Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py: 86%

# Coverage for /root/GitHubProjects/impacket/impacket/dcerpc/v5/scmr.py : 86%

## 642 statements

Hot-keys on this page

r m x p toggle line displays

j k next/prev highlighted chunk

0 (zero) top of page

1 (one) first highlighted chunk

1# Impacket - Collection of Python classes for working with network protocols.

2#

3# SECUREAUTH LABS. Copyright (C) 2019 SecureAuth Corporation. All rights reserved.

4#

5# This software is provided under a slightly modified version

6# of the Apache Software License. See the accompanying LICENSE file

7# for more information.

8#

9# Description:

10# [MS-SCMR] Interface implementation

11#

12# Best way to learn how to use these calls is to grab the protocol standard

13# so you understand what the call does, and then read the test case located

14# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC

15#

16# Some calls have helper functions, which makes it even easier to use.

17# They are located at the end of this file.

18# Helper functions start with "h"<name of the call>.

19# There are test cases for them too.

20#

21# Author:

22# Alberto Solino (@agsolino)

23#

24

25 from impacket import system_errors

26 from impacket.dcerpc.v5.dtypes import NULL, DWORD, LPWSTR, ULONG, BOOL, LPBYTE, ULONGLONG, PGUID, USHORT, LPDWORD, WSTR, \

27 GUID, PBOOL, WIDESTR

28 from impacket.dcerpc.v5.ndr import NDRCALL, NDR, NDRSTRUCT, NDRPOINTER, NDRPOINTERNULL, NDRUniConformantArray, NDRUNION

29 from impacket.dcerpc.v5.rpcrt import DCERPCException

30 from impacket.uuid import uuidtup_to_bin

31

32 MSRPC_UUID_SCMR = uuidtup_to_bin(('367ABB81-9844-35F1-AD32-98F038001003', '2.0'))

33

34 class DCERPCSessionError(DCERPCException):

35 def __init__(self, error_string=None, error_code=None, packet=None):

36 DCERPCException.__init__(self, error_string, error_code, packet)

37

38 def __str__( self ):

39 key = self.error_code

40 if key in system_errors.ERROR_MESSAGES: 40 ↛ 45line 40 didn't jump to line 45, because the condition on line 40 was never false

41 error_msg_short = system_errors.ERROR_MESSAGES[key][0]

42 error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]

43 return 'SCMR SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)

44 else:

45 return 'SCMR SessionError: unknown error code: 0x%x' % self.error_code

46

47################################################################################

48# CONSTANTS

49################################################################################

