Impacket services.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Uses Service Control Manager RPC to list services, check status, create or reconfigure services, and start, stop, or delete them.
| Item | Details |
|---|---|
| Implementation | examples/services.py |
| Category | Remote execution / WMI / services |
| Size | 353 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/services.py -h for the current option definitions.
Subcommands: start, stop, delete, status, config, list, create, change
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-debug | Enable debug output |
-ts | Add a timestamp to each log message |
-name | Service name; required |
-display | Display name; required |
-path | Binary path; required |
-service_type | Service type |
-start_type | Service start type |
-start_name | Name of the account under which the service runs |
-password | Password for the account specified by -start_name |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
-port | Destination SMB server port (choices: 139, 445; default: 445) |
Detailed processing flow
Section titled “Detailed processing flow”The tool binds to SCMR through an SMB/RPC transport and opens a manager handle. Depending on the subcommand, it opens a service handle, queries status, sends control codes, or creates or changes configuration. It displays the result and closes each handle.
How it works
Section titled “How it works”A Windows service has an entry in the Service Control Manager database and a current execution state. This command binds to SCMR and opens a manager handle, then a service handle for actions that need one. Start and stop change state; create, delete, and change modify the database; status, config, and list only read it.
start passes an argument array in a service start request, while stop sends
a control code. Acceptance of a request does not mean the service has reached
its final state, so interpret pending, running, and stopped status fields. create
and change convert service type, start type, account, and binary path to RPC
enums and Unicode fields.
The service account password must be encrypted in a protocol-specific form with the RPC session key rather than placed as plaintext directly in a structure. Access masks on handles can be minimized by action. Handle list pagination, services that already exist or were deleted, and stop failures caused by dependent services separately.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
SVCCTL | 38 | __init__(), run(), doStuff() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket | version |
impacket.dcerpc.v5 | scmr, transport |
impacket.dcerpc.v5.ndr | NULL |
impacket.crypto | encryptSecret |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Some operations change the target’s state. Check the target name, SID, and path before making changes.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on dcerpc.v5.scmr, transport, NDR NULL, and encryptSecret for service passwords. SVCCTL.run() and doStuff() handle dispatch and protocol operations. Converting service and start types from CLI values to RPC constants is the main extension point.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/services.py - CLI:
python examples/services.py -h - Related test:
tests/SMB_RPC/test_ndr.py - Related test:
tests/misc/test_crypto.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py - Related test:
tests/misc/test_krb5_crypto.py