),

1124 14 : (REnumServicesStatusW, REnumServicesStatusWResponse),

1125 15 : (ROpenSCManagerW, ROpenSCManagerWResponse),

1126 16 : (ROpenServiceW, ROpenServiceWResponse),

1127 17 : (RQueryServiceConfigW, RQueryServiceConfigWResponse),

1128 18 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse),

1129 19 : (RStartServiceW, RStartServiceWResponse),

1130 20 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse),

1131 21 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse),

1132 35 : (REnumServiceGroupW, REnumServiceGroupWResponse),

1133 37 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse),

1134 39 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse),

1135 40 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse),

1136 42 : (REnumServicesStatusExW, REnumServicesStatusExWResponse),

1137 45 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse),

1138 47 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse),

1139 48 : (RGetNotifyResults, RGetNotifyResultsResponse),

1140 49 : (RCloseNotifyHandle, RCloseNotifyHandleResponse),

1141 51 : (RControlServiceExW, RControlServiceExWResponse),

1142 56 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse),

1143}

1144

1145################################################################################

1146# HELPER FUNCTIONS

1147################################################################################

1148 def checkNullString(string):

1149 if string == NULL:

1150 return string

1151

1152 if string[-1:] != '\x00':

1153 return string + '\x00'

1154 else:

1155 return string

1156

1157 def hRCloseServiceHandle(dce, hSCObject):

1158 request = RCloseServiceHandle()

1159 request['hSCObject'] = hSCObject

1160 return dce.request(request)

1161

1162 def hRControlService(dce, hService, dwControl):

1163 request = RControlService()

1164 request['hService'] = hService

1165 request['dwControl'] = dwControl

1166 return dce.request(request)

1167

1168 def hRDeleteService(dce, hService):

1169 request = RDeleteService()

1170 request ['hService'] = hService

1171 return dce.request(request)

1172

1173 def hRLockServiceDatabase(dce, hSCManager):

1174 request = RLockServiceDatabase()

1175 request['hSCManager'] = hSCManager

1176 return dce.request(request)

1177

1178

1179 def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0):

1180 request = RQueryServiceObjectSecurity()

1181 request['hService'] = hService

1182 request['dwSecurityInformation'] = dwSecurityInformation

1183 request['cbBufSize'] = cbBufSize

1184 try:

1185 resp = dce.request(request)

1186 except DCERPCSessionError as e:

1187 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:

1188 resp = e.get_packet()

1189 request['cbBufSize'] = resp['pcbBytesNeeded']

1190 resp = dce.request(request)

1191 else:

1192 raise

1193 return resp

1194

1195 def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ):

1196 request = RSetServiceObjectSecurity()

1197 request['hService'] = hService

1198 request['dwSecurityInformation'] = dwSecurityInformation

1199 request['cbBufSize'] = cbBufSize

1200 return dce.request(request)

1201

1202 def hRQueryServiceStatus(dce, hService ):

1203 request = RQueryServiceStatus()

1204 request['hService'] = hService

1205 return dce.request(request)

1206

1207 def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ):

1208 request = RSetServiceStatus()

1209 request['hServiceStatus'] = hServiceStatus

1210 request['lpServiceStatus'] = lpServiceStatus

1211 return dce.request(request)

1212

1213 def hRUnlockServiceDatabase(dce, Lock ):

1214 request = RUnlockServiceDatabase()

1215 request['Lock'] = Lock

1216 return dce.request(request)

1217

1218 def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ):

1219 request = RNotifyBootConfigStatus()

1220 request['lpMachineName'] = lpMachineName

1221 request['BootAcceptable'] = BootAcceptable

1222 return dce.request(request)

1223

1224 def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL):

1225 changeServiceConfig = RChangeServiceConfigW()

1226 changeServiceConfig['hService'] = hService

1227 changeServiceConfig['dwServiceType'] = dwServiceType

1228 changeServiceConfig['dwStartType'] = dwStartType

1229 changeServiceConfig['dwErrorControl'] = dwErrorControl

1230 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName)

1231 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)

1232 changeServiceConfig['lpdwTagId'] = lpdwTagId

1233 changeServiceConfig['lpDependencies'] = lpDependencies

1234 # Strings MUST be NULL terminated for lpDependencies

1235 changeServiceConfig['dwDependSize'] = dwDependSize

1236 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName)

1237 changeServiceConfig['lpPassword'] = lpPassword

1238 changeServiceConfig['dwPwSize'] = dwPwSize

1239 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName)

1240 return dce.request(changeServiceConfig)

1241

1242 def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0):

1243 createService = RCreateServiceW()

1244 createService['hSCManager'] = hSCManager

1245 createService['lpServiceName'] = checkNullString(lpServiceName)

1246 createService['lpDisplayName'] = checkNullString(lpDisplayName)

1247 createService['dwDesiredAccess'] = dwDesiredAccess

1248 createService['dwServiceType'] = dwServiceType

1249 createService['dwStartType'] = dwStartType

1250 createService['dwErrorControl'] = dwErrorControl

1251 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName)

1252 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)

1253 createService['lpdwTagId'] = lpdwTagId

1254 # Strings MUST be NULL terminated for lpDependencies

1255 createService['lpDependencies'] = lpDependencies

1256 createService['dwDependSize'] = dwDependSize

1257 createService['lpServiceStartName'] = checkNullString(lpServiceStartName)

1258 createService['lpPassword'] = lpPassword

1259 createService['dwPwSize'] = dwPwSize

1260 return dce.request(createService)

1261

1262 def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ):

1263 enumDependentServices = REnumDependentServicesW()

1264 enumDependentServices['hService'] = hService

1265 enumDependentServices['dwServiceState'] = dwServiceState

1266 enumDependentServices['cbBufSize'] = cbBufSize

1267 return dce.request(enumDependentServices)

1268

1269 def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL):

1270 class ENUM_SERVICE_STATUSW2(NDRSTRUCT):

1271 # This is a little trick, since the original structure is slightly different

1272 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid

1273 # of the NDR library, although the pointers are swapped from the original specification.