50

51# Access codes

52 SERVICE_ALL_ACCESS = 0X000F01FF

53 SERVICE_CHANGE_CONFIG = 0X00000002

54 SERVICE_ENUMERATE_DEPENDENTS = 0X00000008

55 SERVICE_INTERROGATE = 0X00000080

56 SERVICE_PAUSE_CONTINUE = 0X00000040

57 SERVICE_QUERY_CONFIG = 0X00000001

58 SERVICE_QUERY_STATUS = 0X00000004

59 SERVICE_START = 0X00000010

60 SERVICE_STOP = 0X00000020

61 SERVICE_USER_DEFINED_CTRL = 0X00000100

62 SERVICE_SET_STATUS = 0X00008000

63

64# Specific Access for SCM

65 SC_MANAGER_LOCK = 0x00000008

66 SC_MANAGER_CREATE_SERVICE = 0x00000002

67 SC_MANAGER_ENUMERATE_SERVICE = 0x00000004

68 SC_MANAGER_CONNECT = 0x00000001

69 SC_MANAGER_QUERY_LOCK_STATUS = 0x00000010

70 SC_MANAGER_MODIFY_BOOT_CONFIG = 0x00000020

71

72# Service Types

73 SERVICE_KERNEL_DRIVER = 0x00000001

74 SERVICE_FILE_SYSTEM_DRIVER = 0x00000002

75 SERVICE_WIN32_OWN_PROCESS = 0x00000010

76 SERVICE_WIN32_SHARE_PROCESS = 0x00000020

77 SERVICE_INTERACTIVE_PROCESS = 0x00000100

78 SERVICE_NO_CHANGE = 0xffffffff

79

80# Start Types

81 SERVICE_BOOT_START = 0x00000000

82 SERVICE_SYSTEM_START = 0x00000001

83 SERVICE_AUTO_START = 0x00000002

84 SERVICE_DEMAND_START = 0x00000003

85 SERVICE_DISABLED = 0x00000004

86 SERVICE_NO_CHANGE = 0xffffffff

87

88# Error Control

89 SERVICE_ERROR_IGNORE = 0x00000000

90 SERVICE_ERROR_NORMAL = 0x00000001

91 SERVICE_ERROR_SEVERE = 0x00000002

92 SERVICE_ERROR_CRITICAL = 0x00000003

93 SERVICE_NO_CHANGE = 0xffffffff

94

95# Service Control Codes

96 SERVICE_CONTROL_CONTINUE = 0x00000003

97 SERVICE_CONTROL_INTERROGATE = 0x00000004

98 SERVICE_CONTROL_PARAMCHANGE = 0x00000006

99 SERVICE_CONTROL_PAUSE = 0x00000002

100 SERVICE_CONTROL_STOP = 0x00000001

101 SERVICE_CONTROL_NETBINDADD = 0x00000007

102 SERVICE_CONTROL_NETBINDREMOVE = 0x00000008

103 SERVICE_CONTROL_NETBINDENABLE = 0x00000009

104 SERVICE_CONTROL_NETBINDDISABLE= 0x0000000A

105

106# Service State

107 SERVICE_ACTIVE = 0x00000001

108 SERVICE_INACTIVE = 0x00000002

109 SERVICE_STATE_ALL = 0x00000003

110

111# Current State

112 SERVICE_CONTINUE_PENDING = 0x00000005

113 SERVICE_PAUSE_PENDING = 0x00000006

114 SERVICE_PAUSED = 0x00000007

115 SERVICE_RUNNING = 0x00000004

116 SERVICE_START_PENDING = 0x00000002

117 SERVICE_STOP_PENDING = 0x00000003

118 SERVICE_STOPPED = 0x00000001

119

120# Controls Accepted

121 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008

122 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002

123 SERVICE_ACCEPT_SHUTDOWN = 0x00000004

124 SERVICE_ACCEPT_STOP = 0x00000001

125 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020

126 SERVICE_ACCEPT_POWEREVENT = 0x00000040

127 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080

128 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100

129 SERVICE_ACCEPT_TIMECHANGE = 0x00000200

130 ERVICE_ACCEPT_TRIGGEREVENT = 0x00000400

131

132# Security Information

133 DACL_SECURITY_INFORMATION = 0x4

134 GROUP_SECURITY_INFORMATION = 0x2

135 OWNER_SECURITY_INFORMATION = 0x1

136 SACL_SECURITY_INFORMATION = 0x8

137

138# Service Config2 Info Levels

139 SERVICE_CONFIG_DESCRIPTION = 0x00000001

140 SERVICE_CONFIG_FAILURE_ACTIONS = 0x00000002

141 SERVICE_CONFIG_DELAYED_AUTO_START_INFO = 0x00000003

142 SERVICE_CONFIG_FAILURE_ACTIONS_FLAG = 0x00000004

143 SERVICE_CONFIG_SERVICE_SID_INFO = 0x00000005

144 SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006

145 SERVICE_CONFIG_PRESHUTDOWN_INFO = 0x00000007

146 SERVICE_CONFIG_PREFERRED_NODE = 0x00000009

147 SERVICE_CONFIG_RUNLEVEL_INFO = 0x0000000A

148

149# SC_ACTIONS Types

150 SC_ACTION_NONE = 0

151 SC_ACTION_RESTART = 1

152 SC_ACTION_REBOOT = 2

153 SC_ACTION_RUN_COMMAND = 3

154

155# SERVICE_SID_INFO types

156 SERVICE_SID_TYPE_NONE = 0x00000000

157 SERVICE_SID_TYPE_RESTRICTED = 0x00000003

158 SERVICE_SID_TYPE_UNRESTRICTED = 0x00000001

159

160# SC_STATUS_TYPE types

161 SC_STATUS_PROCESS_INFO = 0

162

163# Notify Mask

164 SERVICE_NOTIFY_CREATED = 0x00000080

165 SERVICE_NOTIFY_CONTINUE_PENDING = 0x00000010

166 SERVICE_NOTIFY_DELETE_PENDING = 0x00000200

167 SERVICE_NOTIFY_DELETED = 0x00000100

168 SERVICE_NOTIFY_PAUSE_PENDING = 0x00000020

169 SERVICE_NOTIFY_PAUSED = 0x00000040

170 SERVICE_NOTIFY_RUNNING = 0x00000008

171 SERVICE_NOTIFY_START_PENDING = 0x00000002

172 SERVICE_NOTIFY_STOP_PENDING = 0x00000004

173 SERVICE_NOTIFY_STOPPED = 0x00000001

174

175# SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW Reasons

176 SERVICE_STOP_CUSTOM = 0x20000000

177 SERVICE_STOP_PLANNED = 0x40000000

178 SERVICE_STOP_UNPLANNED = 0x10000000

179

180# SERVICE_TRIGGER triggers

181 SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL = 0x00000001

182 SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY = 0x00000002

183 SERVICE_TRIGGER_TYPE_DOMAIN_JOIN = 0x00000003

184 SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT = 0x00000004

185 SERVICE_TRIGGER_TYPE_GROUP_POLICY = 0x00000005

186 SERVICE_TRIGGER_TYPE_CUSTOM = 0x00000020

187

188# SERVICE_TRIGGER actions

189 SERVICE_TRIGGER_ACTION_SERVICE_START = 0x00000001

190 SERVICE_TRIGGER_ACTION_SERVICE_STOP = 0x00000002

191

192# SERVICE_TRIGGER subTypes

193 DOMAIN_JOIN_GUID = '1ce20aba-9851-4421-9430-1ddeb766e809'

194 DOMAIN_LEAVE_GUID = 'ddaf516e-58c2-4866-9574-c3b615d42ea1'

195 FIREWALL_PORT_OPEN_GUID = 'b7569e07-8421-4ee0-ad10-86915afdad09'

196 FIREWALL_PORT_CLOSE_GUID = 'a144ed38-8e12-4de4-9d96-e64740b1a524'

197 MACHINE_POLICY_PRESENT_GUID = '659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0'

198 NETWORK_MANAGER_FIRST_IP_ADDRESS_ARRIVAL_GUID = '4f27f2de-14e2-430b-a549-7cd48cbc8245'

199 NETWORK_MANAGER_LAST_IP_ADDRESS_REMOVAL_GUID = 'cc4ba62a-162e-4648-847a-b6bdf993e335'

200 USER_POLICY_PRESENT_GUID = '54FB46C8-F089-464C-B1FD-59D1B62C3B50'

201

202# SERVICE_TRIGGER_SPECIFIC_DATA_ITEM dataTypes

203 SERVICE_TRIGGER_DATA_TYPE_BINARY = 0x00000001

204 SERVICE_TRIGGER_DATA_TYPE_STRING = 0x00000002

205

206################################################################################

207# STRUCTURES

208################################################################################

209

210 class BYTE_ARRAY(NDRUniConformantArray):

211 item = 'c'

212

213 class SC_RPC_HANDLE(NDRSTRUCT):

214 structure = (

215 ('Data','20s=""'),

216 )

217 def getAlignment(self):

218 return 1

219

220 SC_NOTIFY_RPC_HANDLE = SC_RPC_HANDLE

221

222 class SERVICE_STATUS(NDRSTRUCT):

223 structure = (

224 ('dwServiceType',DWORD),

225 ('dwCurrentState',DWORD),

226 ('dwControlsAccepted',DWORD),

227 ('dwWin32ExitCode',DWORD),

228 ('dwServiceSpecificExitCode',DWORD),

229 ('dwCheckPoint',DWORD),

230 ('dwWaitHint',DWORD),

231 )

232

233 class QUERY_SERVICE_CONFIGW(NDRSTRUCT):

234 structure = (

235 ('dwServiceType',DWORD),

236 ('dwStartType',DWORD),

237 ('dwErrorControl',DWORD),

238 ('lpBinaryPathName', LPWSTR),

239 ('lpLoadOrderGroup',LPWSTR),

240 ('dwTagId',DWORD),

241 ('lpDependencies',LPWSTR),

242 ('lpServiceStartName',LPWSTR),

243 ('lpDisplayName',LPWSTR),

244 )

245

246 class SC_RPC_LOCK(NDRSTRUCT):

247 structure = (

248 ('Data','20s=""'),

249 )

250 def getAlignment(self):

251 return 1

252

253 class LPSERVICE_STATUS(NDRPOINTER):

254 referent = (

255 ('Data',SERVICE_STATUS),

256 )

257

258 SECURITY_INFORMATION = ULONG

259

260 BOUNDED_DWORD_256K = DWORD

261

262 class LPBOUNDED_DWORD_256K(NDRPOINTER):

263 referent = (

264 ('Data', BOUNDED_DWORD_256K),

265 )

266

267 SVCCTL_HANDLEW = LPWSTR

268

269 class ENUM_SERVICE_STATUSW(NDRSTRUCT):

270 structure = (

271 ('lpServiceName',LPWSTR),

272 ('lpDisplayName',LPWSTR),

273 ('ServiceStatus',SERVICE_STATUS),

274 )

275

276 class LPQUERY_SERVICE_CONFIGW(NDRPOINTER):

277 referent = (

278 ('Data', QUERY_SERVICE_CONFIGW),

279 )

280

281 BOUNDED_DWORD_8K = DWORD

282 BOUNDED_DWORD_4K = DWORD

283

284 class STRING_PTRSW(NDRSTRUCT):

285 structure = (

286 ('Data',NDRUniConformantArray),

287 )

288 def __init__(self, data = None, isNDR64 = False):

289 NDR.__init__(self,None,isNDR64)

290 self.fields['Data'].item = LPWSTR

291 if data is not None: 291 ↛ 292line 291 didn't jump to line 292, because the condition on line 291 was never true

292 self.fromString(data)

293

294 class UNIQUE_STRING_PTRSW(NDRPOINTER):

295 referent = (

296 ('Data', STRING_PTRSW),

297 )

298

299 class QUERY_SERVICE_LOCK_STATUSW(NDRSTRUCT):

300 structure = (

301 ('fIsLocked',DWORD),

302 ('lpLockOwner',LPWSTR),

303 ('dwLockDuration',DWORD),

304 )

305

306 class SERVICE_DESCRIPTION_WOW64(NDRSTRUCT):

307 structure = (

308 ('dwDescriptionOffset', DWORD),

309 )

310

311 class SERVICE_DESCRIPTIONW(NDRSTRUCT):

