diff --git a/lib/msf/core/post/windows/services.rb b/lib/msf/core/post/windows/services.rb index 3a6490cd42..498437abea 100644 --- a/lib/msf/core/post/windows/services.rb +++ b/lib/msf/core/post/windows/services.rb @@ -146,7 +146,7 @@ module WindowsServices # Returns 0 if service is stopped successfully, 1 if service is already # stopped or disabled and 2 if the service can not be stopped. # - def service_stop(name) + def service_stop(name, server=nil) machine_str = server ? "\\\\#{server}" : nil adv = session.railgun.advapi32 manag = adv.OpenSCManagerA(machine_str,nil,1) @@ -172,22 +172,33 @@ module WindowsServices end # - # Delete a service by deleting the key in the registry. + # Delete a service. # - def service_delete(name) - begin - basekey = "HKLM\\SYSTEM\\CurrentControlSet\\Services" - if registry_enumkeys(basekey).index(name) - servicekey = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\#{name.chomp}" - registry_deletekey(servicekey) - return true - else - return false - end - rescue::Exception => e - print_error(e) - return false + def service_delete(name, server=nil) + machine_str = server ? "\\\\#{server}" : nil + adv = session.railgun.advapi32 + + # #define SC_MANAGER_ALL_ACCESS 0xF003F + manag = adv.OpenSCManagerA(machine_str,nil,0xF003F) + if (manag["return"] == 0) + raise "Could not open Service Control Manager, Access Denied" end + + # Now to grab a handle to the service. + # Thank, you Wine project for defining the DELETE constant since it, + # and all its friends, are missing from the MSDN docs. + # #define DELETE 0x00010000 + servhandleret = adv.OpenServiceA(manag["return"],name,0x10000) + if (servhandleret["return"] == 0) + adv.CloseServiceHandle(manag["return"]) + raise "Could not Open Service, Access Denied" + end + + # Lastly, delete it + adv.DeleteService(servhandleret["return"]) + + adv.CloseServiceHandle(manag["return"]) + adv.CloseServiceHandle(servhandleret["return"]) end end