Merge pull request #108 from sagishahar/master
Add 'CanRestart' to output and Pester tests
This commit is contained in:
HarmJ0y
commit
43c4c69b38
|
|
@ -122,8 +122,7 @@ function Test-ServiceDaclPermission {
|
|||
|
||||
# check if sc.exe exists
|
||||
if (-not (Test-Path ("$env:SystemRoot\system32\sc.exe"))){
|
||||
Write-Warning "[!] Could not find $env:SystemRoot\system32\sc.exe"
|
||||
return $False
|
||||
throw [System.IO.FileNotFoundException] "$env:SystemRoot\system32\sc.exe not found"
|
||||
}
|
||||
|
||||
$ServiceAccessFlags = @{
|
||||
|
|
@ -151,17 +150,14 @@ function Test-ServiceDaclPermission {
|
|||
|
||||
# make sure we got a result back
|
||||
if (-not ($TargetService)){
|
||||
Write-Warning "[!] Target service '$ServiceName' not found on the machine"
|
||||
return $False
|
||||
throw [System.Management.Instrumentation.InstanceNotFoundException] "Target service '$ServiceName' not found on the machine"
|
||||
}
|
||||
|
||||
try {
|
||||
# retrieve DACL from sc.exe
|
||||
# retrieve DACL from sc.exe (only possible if 'RC' DACL is set)
|
||||
$Result = sc.exe sdshow $TargetService.Name | where {$_}
|
||||
|
||||
if ($Result -like "*OpenService FAILED*"){
|
||||
Write-Warning "[!] Access to service $($TargetService.Name) denied"
|
||||
return $False
|
||||
throw [System.Management.Automation.ApplicationFailedException] "Could not retrieve DACL permissions for '$($TargetService.Name)'"
|
||||
}
|
||||
|
||||
$SecurityDescriptors = New-Object System.Security.AccessControl.RawSecurityDescriptor($Result)
|
||||
|
|
@ -208,11 +204,6 @@ function Test-ServiceDaclPermission {
|
|||
}
|
||||
}
|
||||
return $False
|
||||
}
|
||||
catch{
|
||||
Write-Warning "Error: $_"
|
||||
return $False
|
||||
}
|
||||
}
|
||||
|
||||
function Invoke-ServiceStart {
|
||||
|
|
@ -369,7 +360,7 @@ function Invoke-ServiceEnable {
|
|||
|
||||
try {
|
||||
# enable the service
|
||||
Write-Verbose "Enabling service '$TargetService.Name'"
|
||||
Write-Verbose "Enabling service '$($TargetService.Name)'"
|
||||
$Null = sc.exe config "$($TargetService.Name)" start= demand
|
||||
return $True
|
||||
}
|
||||
|
|
@ -417,7 +408,7 @@ function Invoke-ServiceDisable {
|
|||
|
||||
try {
|
||||
# disable the service
|
||||
Write-Verbose "Disabling service '$TargetService.Name'"
|
||||
Write-Verbose "Disabling service '$($TargetService.Name)'"
|
||||
$Null = sc.exe config "$($TargetService.Name)" start= disabled
|
||||
return $True
|
||||
}
|
||||
|
|
@ -458,11 +449,17 @@ function Get-ServiceUnquoted {
|
|||
|
||||
if ($VulnServices) {
|
||||
ForEach ($Service in $VulnServices){
|
||||
try {
|
||||
$CanRestart = Test-ServiceDaclPermission -ServiceName $Service.name -Dacl 'WPRP'
|
||||
} catch {
|
||||
$CanRestart = "Cannot be determined through DACL, try manually."
|
||||
}
|
||||
$Out = New-Object PSObject
|
||||
$Out | Add-Member Noteproperty 'ServiceName' $Service.name
|
||||
$Out | Add-Member Noteproperty 'Path' $Service.pathname
|
||||
$Out | Add-Member Noteproperty 'StartName' $Service.startname
|
||||
$Out | Add-Member Noteproperty 'AbuseFunction' "Write-ServiceBinary -ServiceName '$($Service.name)' -Path <HijackPath>"
|
||||
$Out | Add-Member Noteproperty 'CanRestart' $CanRestart
|
||||
$Out
|
||||
}
|
||||
}
|
||||
|
|
@ -492,12 +489,18 @@ function Get-ServiceFilePermission {
|
|||
$ServiceStartName = $_.startname
|
||||
|
||||
$ServicePath | Get-ModifiableFile | ForEach-Object {
|
||||
try {
|
||||
$CanRestart = Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WPRP'
|
||||
} catch {
|
||||
$CanRestart = "Cannot be determined through DACL, try manually."