1274 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory

1275 # where the pointers are actually POINTING to the data.

1276 # Sadly, the pointers are not aligned based on the services records, so we gotta do this

1277 # It should be easier in C of course.

1278 class STR(NDRPOINTER):

1279 referent = (

1280 ('Data', WIDESTR),

1281 )

1282 structure = (

1283 ('lpServiceName',STR),

1284 ('lpDisplayName',STR),

1285 ('ServiceStatus',SERVICE_STATUS),

1286 )

1287

1288 enumServicesStatus = REnumServicesStatusW()

1289 enumServicesStatus['hSCManager'] = hSCManager

1290 enumServicesStatus['dwServiceType'] = dwServiceType

1291 enumServicesStatus['dwServiceState'] = dwServiceState

1292 enumServicesStatus['cbBufSize'] = 0

1293 enumServicesStatus['lpResumeIndex'] = NULL

1294

1295 try:

1296 resp = dce.request(enumServicesStatus)

1297 except DCERPCSessionError as e:

1298 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1298 ↛ 1303line 1298 didn't jump to line 1303, because the condition on line 1298 was never false

1299 resp = e.get_packet()

1300 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded']

1301 resp = dce.request(enumServicesStatus)

1302 else:

1303 raise

1304

1305 # Now we're supposed to have all services returned. Now we gotta parse them

1306

1307 enumArray = NDRUniConformantArray()

1308 enumArray.item = ENUM_SERVICE_STATUSW2

1309

1310 enumArray.setArraySize(resp['lpServicesReturned'])

1311

1312 data = b''.join(resp['lpBuffer'])

1313 enumArray.fromString(data)

1314 data = data[4:]

1315 # Since the pointers here are pointing to the actual data, we have to reparse

1316 # the referents

1317 for record in enumArray['Data']:

1318 offset = record.fields['lpDisplayName'].fields['ReferentID']-4

1319 name = WIDESTR(data[offset:])

1320 record['lpDisplayName'] = name['Data']

1321 offset = record.fields['lpServiceName'].fields['ReferentID']-4

1322 name = WIDESTR(data[offset:])

1323 record['lpServiceName'] = name['Data']

1324

1325 return enumArray['Data']

1326

1327 def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE):

1328 openSCManager = ROpenSCManagerW()

1329 openSCManager['lpMachineName'] = checkNullString(lpMachineName)

1330 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName)

1331 openSCManager['dwDesiredAccess'] = dwDesiredAccess

1332 return dce.request(openSCManager)

1333

1334 def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS):

1335 openService = ROpenServiceW()

1336 openService['hSCManager'] = hSCManager

1337 openService['lpServiceName'] = checkNullString(lpServiceName)

1338 openService['dwDesiredAccess'] = dwDesiredAccess

1339 return dce.request(openService)

1340

1341 def hRQueryServiceConfigW(dce, hService):

1342 queryService = RQueryServiceConfigW()

1343 queryService['hService'] = hService

1344 queryService['cbBufSize'] = 0

1345 try:

1346 resp = dce.request(queryService)

1347 except DCERPCSessionError as e:

1348 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER: 1348 ↛ 1353line 1348 didn't jump to line 1353, because the condition on line 1348 was never false

1349 resp = e.get_packet()

1350 queryService['cbBufSize'] = resp['pcbBytesNeeded']

1351 resp = dce.request(queryService)

1352 else:

1353 raise

1354

1355 return resp

1356

1357 def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ):

1358 queryServiceLock = RQueryServiceLockStatusW()

1359 queryServiceLock['hSCManager'] = hSCManager

1360 queryServiceLock['cbBufSize'] = cbBufSize

1361 return dce.request(queryServiceLock)

1362

1363 def hRStartServiceW(dce, hService, argc=0, argv=NULL ):

1364 startService = RStartServiceW()

1365 startService['hService'] = hService

1366 startService['argc'] = argc

1367 if argc == 0:

1368 startService['argv'] = NULL

1369 else:

1370 for item in argv:

1371 itemn = LPWSTR()

1372 itemn['Data'] = checkNullString(item)

1373 startService['argv'].append(itemn)

1374 return dce.request(startService)

1375

1376 def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ):

1377 getServiceDisplay = RGetServiceDisplayNameW()

1378 getServiceDisplay['hSCManager'] = hSCManager

1379 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName)

1380 getServiceDisplay['lpcchBuffer'] = lpcchBuffer

1381 return dce.request(getServiceDisplay)

1382

1383 def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ):

1384 getServiceKeyName = RGetServiceKeyNameW()

1385 getServiceKeyName['hSCManager'] = hSCManager

1386 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName)

1387 getServiceKeyName['lpcchBuffer'] = lpcchBuffer

1388 return dce.request(getServiceKeyName)

1389

1390 def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ):

1391 enumServiceGroup = REnumServiceGroupW()

1392 enumServiceGroup['hSCManager'] = hSCManager

1393 enumServiceGroup['dwServiceType'] = dwServiceType

1394 enumServiceGroup['dwServiceState'] = dwServiceState

1395 enumServiceGroup['cbBufSize'] = cbBufSize

1396 enumServiceGroup['lpResumeIndex'] = lpResumeIndex

1397 enumServiceGroup['pszGroupName'] = pszGroupName

1398 return dce.request(enumServiceGroup)