AgentSmithers
October 15th, 2009, 05:58 PM
I was taking a look at PSEXEC and I saw that it uses CreateService API to create a service remotely and execute the list of exe's that are sent to it, But is that the only way you can have a machine exec binarys without loading a serivce at API level?
Is their a Execute API for remote machines that support even the oldest OS's?
I HAVE ADMIN PREV ON THE MACHINE ( Username And Password )
This is C++ but only not completly relevent to the question
// Installs and starts the remote service on remote machine
BOOL InstallAndStartRemoteService()
{
// Open remote Service Manager
SC_HANDLE hSCM = ::OpenSCManager( lpszMachine, NULL, SC_MANAGER_ALL_ACCESS);
if (hSCM == NULL)
return FALSE;
// Maybe it's already there and installed, let's try to run
SC_HANDLE hService =::OpenService( hSCM, SERVICENAME, SERVICE_ALL_ACCESS );
// Creates service on remote machine, if it's not installed yet
if ( hService == NULL )
hService = ::CreateService(
hSCM, SERVICENAME, LONGSERVICENAME,
SERVICE_ALL_ACCESS,
SERVICE_WIN32_OWN_PROCESS,
SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
_T("%SystemRoot%\\system32\\")RemComSVCEXE,
NULL, NULL, NULL, NULL, NULL );
if (hService == NULL)
{
::CloseServiceHandle(hSCM);
return FALSE;
}
// Start service
if ( !StartService( hService, 0, NULL ) )
return FALSE;
::CloseServiceHandle(hService);
::CloseServiceHandle(hSCM);
return TRUE;
}
Is their a Execute API for remote machines that support even the oldest OS's?
I HAVE ADMIN PREV ON THE MACHINE ( Username And Password )
This is C++ but only not completly relevent to the question
// Installs and starts the remote service on remote machine
BOOL InstallAndStartRemoteService()
{
// Open remote Service Manager
SC_HANDLE hSCM = ::OpenSCManager( lpszMachine, NULL, SC_MANAGER_ALL_ACCESS);
if (hSCM == NULL)
return FALSE;
// Maybe it's already there and installed, let's try to run
SC_HANDLE hService =::OpenService( hSCM, SERVICENAME, SERVICE_ALL_ACCESS );
// Creates service on remote machine, if it's not installed yet
if ( hService == NULL )
hService = ::CreateService(
hSCM, SERVICENAME, LONGSERVICENAME,
SERVICE_ALL_ACCESS,
SERVICE_WIN32_OWN_PROCESS,
SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
_T("%SystemRoot%\\system32\\")RemComSVCEXE,
NULL, NULL, NULL, NULL, NULL );
if (hService == NULL)
{
::CloseServiceHandle(hSCM);
return FALSE;
}
// Start service
if ( !StartService( hService, 0, NULL ) )
return FALSE;
::CloseServiceHandle(hService);
::CloseServiceHandle(hSCM);
return TRUE;
}