[FEATURE] Service Enumeration

[hydr0nium]

The original evil-winrm has a services feature to list all services, their binpath and if the user has some privileges over that service. Maybe we / you can implement this feature. Maybe we can discuss the implementation here. Happy to help

[adityatelange]

Sure, let's do it. Should be just a command with some filtering done.

[hydr0nium]

I'll try yo figure out how the original does it, so we can stick to that

[hydr0nium]

This is the ruby code from the original evil-winrm:

# [...]
elsif command.start_with?('services')
command = ''
output = shell.run('$servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\*" | Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath  ; foreach ($servicio in $servicios  ) {Get-Service $servicio.PSChildName -ErrorAction SilentlyContinue | Out-Null ; if ($? -eq $true) {$privs = $true} else {$privs = $false} ; $Servicios_object = New-Object psobject -Property @{"Service" = $servicio.pschildname ; "Path" = $servicio.imagepath ; "Privileges" = $privs} ;  $Servicios_object }')
print(output.output.chomp)
$logger&.info(output.output.chomp)
# [...]

Basically the code just runs a powershell command and then prints the output

I will break down the command a little so we are all on the same boat:

$servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\*"
# This gets all the Services including their binpath.

Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null }
# Filters out services with no binpath and system services

Select-Object pschildname,imagepath
# This just selects the name of the service and the binpath

foreach ($servicio in $servicios  ) {
      # [...]
}
# This just goes over each service

The next parts are all in the foreach loop:

Get-Service $servicio.PSChildName -ErrorAction SilentlyContinue | Out-Null
# This just gets the actual service and continues on an error without printing it

 if ($? -eq $true) {$privs = $true} else {$privs = $false}
# Checks if the last command was successfull, thus we can read it's properties

I actually believe the name "Privileges" in the next part is a bit misleading because it just checks if you can get the service object. From the official documentation of Get-Service:

This cmdlet can display services only when the current user has permission to see them. If this cmdlet does not display services, you might not have permission to see them.

Thus I am not sure why they chose to call it privileges. Maybe someone has some input on this?

$Servicios_object = New-Object psobject -Property @{
     "Service" = $servicio.pschildname ;
     "Path" = $servicio.imagepath ;
     "Privileges" = $privs
} ;
$Servicios_object 
# This just formats everything to a new powershell object for printing it in a nice way. Then it prints out the object.

Anyway I hope everyone understands now how this works. I would probably implement it the same and make a PR.

Anyone, anything to add?

[hydr0nium]

Ok I also just looked through the codebase of this project and I think we should also use a switch statement in the interactive_shell function. If we switch over each comamnd, then this will make it more expandable in the future. Maybe we can also somehow improve "code repetition". If I see it correctly if we add a command we need to change 3 parts:

1. Add code to handle the command in the interactive_shell function
2. Add command to MENU_COMMANDS const
3. Add command to show_menu function

Maybe we can combine these 3 into one or two so we just need to add the command into MENU_COMMANDS and add a handler function for it

Maybe something in the lines of

# [...]
MENU_COMMANDS = {
    'menu': menu_handler
}
# [...]

if command in MENU_COMMANDS:
    handler = MENU_COMMANDS[command]
    handler()

We could also add the description field like this:

# [...]
MENU_COMMANDS = {
    'menu': (menu_handler, 'This is some command description')
}
# [...]

if command in MENU_COMMANDS:
    handler, _ = MENU_COMMANDS[command]
    handler()

[adityatelange]

I'll try yo figure out how the original does it, so we can stick to that

we need not stick to that. none of the code is copied in this project nor are the commands.

[adityatelange]

we'll make something better of our own or if the one they made is the best we'll stick to it.

[adityatelange]

Maybe we can combine these 3 into one or two so we just need to add the command into MENU_COMMANDS and add a handler function for it

Better will be that we stick to one feature at a time and avoid refactoring other parts.

[hydr0nium]

Better will be that we stick to one feature at a time and avoid refactoring other parts.

Yeah ok that is fine for me.

we'll make something better of our own or if the one they made is the best we'll stick to it.

Ok nice. But I think the way they do it is pretty well done.

[hydr0nium]

Created a pull request draft (not ready for merge) to see if that implementation is ok like that and to get input on how we can fix the output issue. PR

[adityatelange]

Hi @hydr0nium, after some fiasco at my another project, I do not want to go ahead with the code which is used by Ruby version which is under GPL licence. I'll try to find a way to it or will just skip it. Apparently licensing is difficult to deal with.

[hydr0nium]

No worries. I understand that fully. There a probably a ton of other way to do it. I can look into it and change it aswell

[hydr0nium]

What do you think about this command. It "mimicks" the old one but puts "our" own touch on it. It also fixes the truncation issue I had and I removed the "Privileges" part as I personally see no use in it:

Get-WmiObject win32_service | Where {$_.PathName -notlike "*system*" -and $_.PathName -ne $NULL} | select @{Name='Service Name'; Expression={$_.Name}}, @{Name='Path'; Expression={$_.PathName}} | format-table -autosize -wrap

This retrieves the services by name and servicepath and removes all services that are either default services by removing anything in system32 or empty. Feel free to suggest changes to it

[adityatelange]

Registry Only is the most stealthy we can get.

• Registry Only > CIM > WMI > Get-Service.

Get-ItemProperty 'Registry::HKLM\System\CurrentControlSet\Services\*' -ErrorAction SilentlyContinue | Where-Object { $_.ImagePath -and ($_.ImagePath -notmatch 'system') } | Select-Object @{n='Service';e={$_.PSChildName}}, @{n='Path';e={$_.ImagePath}}

Get-CimInstance -ClassName Win32_Service | Select-Object Name, PathName, State

Get-WmiObject -Class Win32_Service | Select-Object Name, PathName

Get-Service