312 structure = (

313 ('lpDescription', LPWSTR),

314 )

315

316 class LPSERVICE_DESCRIPTIONW(NDRPOINTER):

317 referent = (

318 ('Data', SERVICE_DESCRIPTIONW),

319 )

320

321 class SERVICE_FAILURE_ACTIONS_WOW64(NDRSTRUCT):

322 structure = (

323 ('dwResetPeriod', DWORD),

324 ('dwRebootMsgOffset', DWORD),

325 ('dwCommandOffset', DWORD),

326 ('cActions', DWORD),

327 ('dwsaActionsOffset', DWORD),

328 )

329

330 class SC_ACTION(NDRSTRUCT):

331 structure = (

332 ('Type', DWORD),

333 ('Delay', DWORD) ,

334 )

335

336 class SC_ACTIONS(NDRSTRUCT):

337 structure = (

338 ('Data', NDRUniConformantArray),

339 )

340 def __init__(self, data = None, isNDR64 = False):

341 NDR.__init__(self,None,isNDR64)

342 self.fields['Data'].item = SC_ACTION

343 if data is not None:

344 self.fromString(data)

345

346 class SERVICE_FAILURE_ACTIONSW(NDRSTRUCT):

347 structure = (

348 ('dwResetPeriod', DWORD),

349 ('lpRebootMsg', LPWSTR) ,

350 ('lpCommand', LPWSTR) ,

351 ('cActions', DWORD) ,

352 ('lpsaActions', SC_ACTIONS) ,

353 )

354

355 class LPSERVICE_FAILURE_ACTIONSW(NDRPOINTER):

356 referent = (

357 ('Data', SERVICE_FAILURE_ACTIONSW),

358 )

359

360 class SERVICE_FAILURE_ACTIONS_FLAG(NDRSTRUCT):

361 structure = (

362 ('fFailureActionsOnNonCrashFailures', BOOL),

363 )

364

365 class LPSERVICE_FAILURE_ACTIONS_FLAG(NDRPOINTER):

366 referent = (

367 ('Data', SERVICE_FAILURE_ACTIONS_FLAG),

368 )

369

370 class SERVICE_DELAYED_AUTO_START_INFO(NDRSTRUCT):

371 structure = (

372 ('fDelayedAutostart', BOOL),

373 )

374

375 class LPSERVICE_DELAYED_AUTO_START_INFO(NDRPOINTER):

376 referent = (

377 ('Data', SERVICE_DELAYED_AUTO_START_INFO),

378 )

379

380 class SERVICE_SID_INFO(NDRSTRUCT):

381 structure = (

382 ('dwServiceSidType', DWORD),

383 )

384

385 class LPSERVICE_SID_INFO(NDRPOINTER):

386 referent = (

387 ('Data', SERVICE_SID_INFO),

388 )

389

390

391 class SERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRSTRUCT):

392 structure = (

393 ('cbRequiredPrivileges',DWORD),

394 ('pRequiredPrivileges',LPBYTE),

395 )

396 def getData(self, soFar = 0):

397 self['cbRequiredPrivileges'] = len(self['pRequiredPrivileges'])

398 return NDR.getData(self, soFar = 0)

399

400

401 class LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO(NDRPOINTER):

402 referent = (

403 ('Data', SERVICE_RPC_REQUIRED_PRIVILEGES_INFO),

404 )

405

406 class SERVICE_REQUIRED_PRIVILEGES_INFO_WOW64(NDRSTRUCT):

407 structure = (

408 ('dwRequiredPrivilegesOffset', DWORD),

409 )

410

411 class SERVICE_PRESHUTDOWN_INFO(NDRSTRUCT):

412 structure = (

413 ('dwPreshutdownTimeout', DWORD),

414 )

415

416 class LPSERVICE_PRESHUTDOWN_INFO(NDRPOINTER):

417 referent = (

418 ('Data', SERVICE_PRESHUTDOWN_INFO),

419 )

420

421 class SERVICE_STATUS_PROCESS(NDRSTRUCT):

422 structure = (

423 ('dwServiceType', DWORD),

424 ('dwCurrentState', DWORD),

425 ('dwControlsAccepted', DWORD),

426 ('dwWin32ExitCode', DWORD),

427 ('dwServiceSpecificExitCode', DWORD),

428 ('dwCheckPoint', DWORD),

429 ('dwWaitHint', DWORD),

430 ('dwProcessId', DWORD),

431 ('dwServiceFlags', DWORD),

432 )

433

434 class UCHAR_16(NDRSTRUCT):

435 structure = (

436 ('Data', '16s=""'),

437 )

438 def getAlignment(self):

439 return 1

440

441 class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRSTRUCT):

442 structure = (

443 ('ullThreadId',ULONGLONG),

444 ('dwNotifyMask',DWORD),

445 ('CallbackAddressArray',UCHAR_16),

446 ('CallbackParamAddressArray',UCHAR_16),

447 ('ServiceStatus', SERVICE_STATUS_PROCESS),

448 ('dwNotificationStatus',DWORD),

449 ('dwSequence',DWORD),

450 )

451

452 class SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRSTRUCT):

453 structure = (

454 ('ullThreadId',ULONGLONG),

455 ('dwNotifyMask',DWORD),

456 ('CallbackAddressArray',UCHAR_16),

457 ('CallbackParamAddressArray',UCHAR_16),

458 ('ServiceStatus',SERVICE_STATUS_PROCESS),

459 ('dwNotificationStatus',DWORD),

460 ('dwSequence',DWORD),

461 ('dwNotificationTriggered',DWORD),

462 ('pszServiceNames',LPWSTR),

463 )

464

465 class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1(NDRPOINTER):

466 referent = (

467 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),

468 )

469

470 class PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2(NDRPOINTER):

471 referent = (

472 ('Data', SERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),

473 )

474

475 class SC_RPC_NOTIFY_PARAMS(NDRUNION):

476 union = {

477 1: ('pStatusChangeParam1', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_1),

478 2: ('pStatusChangeParams', PSERVICE_NOTIFY_STATUS_CHANGE_PARAMS_2),

479 }

480

481 class SC_RPC_NOTIFY_PARAMS_ARRAY(NDRUniConformantArray):

482 item = SC_RPC_NOTIFY_PARAMS

483

484 class PSC_RPC_NOTIFY_PARAMS_LIST(NDRSTRUCT):

485 structure = (

486 ('cElements',BOUNDED_DWORD_4K),

487 ('NotifyParamsArray', SC_RPC_NOTIFY_PARAMS_ARRAY),

488 )

489

490 class SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW(NDRSTRUCT):

491 structure = (

492 ('dwReason', DWORD),

493 ('pszComment', LPWSTR),

494 )

495

496 class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRSTRUCT):

497 structure = (

498 ('dwDataType',DWORD ),

499 ('cbData',DWORD),

500 ('pData', LPBYTE),

501 )

502 def getData(self, soFar = 0):

503 if self['pData'] != 0:

504 self['cbData'] = len(self['pData'])

505 return NDR.getData(self, soFar)

506

507 class SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY(NDRUniConformantArray):

508 item = SERVICE_TRIGGER_SPECIFIC_DATA_ITEM

509

510 class PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM(NDRPOINTER):

511 referent = (

512 ('Data', SERVICE_TRIGGER_SPECIFIC_DATA_ITEM_ARRAY),

513 )

514

515 class SERVICE_TRIGGER(NDRSTRUCT):