|
||||
}
|
||||
$Out = New-Object PSObject
|
||||
$Out | Add-Member Noteproperty 'ServiceName' $ServiceName
|
||||
$Out | Add-Member Noteproperty 'Path' $ServicePath
|
||||
$Out | Add-Member Noteproperty 'ModifiableFile' $_
|
||||
$Out | Add-Member Noteproperty 'StartName' $ServiceStartName
|
||||
$Out | Add-Member Noteproperty 'AbuseFunction' "Install-ServiceBinary -ServiceName '$ServiceName'"
|
||||
$Out | Add-Member Noteproperty 'CanRestart' $CanRestart
|
||||
$Out
|
||||
}
|
||||
}
|
||||
|
|
@ -510,7 +513,7 @@ function Get-ServicePermission {
|
|||
|
||||
This function enumerates all available services and tries to
|
||||
open the service for modification, returning the service object
|
||||
if the process doesn't failed.
|
||||
if the process didn't fail.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
|
|
@ -541,11 +544,17 @@ function Get-ServicePermission {
|
|||
|
||||
# means the change was successful
|
||||
if ($Result -contains "[SC] ChangeServiceConfig SUCCESS"){
|
||||
try {
|
||||
$CanRestart = Test-ServiceDaclPermission -ServiceName $Service.name -Dacl 'WPRP'
|
||||
} catch {
|
||||
$CanRestart = "Cannot be determined through DACL, try manually."
|
||||
}
|
||||
$Out = New-Object PSObject
|
||||
$Out | Add-Member Noteproperty 'ServiceName' $Service.name
|
||||
$Out | Add-Member Noteproperty 'Path' $Service.pathname
|
||||
$Out | Add-Member Noteproperty 'StartName' $Service.startname
|
||||
$Out | Add-Member Noteproperty 'AbuseFunction' "Invoke-ServiceAbuse -ServiceName '$($Service.name)'"
|
||||
$Out | Add-Member Noteproperty 'CanRestart' $CanRestart
|
||||
$Out
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -74,6 +74,137 @@ Describe 'Get-ModifiableFile' {
|
|||
}
|
||||
}
|
||||
|
||||
Describe 'Test-ServiceDaclPermission' {
|
||||
|
||||
if(-not $(Test-IsAdmin)) {
|
||||
Throw "'Test-ServiceDaclPermission' Pester test needs local administrator privileges."
|
||||
}
|
||||
|
||||
It "Should fail finding 'sc.exe'." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
$DirectoryName = Get-RandomName
|
||||
$env:SystemRoot = 'C:\\' + $DirectoryName
|
||||
{ Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "sc.exe not found"
|
||||
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
$env:SystemRoot = 'C:\Windows'
|
||||
}
|
||||
|
||||
It "Should succeed finding 'sc.exe'." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
$DirectoryName = Get-RandomName
|
||||
New-Item -Path $env:Temp -Name "$DirectoryName\System32" -ItemType Directory
|
||||
New-Item -Path $env:Temp -Name "$DirectoryName\System32\sc.exe" -ItemType File
|
||||
$env:SystemRoot = $env:Temp + "\$DirectoryName"
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
|
||||
|
||||
Remove-Item -Recurse -Force "$env:Temp\$DirectoryName"
|
||||
$env:SystemRoot = 'C:\Windows'
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
It "Should fail querying WMI for a non-existent service." {
|
||||
$ServiceName = Get-RandomName
|
||||
{ Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
|
||||
}
|
||||
|
||||
It "Should succeed querying WMI for an existenting service." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
It "Should fail querying WMI for an existing service due to insufficient DACL permissions." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
$UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
|
||||
{ Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
It "Should succeed querying WMI for an existing service due to sufficient DACL permissions." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
$UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
It "Should fail running 'sc.exe sdshow' due to insufficient permissions." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
$UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDWDWO;;;$UserSid)" | Should Match "SUCCESS"
|
||||
{ Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "Could not retrieve DACL permissions"
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
It "Should succeed running 'sc.exe sdshow' due to sufficient permissions." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
$UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
it "Should fail finding the service DACL value of 'WP' for the current user." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $False
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
|
||||
it "Should succeed finding the service DACL value of 'WP' for the current user." {
|
||||
$ServiceName = Get-RandomName
|
||||
$ServicePath = "C:\Program Files\service.exe"
|
||||
|
||||
sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
|
||||
Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $True
|
||||
sc.exe delete $ServiceName | Should Match "SUCCESS"
|
||||
}
|
||||
}
|
||||
|
||||
########################################################
|
||||
#
|
||||
|
|
|
|||
Loading…
Reference in New Issue