Adding the services command
#1557
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ling services on Windows
rkervella
requested changes
Jan 15, 2024
We don't want to shell out for this kind of things. There's already the |
That is what I meant 🙂. Good catch 😁 |
…ngService to StartServiceByName, removing unnecessary test
|
@rkervella Hopefully the latest commit addresses the issues you identified 🙂 |
rkervella
approved these changes
Jan 15, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the
servicescommand that gives the operator the ability to interrogate and control (start, stop) services on Windows.There are four new commands, described below. All of the commands can be run against the local machine (the implant) or a remote machine by specifying its hostname with the
-Hflag.services: Get information about the services on the system. On small width terminals, you get the service name, display name, and status. On wide width terminals, you get the same information plus startup type (manual, disabled, automatic), path to the service binary, and the account that the service runs under.services info <service_name>: Gives more detailed information about a specific service, including the information from the wide terminal view plus a description of the service.services start <service_name>: If you have the appropriate permissions, you can start a service on the machine or a remote machine.services stop <service_name>: With the appropriate permissions, you can stop a service on the machine or a remote machine.I would like to open this command up to other platforms in the future. On Linux, that would require interacting with the
systemdAPI or shelling out on SysV-style init systems (have to look into that more). On macOS, that would likely require interacting withlaunchd.