516 structure = (

517 ('dwTriggerType', DWORD),

518 ('dwAction', DWORD),

519 ('pTriggerSubtype', PGUID),

520 ('cDataItems', DWORD),

521 ('pDataItems', PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM),

522 )

523 def getData(self, soFar = 0):

524 if self['pDataItems'] != 0:

525 self['cDataItems'] = len(self['pDataItems'])

526 return NDR.getData(self, soFar)

527

528 class SERVICE_TRIGGER_ARRAY(NDRUniConformantArray):

529 item = SERVICE_TRIGGER

530

531 class PSERVICE_TRIGGER(NDRPOINTER):

532 referent = (

533 ('Data', SERVICE_TRIGGER_ARRAY),

534 )

535

536 class SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS(NDRSTRUCT):

537 structure = (

538 ('ServiceStatus', SERVICE_STATUS_PROCESS),

539 )

540

541 class SERVICE_TRIGGER_INFO(NDRSTRUCT):

542 structure = (

543 ('cTriggers', DWORD),

544 ('pTriggers', PSERVICE_TRIGGER),

545 ('pReserved', NDRPOINTERNULL ),

546 )

547 def getData(self, soFar = 0):

548 if self['pTriggers'] != 0:

549 self['cTriggers'] = len(self['pTriggers'])

550 return NDR.getData(self, soFar)

551

552 class PSERVICE_TRIGGER_INFO(NDRPOINTER):

553 referent = (

554 ('Data', SERVICE_TRIGGER_INFO),

555 )

556

557 class SERVICE_PREFERRED_NODE_INFO(NDRSTRUCT):

558 structure = (

559 ('usPreferredNode', USHORT),

560 ('fDelete', BOOL),

561 )

562

563 class LPSERVICE_PREFERRED_NODE_INFO(NDRPOINTER):

564 referent = (

565 ('Data', SERVICE_PREFERRED_NODE_INFO),

566 )

567

568 class SERVICE_RUNLEVEL_INFO(NDRSTRUCT):

569 structure = (

570 ('eLowestRunLevel', DWORD),

571 )

572

573 class PSERVICE_RUNLEVEL_INFO(NDRPOINTER):

574 referent = (

575 ('Data', SERVICE_RUNLEVEL_INFO),

576 )

577

578 class SERVICE_MANAGEDACCOUNT_INFO(NDRSTRUCT):

579 structure = (

580 ('fIsManagedAccount', DWORD),

581 )

582

583 class PSERVICE_MANAGEDACCOUNT_INFO(NDRPOINTER):

584 referent = (

585 ('Data', SERVICE_MANAGEDACCOUNT_INFO),

586 )

587

588 class SC_RPC_CONFIG_INFOW_UNION(NDRUNION):

589 commonHdr = (

590 ('tag', ULONG),

591 )

592

593 union = {

594 1: ('psd', LPSERVICE_DESCRIPTIONW),

595 2: ('psfa',LPSERVICE_FAILURE_ACTIONSW ),

596 3: ('psda',LPSERVICE_DELAYED_AUTO_START_INFO),

597 4: ('psfaf',LPSERVICE_FAILURE_ACTIONS_FLAG),

598 5: ('pssid',LPSERVICE_SID_INFO),

599 6: ('psrp',LPSERVICE_RPC_REQUIRED_PRIVILEGES_INFO),

600 7: ('psps',LPSERVICE_PRESHUTDOWN_INFO),

601 8: ('psti',PSERVICE_TRIGGER_INFO),

602 9: ('pspn',LPSERVICE_PREFERRED_NODE_INFO),

603 10: ('psri',PSERVICE_RUNLEVEL_INFO),

604 11: ('psma',PSERVICE_MANAGEDACCOUNT_INFO),

605 }

606

607 class SC_RPC_CONFIG_INFOW(NDRSTRUCT):

608 structure = (

609 ('dwInfoLevel', DWORD),

610 ('Union', SC_RPC_CONFIG_INFOW_UNION),

611 )

612

613################################################################################

614# RPC CALLS

615################################################################################

616

617 class RCloseServiceHandle(NDRCALL):

618 opnum = 0

619 structure = (

620 ('hSCObject',SC_RPC_HANDLE),

621 )

622

623 class RCloseServiceHandleResponse(NDRCALL):

624 structure = (

625 ('hSCObject',SC_RPC_HANDLE),

626 ('ErrorCode', DWORD),

627 )

628

629 class RControlService(NDRCALL):

630 opnum = 1

631 structure = (

632 ('hService',SC_RPC_HANDLE),

633 ('dwControl',DWORD),

634 )

635

636 class RControlServiceResponse(NDRCALL):

637 structure = (

638 ('lpServiceStatus',SERVICE_STATUS),

639 ('ErrorCode', DWORD),

640 )

641

642 class RDeleteService(NDRCALL):

643 opnum = 2

644 structure = (

645 ('hService',SC_RPC_HANDLE),

646 )

647

648 class RDeleteServiceResponse(NDRCALL):

649 structure = (

650 ('ErrorCode', DWORD),

651 )

652

653 class RLockServiceDatabase(NDRCALL):

654 opnum = 3

655 structure = (

656 ('hSCManager',SC_RPC_HANDLE),

657 )

658

659 class RLockServiceDatabaseResponse(NDRCALL):

660 structure = (

661 ('lpLock',SC_RPC_LOCK),

662 ('ErrorCode', DWORD),

663 )

664

665 class RQueryServiceObjectSecurity(NDRCALL):

666 opnum = 4

667 structure = (

668 ('hService',SC_RPC_HANDLE),

669 ('dwSecurityInformation',SECURITY_INFORMATION),

670 ('cbBufSize',DWORD),

671 )

672

673 class RQueryServiceObjectSecurityResponse(NDRCALL):

674 structure = (

675 ('lpSecurityDescriptor', BYTE_ARRAY),

676 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

677 ('ErrorCode', DWORD),

678 )

679

680 class RSetServiceObjectSecurity(NDRCALL):

681 opnum = 5

682 structure = (

683 ('hService',SC_RPC_HANDLE),

684 ('dwSecurityInformation',SECURITY_INFORMATION),

685 ('lpSecurityDescriptor',LPBYTE),

686 ('cbBufSize',DWORD),

687 )

688

689 class RSetServiceObjectSecurityResponse(NDRCALL):

690 structure = (

691 ('ErrorCode', DWORD),

692 )

693

694 class RQueryServiceStatus(NDRCALL):

695 opnum = 6

696 structure = (

697 ('hService',SC_RPC_HANDLE),

698 )

699

700 class RQueryServiceStatusResponse(NDRCALL):

701 structure = (

702 ('lpServiceStatus',SERVICE_STATUS),

703 ('ErrorCode', DWORD),

704 )

705

706 class RSetServiceStatus(NDRCALL):

707 opnum = 7

708 structure = (

709 ('hServiceStatus',SC_RPC_HANDLE),

710 ('lpServiceStatus',SERVICE_STATUS),

711 )

712

713 class RSetServiceStatusResponse(NDRCALL):

714 structure = (

715 ('ErrorCode', DWORD),

716 )

717

718 class RUnlockServiceDatabase(NDRCALL):

719 opnum = 8

720 structure = (

721 ('Lock',SC_RPC_LOCK),

722 )

723

724 class RUnlockServiceDatabaseResponse(NDRCALL):

725 structure = (

726 ('Lock',SC_RPC_LOCK),

727 ('ErrorCode', DWORD),

728 )

729

730 class RNotifyBootConfigStatus(NDRCALL):

