Add structs/def/funcs + Service.start()

TODO

@@ -37,16 +37,11 @@ TODO:
     - registry
         - test !
 
-    - Clean pe_parse.py
-
     - wintrust doc:
         add : https://blogs.msdn.microsoft.com/winsdk/2016/01/05/why-cryptcatadmincalchashfromfilehandle-fails-with-a-seemingly-unexpected-error-code/
 
 Documentation
     * verif samples
 
-FIXME:
-    - Push("[ECX]") in simple_x64 as a "H" rex and i think it should not..
-
 RESSOURCE
     * read http://www.codeproject.com/Articles/18975/Listing-Used-Files

ctypes_generation/definitions/windef.txt

@@ -1066,3 +1066,11 @@
 #define ALPC_CANCELFLG_TRY_CANCEL 0x1
 #define ALPC_CANCELFLG_NO_CONTEXT_CHECK 0x8
 #define ALPC_CANCELFLGP_FLUSH 0x10000
+
+
+#define OWNER_SECURITY_INFORMATION       (0x00000001L)
+#define GROUP_SECURITY_INFORMATION       (0x00000002L)
+#define DACL_SECURITY_INFORMATION        (0x00000004L)
+#define SACL_SECURITY_INFORMATION        (0x00000008L)
+#define LABEL_SECURITY_INFORMATION       (0x00000010L)
+#define MAXIMUM_ALLOWED                  (0x02000000L)

ctypes_generation/definitions/winfunc.txt

@@ -1065,6 +1065,10 @@ SC_HANDLE WINAPI OpenSCManagerW(
     __in            DWORD                   dwDesiredAccess
 );
 
+BOOL WINAPI CloseServiceHandle(
+  _In_ SC_HANDLE hSCObject
+);
+
 BOOL WINAPI EnumServicesStatusExA(
     __in            SC_HANDLE               hSCManager,
     __in            SC_ENUM_TYPE            InfoLevel,
@@ -1092,6 +1096,33 @@ BOOL WINAPI EnumServicesStatusExW(
     __in_opt        LPCWSTR                pszGroupName
     );
 
+
+BOOL WINAPI StartServiceA(
+  _In_     SC_HANDLE hService,
+  _In_     DWORD     dwNumServiceArgs,
+  _In_opt_ LPCSTR   *lpServiceArgVectors
+);
+
+BOOL WINAPI StartServiceW(
+  _In_     SC_HANDLE hService,
+  _In_     DWORD     dwNumServiceArgs,
+  _In_opt_ LPCWSTR   *lpServiceArgVectors
+);
+
+SC_HANDLE WINAPI OpenServiceA(
+  _In_ SC_HANDLE hSCManager,
+  _In_ LPCSTR   lpServiceName,
+  _In_ DWORD     dwDesiredAccess
+);
+
+
+SC_HANDLE WINAPI OpenServiceW(
+  _In_ SC_HANDLE hSCManager,
+  _In_ LPCWSTR   lpServiceName,
+  _In_ DWORD     dwDesiredAccess
+);
+
+
 BOOL WINAPI EnumWindows(
     __in WNDENUMPROC lpEnumFunc,
     __in LPARAM lParam

ctypes_generation/definitions/winstruct.txt

@@ -761,7 +761,7 @@ typedef struct _LDR_DATA_TABLE_ENTRY {
     PVOID Reserved2[2];
     PVOID DllBase;
     PVOID EntryPoint;
-    PVOID Reserved3;
+    PVOID SizeOfImage;
     UNICODE_STRING FullDllName;
     UNICODE_STRING BaseDllName;
     PVOID Reserved5[3];

windows/generated_def/windef.py

@@ -983,6 +983,12 @@ ALPC_MSGFLG_WOW64_CALL = make_flag("ALPC_MSGFLG_WOW64_CALL", 0x80000000)
 ALPC_CANCELFLG_TRY_CANCEL = make_flag("ALPC_CANCELFLG_TRY_CANCEL", 0x1)
 ALPC_CANCELFLG_NO_CONTEXT_CHECK = make_flag("ALPC_CANCELFLG_NO_CONTEXT_CHECK", 0x8)
 ALPC_CANCELFLGP_FLUSH = make_flag("ALPC_CANCELFLGP_FLUSH", 0x10000)
+OWNER_SECURITY_INFORMATION = make_flag("OWNER_SECURITY_INFORMATION", ( 0x00000001 ))
+GROUP_SECURITY_INFORMATION = make_flag("GROUP_SECURITY_INFORMATION", ( 0x00000002 ))
+DACL_SECURITY_INFORMATION = make_flag("DACL_SECURITY_INFORMATION", ( 0x00000004 ))
+SACL_SECURITY_INFORMATION = make_flag("SACL_SECURITY_INFORMATION", ( 0x00000008 ))
+LABEL_SECURITY_INFORMATION = make_flag("LABEL_SECURITY_INFORMATION", ( 0x00000010 ))
+MAXIMUM_ALLOWED = make_flag("MAXIMUM_ALLOWED", ( 0x02000000 ))
 CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
 CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
 CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)