731 opnum = 9

732 structure = (

733 ('lpMachineName',SVCCTL_HANDLEW),

734 ('BootAcceptable',DWORD),

735 )

736

737 class RNotifyBootConfigStatusResponse(NDRCALL):

738 structure = (

739 ('ErrorCode', DWORD),

740 )

741

742 class RChangeServiceConfigW(NDRCALL):

743 opnum = 11

744 structure = (

745 ('hService',SC_RPC_HANDLE),

746 ('dwServiceType',DWORD),

747 ('dwStartType',DWORD),

748 ('dwErrorControl',DWORD),

749 ('lpBinaryPathName',LPWSTR),

750 ('lpLoadOrderGroup',LPWSTR),

751 ('lpdwTagId',LPDWORD),

752 ('lpDependencies',LPBYTE),

753 ('dwDependSize',DWORD),

754 ('lpServiceStartName',LPWSTR),

755 ('lpPassword',LPBYTE),

756 ('dwPwSize',DWORD),

757 ('lpDisplayName',LPWSTR),

758 )

759

760 class RChangeServiceConfigWResponse(NDRCALL):

761 structure = (

762 ('lpdwTagId',LPDWORD),

763 ('ErrorCode', DWORD),

764 )

765

766 class RCreateServiceW(NDRCALL):

767 opnum = 12

768 structure = (

769 ('hSCManager',SC_RPC_HANDLE),

770 ('lpServiceName',WSTR),

771 ('lpDisplayName',LPWSTR),

772 ('dwDesiredAccess',DWORD),

773 ('dwServiceType',DWORD),

774 ('dwStartType',DWORD),

775 ('dwErrorControl',DWORD),

776 ('lpBinaryPathName',WSTR),

777 ('lpLoadOrderGroup',LPWSTR),

778 ('lpdwTagId',LPDWORD),

779 ('lpDependencies',LPBYTE),

780 ('dwDependSize',DWORD),

781 ('lpServiceStartName',LPWSTR),

782 ('lpPassword',LPBYTE),

783 ('dwPwSize',DWORD),

784 )

785

786 class RCreateServiceWResponse(NDRCALL):

787 structure = (

788 ('lpdwTagId',LPWSTR),

789 ('lpServiceHandle',SC_RPC_HANDLE),

790 ('ErrorCode', DWORD),

791 )

792

793 class REnumDependentServicesW(NDRCALL):

794 opnum = 13

795 structure = (

796 ('hService',SC_RPC_HANDLE),

797 ('dwServiceState',DWORD),

798 ('cbBufSize',DWORD),

799 )

800

801 class REnumDependentServicesWResponse(NDRCALL):

802 structure = (

803 ('lpServices',NDRUniConformantArray),

804 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

805 ('lpServicesReturned',BOUNDED_DWORD_256K),

806 ('ErrorCode', DWORD),

807 )

808

809 class REnumServicesStatusW(NDRCALL):

810 opnum = 14

811 structure = (

812 ('hSCManager',SC_RPC_HANDLE),

813 ('dwServiceType',DWORD),

814 ('dwServiceState',DWORD),

815 ('cbBufSize',DWORD),

816 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

817 )

818

819 class REnumServicesStatusWResponse(NDRCALL):

820 structure = (

821 ('lpBuffer',NDRUniConformantArray),

822 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

823 ('lpServicesReturned',BOUNDED_DWORD_256K),

824 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

825 ('ErrorCode', DWORD),

826 )

827

828 class ROpenSCManagerW(NDRCALL):

829 opnum = 15

830 structure = (

831 ('lpMachineName',SVCCTL_HANDLEW),

832 ('lpDatabaseName',LPWSTR),

833 ('dwDesiredAccess',DWORD),

834 )

835

836 class ROpenSCManagerWResponse(NDRCALL):

837 structure = (

838 ('lpScHandle',SC_RPC_HANDLE),

839 ('ErrorCode', DWORD),

840 )

841

842 class ROpenServiceW(NDRCALL):

843 opnum = 16

844 structure = (

845 ('hSCManager',SC_RPC_HANDLE),

846 ('lpServiceName',WSTR),

847 ('dwDesiredAccess',DWORD),

848 )

849

850 class ROpenServiceWResponse(NDRCALL):

851 structure = (

852 ('lpServiceHandle',SC_RPC_HANDLE),

853 ('ErrorCode', DWORD),

854 )

855

856 class RQueryServiceConfigW(NDRCALL):

857 opnum = 17

858 structure = (

859 ('hService',SC_RPC_HANDLE),

860 ('cbBufSize',DWORD),

861 )

862

863 class RQueryServiceConfigWResponse(NDRCALL):

864 structure = (

865 ('lpServiceConfig',QUERY_SERVICE_CONFIGW),

866 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

867 ('ErrorCode', DWORD),

868 )

869

870 class RQueryServiceLockStatusW(NDRCALL):

871 opnum = 18

872 structure = (

873 ('hSCManager',SC_RPC_HANDLE),

874 ('cbBufSize',DWORD),

875 )

876

877 class RQueryServiceLockStatusWResponse(NDRCALL):

878 structure = (

879 ('lpLockStatus',QUERY_SERVICE_LOCK_STATUSW),

880 ('pcbBytesNeeded',BOUNDED_DWORD_4K),

881 ('ErrorCode', DWORD),

882 )

883

884 class RStartServiceW(NDRCALL):

885 opnum = 19

886 structure = (

887 ('hService',SC_RPC_HANDLE),

888 ('argc',DWORD),

889 ('argv',UNIQUE_STRING_PTRSW),

890 )

891

892 class RStartServiceWResponse(NDRCALL):

893 structure = (

894 ('ErrorCode', DWORD),

895 )

896

897 class RGetServiceDisplayNameW(NDRCALL):

898 opnum = 20

899 structure = (

900 ('hSCManager',SC_RPC_HANDLE),

901 ('lpServiceName',WSTR),

902 ('lpcchBuffer',DWORD),

903 )

904

905 class RGetServiceDisplayNameWResponse(NDRCALL):

906 structure = (

907 ('lpDisplayName',WSTR),

908 ('lpcchBuffer',DWORD),

909 ('ErrorCode', DWORD),

910 )

911

912 class RGetServiceKeyNameW(NDRCALL):

913 opnum = 21

914 structure = (

915 ('hSCManager',SC_RPC_HANDLE),

916 ('lpDisplayName',WSTR),

917 ('lpcchBuffer',DWORD),

918 )

919

920 class RGetServiceKeyNameWResponse(NDRCALL):

921 structure = (

922 ('lpDisplayName',WSTR),

923 ('lpcchBuffer',DWORD),

924 ('ErrorCode', DWORD),

925 )

926

927 class REnumServiceGroupW(NDRCALL):

928 opnum = 35

929 structure = (

930 ('hSCManager',SC_RPC_HANDLE),

931 ('dwServiceType',DWORD),

932 ('dwServiceState',DWORD),

933 ('cbBufSize',DWORD),

934 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

935 ('pszGroupName',LPWSTR),

936 )

937

938 class REnumServiceGroupWResponse(NDRCALL):

939 structure = (

940 ('lpBuffer',LPBYTE),

941 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

942 ('lpServicesReturned',BOUNDED_DWORD_256K),

943 ('lpResumeIndex',BOUNDED_DWORD_256K),

944 ('ErrorCode', DWORD),

945 )

946

947 class RChangeServiceConfig2W(NDRCALL):

948 opnum = 37

949 structure = (

950 ('hService',SC_RPC_HANDLE),

951 ('Info',SC_RPC_CONFIG_INFOW),

952 )

953

954 class RChangeServiceConfig2WResponse(NDRCALL):

955 structure = (

956 ('ErrorCode', DWORD),

957 )

958

959 class RQueryServiceConfig2W(NDRCALL):

960 opnum = 39

961 structure = (

962 ('hService',SC_RPC_HANDLE),

963 ('dwInfoLevel',DWORD),

964 ('cbBufSize',DWORD),

965 )

966

967 class RQueryServiceConfig2WResponse(NDRCALL):

968 structure = (

969 ('lpBuffer',NDRUniConformantArray),

970 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

971 ('ErrorCode', DWORD),

972 )

973

974 class RQueryServiceStatusEx(NDRCALL):

975 opnum = 40

976 structure = (

977 ('hService',SC_RPC_HANDLE),

978 ('InfoLevel',DWORD),

979 ('cbBufSize',DWORD),

980 )

981

982 class RQueryServiceStatusExResponse(NDRCALL):

983 structure = (

984 ('lpBuffer',NDRUniConformantArray),

985 ('pcbBytesNeeded',BOUNDED_DWORD_8K),

986 ('ErrorCode', DWORD),

987 )

988

989 class REnumServicesStatusExW(NDRCALL):

990 opnum = 42

991 structure = (

992 ('hSCManager',SC_RPC_HANDLE),

993 ('InfoLevel',DWORD),

994 ('dwServiceType',DWORD),

995 ('dwServiceState',DWORD),

996 ('cbBufSize',DWORD),

997 ('lpResumeIndex',LPBOUNDED_DWORD_256K),

998 ('pszGroupName',LPWSTR),

999 )

1000

1001 class REnumServicesStatusExWResponse(NDRCALL):

1002 structure = (

1003 ('lpBuffer',NDRUniConformantArray),

1004 ('pcbBytesNeeded',BOUNDED_DWORD_256K),

1005 ('lpServicesReturned',BOUNDED_DWORD_256K),

1006 ('lpResumeIndex',BOUNDED_DWORD_256K),

1007 ('ErrorCode', DWORD),

1008 )

1009

1010 class RCreateServiceWOW64W(NDRCALL):

1011 opnum = 45

1012 structure = (

1013 ('hSCManager',SC_RPC_HANDLE),

1014 ('lpServiceName',WSTR),

1015 ('lpDisplayName',LPWSTR),

1016 ('dwDesiredAccess',DWORD),

1017 ('dwServiceType',DWORD),

1018 ('dwStartType',DWORD),

1019 ('dwErrorControl',DWORD),

1020 ('lpBinaryPathName',WSTR),

1021 ('lpLoadOrderGroup',LPWSTR),

1022 ('lpdwTagId',LPDWORD),

1023 ('lpDependencies',LPBYTE),

1024 ('dwDependSize',DWORD),

1025 ('lpServiceStartName',LPWSTR),

1026 ('lpPassword',LPBYTE),

1027 ('dwPwSize',DWORD),

1028 )

1029

1030 class RCreateServiceWOW64WResponse(NDRCALL):

1031 structure = (

1032 ('lpdwTagId',LPWSTR),

1033 ('lpServiceHandle',SC_RPC_HANDLE),

1034 ('ErrorCode', DWORD),

1035 )

1036

1037# Still not working, for some reason something changes in the way the pointer inside SC_RPC_NOTIFY_PARAMS is marshalled here

1038 class RNotifyServiceStatusChange(NDRCALL):

1039 opnum = 47

1040 structure = (

1041 ('hService',SC_RPC_HANDLE),

1042 ('NotifyParams',SC_RPC_NOTIFY_PARAMS),

1043 ('pClientProcessGuid',GUID),

1044 )

1045

1046 class RNotifyServiceStatusChangeResponse(NDRCALL):

1047 structure = (

1048 ('pSCMProcessGuid',GUID),

1049 ('pfCreateRemoteQueue',PBOOL),

1050 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1051 ('ErrorCode', DWORD),

1052 )

1053

1054# Not working, until I don't fix the previous one

1055 class RGetNotifyResults(NDRCALL):

1056 opnum = 48

1057 structure = (

1058 ('hNotify',SC_NOTIFY_RPC_HANDLE),

1059 )

1060

1061 class RGetNotifyResultsResponse(NDRCALL):

1062 structure = (

1063 ('ppNotifyParams',PSC_RPC_NOTIFY_PARAMS_LIST),

1064 ('ErrorCode', DWORD),

1065 )

1066

1067# Not working, until I don't fix the previous ones

1068 class RCloseNotifyHandle(NDRCALL):

1069 opnum = 49

1070 structure = (

1071 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1072 )

1073

1074 class RCloseNotifyHandleResponse(NDRCALL):

1075 structure = (

1076 ('phNotify',SC_NOTIFY_RPC_HANDLE),

1077 ('pfApcFired',PBOOL),

1078 ('ErrorCode', DWORD),

1079 )

1080

1081# Not working, returning bad_stub_data

1082 class RControlServiceExW(NDRCALL):

1083 opnum = 51

1084 structure = (

1085 ('hService',SC_RPC_HANDLE),

1086 ('dwControl',DWORD),

1087 ('dwInfoLevel',DWORD),

1088 ('pControlInParams',SERVICE_CONTROL_STATUS_REASON_IN_PARAMSW),

1089 )

1090

1091 class RControlServiceExWResponse(NDRCALL):

1092 structure = (

1093 ('pControlOutParams',SERVICE_CONTROL_STATUS_REASON_OUT_PARAMS),

1094 ('ErrorCode', DWORD),

1095 )

1096

1097 class RQueryServiceConfigEx(NDRCALL):

1098 opnum = 56

1099 structure = (

1100 ('hService',SC_RPC_HANDLE),

1101 ('dwInfoLevel',DWORD),

1102 )

1103

1104 class RQueryServiceConfigExResponse(NDRCALL):

1105 structure = (

1106 ('pInfo',SC_RPC_CONFIG_INFOW),

1107 ('ErrorCode', DWORD),

1108 )

1109

1110################################################################################

1111# OPNUMs and their corresponding structures

1112################################################################################