windows/generated_def/winstructs.py

@@ -1115,7 +1115,7 @@ class _LDR_DATA_TABLE_ENTRY(Structure):
         ("Reserved2", PVOID * 2),
         ("DllBase", PVOID),
         ("EntryPoint", PVOID),
-        ("Reserved3", PVOID),
+        ("SizeOfImage", PVOID),
         ("FullDllName", UNICODE_STRING),
         ("BaseDllName", UNICODE_STRING),
         ("Reserved5", PVOID * 3),

windows/winobject/service.py

@@ -2,6 +2,7 @@ import ctypes
 import windows
 
 from collections import namedtuple
+from contextlib import contextmanager
 
 from windows import utils
 from windows.generated_def import *
@@ -41,8 +42,10 @@ ServiceStatus = namedtuple("ServiceStatus", ["type", "state", "control_accepted"
 """
 
 class Service(object):
+    handle = None
+
     def __repr__(self):
-        return '<{0} "{1}">'.format(type(self).__name__, self.name)
+        return '<{0} "{1}" {2}>'.format(type(self).__name__, self.name, self.status.state)
 
     @utils.fixedpropety
     def name(self):
@@ -90,16 +93,34 @@ class Service(object):
 
 class ServiceA(Service, ENUM_SERVICE_STATUS_PROCESSA):
     """A Service object with ascii data"""
-    pass
+    def start(self, args=None):
+        if args is not None:
+            raise NotImplementedError("Start service with args != None")
+        with scmanagera(SC_MANAGER_CONNECT) as scm:
+            # windows.winproxy.StartServiceA()
+            servh = windows.winproxy.OpenServiceA(scm, self.name, SERVICE_START)
+            windows.winproxy.StartServiceA(servh, 0, None)
+            windows.winproxy.CloseServiceHandle(servh)
+
+
+@contextmanager
+def scmanagera(access):
+    # scmanager = windows.winproxy.OpenSCManagerA(dwDesiredAccess=SC_MANAGER_ENUMERATE_SERVICE)
+    scmanager = windows.winproxy.OpenSCManagerA(dwDesiredAccess=access)
+    try:
+        yield scmanager
+    finally:
+        windows.winproxy.CloseServiceHandle(scmanager)
 
 def enumerate_services():
+    # TODO: fix this so we don't have a scmanager leak..
     scmanager = windows.winproxy.OpenSCManagerA(dwDesiredAccess=SC_MANAGER_ENUMERATE_SERVICE)
 
     size_needed = DWORD()
     nb_services = DWORD()
     counter = DWORD()
     try:
-        windows.winproxy.EnumServicesStatusExA(scmanager, SC_ENUM_PROCESS_INFO, SERVICE_TYPE_ALL, SERVICE_ACTIVE, None, 0, ctypes.byref(size_needed), ctypes.byref(nb_services), byref(counter), None)
+        windows.winproxy.EnumServicesStatusExA(scmanager, SC_ENUM_PROCESS_INFO, SERVICE_TYPE_ALL, SERVICE_STATE_ALL, None, 0, ctypes.byref(size_needed), ctypes.byref(nb_services), byref(counter), None)
     except WindowsError:
         pass
 
@@ -108,7 +129,7 @@ def enumerate_services():
         buffer = (BYTE * size)()
 
         try:
-            windows.winproxy.EnumServicesStatusExA(scmanager, SC_ENUM_PROCESS_INFO, SERVICE_TYPE_ALL, SERVICE_ACTIVE, buffer, size, ctypes.byref(size_needed), ctypes.byref(nb_services), byref(counter), None)
+            windows.winproxy.EnumServicesStatusExA(scmanager, SC_ENUM_PROCESS_INFO, SERVICE_TYPE_ALL, SERVICE_STATE_ALL, buffer, size, ctypes.byref(size_needed), ctypes.byref(nb_services), byref(counter), None)
         except WindowsError as e:
             continue
 

windows/winproxy.py

@@ -1023,6 +1023,31 @@ def EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState,
 def EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName):
     return EnumServicesStatusExW.ctypes_function(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName)
 
+
+@Advapi32Proxy('StartServiceA')
+def StartServiceA(hService, dwNumServiceArgs, lpServiceArgVectors):
+    return StartServiceA.ctypes_function(hService, dwNumServiceArgs, lpServiceArgVectors)
+
+
+@Advapi32Proxy('StartServiceW')
+def StartServiceW(hService, dwNumServiceArgs, lpServiceArgVectors):
+    return StartServiceW.ctypes_function(hService, dwNumServiceArgs, lpServiceArgVectors)
+
+
+@Advapi32Proxy('OpenServiceA')
+def OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess):
+    return OpenServiceA.ctypes_function(hSCManager, lpServiceName, dwDesiredAccess)
+
+
+@Advapi32Proxy('OpenServiceW')
+def OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess):
+    return OpenServiceW.ctypes_function(hSCManager, lpServiceName, dwDesiredAccess)
+
+
+@Advapi32Proxy('CloseServiceHandle')
+def CloseServiceHandle(hSCObject):
+    return CloseServiceHandle.ctypes_function(hSCObject)
+
 # Create process stuff
 
 @Advapi32Proxy('CreateProcessAsUserA')