1113 OPNUMS = {

1114 0 : (RCloseServiceHandle, RCloseServiceHandleResponse),

1115 1 : (RControlService, RControlServiceResponse),

1116 2 : (RDeleteService, RDeleteServiceResponse),

1117 3 : (RLockServiceDatabase, RLockServiceDatabaseResponse),

1118 4 : (RQueryServiceObjectSecurity, RQueryServiceObjectSecurityResponse),

1119 5 : (RSetServiceObjectSecurity, RSetServiceObjectSecurityResponse),

1120 6 : (RQueryServiceStatus, RQueryServiceStatusResponse),

1121 7 : (RSetServiceStatus, RSetServiceStatusResponse),

1122 8 : (RUnlockServiceDatabase, RUnlockServiceDatabaseResponse),

1123 9 : (RNotifyBootConfigStatus, RNotifyBootConfigStatusResponse),

1124 11 : (RChangeServiceConfigW, RChangeServiceConfigWResponse),

1125 12 : (RCreateServiceW, RCreateServiceWResponse),

1126 13 : (REnumDependentServicesW, REnumDependentServicesWResponse),

1127 14 : (REnumServicesStatusW, REnumServicesStatusWResponse),

1128 15 : (ROpenSCManagerW, ROpenSCManagerWResponse),

1129 16 : (ROpenServiceW, ROpenServiceWResponse),

1130 17 : (RQueryServiceConfigW, RQueryServiceConfigWResponse),

1131 18 : (RQueryServiceLockStatusW, RQueryServiceLockStatusWResponse),

1132 19 : (RStartServiceW, RStartServiceWResponse),

1133 20 : (RGetServiceDisplayNameW, RGetServiceDisplayNameWResponse),

1134 21 : (RGetServiceKeyNameW, RGetServiceKeyNameWResponse),

1135 35 : (REnumServiceGroupW, REnumServiceGroupWResponse),

1136 37 : (RChangeServiceConfig2W, RChangeServiceConfig2WResponse),

1137 39 : (RQueryServiceConfig2W, RQueryServiceConfig2WResponse),

1138 40 : (RQueryServiceStatusEx, RQueryServiceStatusExResponse),

1139 42 : (REnumServicesStatusExW, REnumServicesStatusExWResponse),

1140 45 : (RCreateServiceWOW64W, RCreateServiceWOW64WResponse),

1141 47 : (RNotifyServiceStatusChange, RNotifyServiceStatusChangeResponse),

1142 48 : (RGetNotifyResults, RGetNotifyResultsResponse),

1143 49 : (RCloseNotifyHandle, RCloseNotifyHandleResponse),

1144 51 : (RControlServiceExW, RControlServiceExWResponse),

1145 56 : (RQueryServiceConfigEx, RQueryServiceConfigExResponse),

1146}

1147

1148################################################################################

1149# HELPER FUNCTIONS

1150################################################################################

1151 def checkNullString(string):

1152 if string == NULL:

1153 return string

1154

1155 if string[-1:] != '\x00': 1155 ↛ 1156line 1155 didn't jump to line 1156, because the condition on line 1155 was never true

1156 return string + '\x00'

1157 else:

1158 return string

1159

1160 def hRCloseServiceHandle(dce, hSCObject):

1161 request = RCloseServiceHandle()

1162 request['hSCObject'] = hSCObject

1163 return dce.request(request)

1164

1165 def hRControlService(dce, hService, dwControl):

1166 request = RControlService()

1167 request['hService'] = hService

1168 request['dwControl'] = dwControl

1169 return dce.request(request)

1170

1171 def hRDeleteService(dce, hService):

1172 request = RDeleteService()

1173 request ['hService'] = hService

1174 return dce.request(request)

1175

1176 def hRLockServiceDatabase(dce, hSCManager):

1177 request = RLockServiceDatabase()

1178 request['hSCManager'] = hSCManager

1179 return dce.request(request)

1180

1181

1182 def hRQueryServiceObjectSecurity(dce, hService, dwSecurityInformation, cbBufSize=0):

1183 request = RQueryServiceObjectSecurity()

1184 request['hService'] = hService

1185 request['dwSecurityInformation'] = dwSecurityInformation

1186 request['cbBufSize'] = cbBufSize

1187 try:

1188 resp = dce.request(request)

1189 except DCERPCSessionError as e:

1190 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:

1191 resp = e.get_packet()

1192 request['cbBufSize'] = resp['pcbBytesNeeded']

1193 resp = dce.request(request)

1194 else:

1195 raise

1196 return resp

1197

1198 def hRSetServiceObjectSecurity(dce, hService, dwSecurityInformation, lpSecurityDescriptor, cbBufSize ):

1199 request = RSetServiceObjectSecurity()

1200 request['hService'] = hService

1201 request['dwSecurityInformation'] = dwSecurityInformation

1202 request['cbBufSize'] = cbBufSize

1203 return dce.request(request)

1204

1205 def hRQueryServiceStatus(dce, hService ):

1206 request = RQueryServiceStatus()

1207 request['hService'] = hService

1208 return dce.request(request)

1209

1210 def hRSetServiceStatus(dce, hServiceStatus, lpServiceStatus ):

1211 request = RSetServiceStatus()

1212 request['hServiceStatus'] = hServiceStatus

1213 request['lpServiceStatus'] = lpServiceStatus

1214 return dce.request(request)

1215

1216 def hRUnlockServiceDatabase(dce, Lock ):

1217 request = RUnlockServiceDatabase()

1218 request['Lock'] = Lock

1219 return dce.request(request)

1220

1221 def hRNotifyBootConfigStatus(dce, lpMachineName, BootAcceptable ):

1222 request = RNotifyBootConfigStatus()

1223 request['lpMachineName'] = lpMachineName

1224 request['BootAcceptable'] = BootAcceptable

1225 return dce.request(request)

1226

1227 def hRChangeServiceConfigW(dce, hService, dwServiceType=SERVICE_NO_CHANGE, dwStartType=SERVICE_NO_CHANGE, dwErrorControl=SERVICE_NO_CHANGE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0, lpDisplayName=NULL):

1228 changeServiceConfig = RChangeServiceConfigW()

1229 changeServiceConfig['hService'] = hService

1230 changeServiceConfig['dwServiceType'] = dwServiceType

1231 changeServiceConfig['dwStartType'] = dwStartType

1232 changeServiceConfig['dwErrorControl'] = dwErrorControl

1233 changeServiceConfig['lpBinaryPathName'] = checkNullString(lpBinaryPathName)

1234 changeServiceConfig['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)

1235 changeServiceConfig['lpdwTagId'] = lpdwTagId

1236 changeServiceConfig['lpDependencies'] = lpDependencies

1237 # Strings MUST be NULL terminated for lpDependencies

1238 changeServiceConfig['dwDependSize'] = dwDependSize

1239 changeServiceConfig['lpServiceStartName'] = checkNullString(lpServiceStartName)

1240 changeServiceConfig['lpPassword'] = lpPassword

1241 changeServiceConfig['dwPwSize'] = dwPwSize

1242 changeServiceConfig['lpDisplayName'] = checkNullString(lpDisplayName)

1243 return dce.request(changeServiceConfig)

1244

1245 def hRCreateServiceW(dce, hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess=SERVICE_ALL_ACCESS, dwServiceType=SERVICE_WIN32_OWN_PROCESS, dwStartType=SERVICE_AUTO_START, dwErrorControl=SERVICE_ERROR_IGNORE, lpBinaryPathName=NULL, lpLoadOrderGroup=NULL, lpdwTagId=NULL, lpDependencies=NULL, dwDependSize=0, lpServiceStartName=NULL, lpPassword=NULL, dwPwSize=0):

1246 createService = RCreateServiceW()

1247 createService['hSCManager'] = hSCManager

1248 createService['lpServiceName'] = checkNullString(lpServiceName)

1249 createService['lpDisplayName'] = checkNullString(lpDisplayName)

1250 createService['dwDesiredAccess'] = dwDesiredAccess

1251 createService['dwServiceType'] = dwServiceType

1252 createService['dwStartType'] = dwStartType

1253 createService['dwErrorControl'] = dwErrorControl

1254 createService['lpBinaryPathName'] = checkNullString(lpBinaryPathName)

1255 createService['lpLoadOrderGroup'] = checkNullString(lpLoadOrderGroup)

1256 createService['lpdwTagId'] = lpdwTagId

1257 # Strings MUST be NULL terminated for lpDependencies

1258 createService['lpDependencies'] = lpDependencies

1259 createService['dwDependSize'] = dwDependSize

1260 createService['lpServiceStartName'] = checkNullString(lpServiceStartName)

1261 createService['lpPassword'] = lpPassword

1262 createService['dwPwSize'] = dwPwSize

1263 return dce.request(createService)

1264

1265 def hREnumDependentServicesW(dce, hService, dwServiceState, cbBufSize ):

1266 enumDependentServices = REnumDependentServicesW()

1267 enumDependentServices['hService'] = hService

1268 enumDependentServices['dwServiceState'] = dwServiceState

1269 enumDependentServices['cbBufSize'] = cbBufSize

1270 return dce.request(enumDependentServices)

1271

1272 def hREnumServicesStatusW(dce, hSCManager, dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_KERNEL_DRIVER|SERVICE_FILE_SYSTEM_DRIVER|SERVICE_WIN32_SHARE_PROCESS|SERVICE_INTERACTIVE_PROCESS, dwServiceState=SERVICE_STATE_ALL):

1273 class ENUM_SERVICE_STATUSW2(NDRSTRUCT):

1274 # This is a little trick, since the original structure is slightly different

1275 # but instead of parsing the LPBYTE buffer at hand, we just do it with the aid

1276 # of the NDR library, although the pointers are swapped from the original specification.

1277 # Why is this? Well.. since we're getting an LPBYTE back, it's just a copy of the remote's memory

1278 # where the pointers are actually POINTING to the data.

1279 # Sadly, the pointers are not aligned based on the services records, so we gotta do this

1280 # It should be easier in C of course.

1281 class STR(NDRPOINTER):

1282 referent = (

1283 ('Data', WIDESTR),

1284 )

1285 structure = (

1286 ('lpServiceName',STR),

1287 ('lpDisplayName',STR),

1288 ('ServiceStatus',SERVICE_STATUS),

1289 )

1290

1291 enumServicesStatus = REnumServicesStatusW()

1292 enumServicesStatus['hSCManager'] = hSCManager

1293 enumServicesStatus['dwServiceType'] = dwServiceType

1294 enumServicesStatus['dwServiceState'] = dwServiceState

1295 enumServicesStatus['cbBufSize'] = 0

1296 enumServicesStatus['lpResumeIndex'] = NULL

1297

1298 try:

1299 resp = dce.request(enumServicesStatus)

1300 except DCERPCSessionError as e:

1301 if e.get_error_code() == system_errors.ERROR_MORE_DATA: 1301 ↛ 1306line 1301 didn't jump to line 1306, because the condition on line 1301 was never false

1302 resp = e.get_packet()

1303 enumServicesStatus['cbBufSize'] = resp['pcbBytesNeeded']

1304 resp = dce.request(enumServicesStatus)

1305 else:

1306 raise

1307

1308 # Now we're supposed to have all services returned. Now we gotta parse them

1309

1310 enumArray = NDRUniConformantArray()

1311 enumArray.item = ENUM_SERVICE_STATUSW2

1312

1313 enumArray.setArraySize(resp['lpServicesReturned'])

1314

1315 data = b''.join(resp['lpBuffer'])

1316 enumArray.fromString(data)

1317 data = data[4:]

1318 # Since the pointers here are pointing to the actual data, we have to reparse

1319 # the referents

1320 for record in enumArray['Data']:

1321 offset = record.fields['lpDisplayName'].fields['ReferentID']-4

1322 name = WIDESTR(data[offset:])

1323 record['lpDisplayName'] = name['Data']

1324 offset = record.fields['lpServiceName'].fields['ReferentID']-4

1325 name = WIDESTR(data[offset:])

1326 record['lpServiceName'] = name['Data']

1327

1328 return enumArray['Data']

1329

1330 def hROpenSCManagerW(dce, lpMachineName='DUMMY\x00', lpDatabaseName='ServicesActive\x00', dwDesiredAccess=SERVICE_START | SERVICE_STOP | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SC_MANAGER_ENUMERATE_SERVICE):

1331 openSCManager = ROpenSCManagerW()

1332 openSCManager['lpMachineName'] = checkNullString(lpMachineName)

1333 openSCManager['lpDatabaseName'] = checkNullString(lpDatabaseName)

1334 openSCManager['dwDesiredAccess'] = dwDesiredAccess

1335 return dce.request(openSCManager)

1336

1337 def hROpenServiceW(dce, hSCManager, lpServiceName, dwDesiredAccess= SERVICE_ALL_ACCESS):

1338 openService = ROpenServiceW()

1339 openService['hSCManager'] = hSCManager

1340 openService['lpServiceName'] = checkNullString(lpServiceName)

1341 openService['dwDesiredAccess'] = dwDesiredAccess

1342 return dce.request(openService)

1343

1344 def hRQueryServiceConfigW(dce, hService):

1345 queryService = RQueryServiceConfigW()

1346 queryService['hService'] = hService

1347 queryService['cbBufSize'] = 0

1348 try:

1349 resp = dce.request(queryService)

1350 except DCERPCSessionError as e:

1351 if e.get_error_code() == system_errors.ERROR_INSUFFICIENT_BUFFER:

1352 resp = e.get_packet()

1353 queryService['cbBufSize'] = resp['pcbBytesNeeded']

1354 resp = dce.request(queryService)

1355 else:

1356 raise

1357

1358 return resp

1359

1360 def hRQueryServiceLockStatusW(dce, hSCManager, cbBufSize ):

1361 queryServiceLock = RQueryServiceLockStatusW()

1362 queryServiceLock['hSCManager'] = hSCManager

1363 queryServiceLock['cbBufSize'] = cbBufSize

1364 return dce.request(queryServiceLock)

1365

1366 def hRStartServiceW(dce, hService, argc=0, argv=NULL ):

1367 startService = RStartServiceW()

1368 startService['hService'] = hService

1369 startService['argc'] = argc

1370 if argc == 0:

1371 startService['argv'] = NULL

1372 else:

1373 for item in argv:

1374 itemn = LPWSTR()

1375 itemn['Data'] = checkNullString(item)

1376 startService['argv'].append(itemn)

1377 return dce.request(startService)

1378

1379 def hRGetServiceDisplayNameW(dce, hSCManager, lpServiceName, lpcchBuffer ):

1380 getServiceDisplay = RGetServiceDisplayNameW()

1381 getServiceDisplay['hSCManager'] = hSCManager

1382 getServiceDisplay['lpServiceName'] = checkNullString(lpServiceName)

1383 getServiceDisplay['lpcchBuffer'] = lpcchBuffer

1384 return dce.request(getServiceDisplay)

1385

1386 def hRGetServiceKeyNameW(dce, hSCManager, lpDisplayName, lpcchBuffer ):

1387 getServiceKeyName = RGetServiceKeyNameW()

1388 getServiceKeyName['hSCManager'] = hSCManager

1389 getServiceKeyName['lpDisplayName'] = checkNullString(lpDisplayName)

1390 getServiceKeyName['lpcchBuffer'] = lpcchBuffer

1391 return dce.request(getServiceKeyName)

1392

1393 def hREnumServiceGroupW(dce, hSCManager, dwServiceType, dwServiceState, cbBufSize, lpResumeIndex = NULL, pszGroupName = NULL ):

1394 enumServiceGroup = REnumServiceGroupW()

1395 enumServiceGroup['hSCManager'] = hSCManager

1396 enumServiceGroup['dwServiceType'] = dwServiceType

1397 enumServiceGroup['dwServiceState'] = dwServiceState

1398 enumServiceGroup['cbBufSize'] = cbBufSize

1399 enumServiceGroup['lpResumeIndex'] = lpResumeIndex

1400 enumServiceGroup['pszGroupName'] = pszGroupName

1401 return dce.request(enumServiceGroup)