Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

Full Version: Writing An Nt Service
White Scorpion
Hi all,

i'm trying to write a service for NT which will start explorer.exe but i can't get the service to start sad.gif

i've read through several sources from services, but i still can't figure out what i'm doing wrong .....


any ideas?:
CODE

.686
.model flat,stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\advapi32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\advapi32.lib

ServiceControlHandler   PROTO :DWORD
MyFunction              PROTO
ServiceMain             PROTO
.DATA
explorer        db "explorer",0
backslash       db "\",0
AppName         db "Test",0


.DATA?
startinfo       STARTUPINFO         <>
secat           SECURITY_ATTRIBUTES <>
procinfo        PROCESS_INFORMATION <>
ServStat        SERVICE_STATUS      <>
ServTable       SERVICE_TABLE_ENTRY <>
hServStat       DWORD ?
stopServiceEvent DWORD ?
explorerbuf     db 512 dup (?)

.CODE
start:
mov ServTable.lpServiceName,offset AppName
mov ServTable.lpServiceProc,offset ServiceMain

invoke StartServiceCtrlDispatcher,addr ServTable
.IF eax==NULL
   invoke GetLastError
   .IF eax==ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
   invoke MyFunction
   .ENDIF
.ELSE
   invoke ServiceMain
.ENDIF
invoke ExitProcess,0

ServiceMain PROC

mov ServStat.dwServiceType,SERVICE_WIN32
mov ServStat.dwCurrentState,SERVICE_STOPPED
mov ServStat.dwControlsAccepted,0
mov ServStat.dwWin32ExitCode,NO_ERROR
mov ServStat.dwServiceSpecificExitCode,NO_ERROR
mov ServStat.dwCheckPoint,0
mov ServStat.dwWaitHint,0

invoke RegisterServiceCtrlHandler,addr AppName,addr ServiceControlHandler
mov hServStat,eax
.IF eax!=NULL
      mov ServStat.dwCurrentState,SERVICE_START_PENDING
      invoke SetServiceStatus,hServStat,addr ServStat

      invoke CreateEvent,0,FALSE,FALSE,0
      mov stopServiceEvent,eax

      mov ServStat.dwControlsAccepted,SERVICE_ACCEPT_STOP+SERVICE_ACCEPT_SHUTDOWN
      mov ServStat.dwCurrentState,SERVICE_RUNNING
      invoke SetServiceStatus,hServStat,addr ServStat

      invoke MyFunction

      mov ServStat.dwCurrentState,SERVICE_STOP_PENDING
      invoke SetServiceStatus,hServStat,addr ServStat

      invoke CloseHandle,stopServiceEvent
      mov stopServiceEvent,0

      mov ServStat.dwControlsAccepted,SERVICE_ACCEPT_STOP+SERVICE_ACCEPT_SHUTDOWN
      mov ServStat.dwCurrentState,SERVICE_STOPPED
      invoke SetServiceStatus,hServStat,addr ServStat
.ENDIF
ret
 
ServiceMain ENDP

;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
;The procedure to handle the service controls
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ServiceControlHandler PROC controlcode:DWORD

.IF controlcode==SERVICE_CONTROL_INTERROGATE
   jmp next
.ELSEIF controlcode==SERVICE_CONTROL_SHUTDOWN || controlcode==SERVICE_CONTROL_STOP
   mov ServStat.dwCurrentState,SERVICE_STOP_PENDING
   invoke SetServiceStatus,addr hServStat,addr ServStat
   invoke SetEvent,addr stopServiceEvent
   ret
.ELSEIF controlcode==SERVICE_CONTROL_PAUSE
   jmp next
.ELSEIF controlcode==SERVICE_CONTROL_CONTINUE
   jmp next
.ENDIF
next:
invoke SetServiceStatus,hServStat,addr ServStat
ret

ServiceControlHandler ENDP                

;-----------------------------------------------------
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
;My function
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MyFunction PROC

invoke GetWindowsDirectory,addr explorerbuf,sizeof explorerbuf
invoke lstrcat,addr explorerbuf,addr backslash
invoke lstrcat,addr explorerbuf,addr explorer

mov secat.nLength,sizeof SECURITY_ATTRIBUTES
mov secat.bInheritHandle,TRUE

invoke GetStartupInfo,addr startinfo
mov startinfo.dwFlags,STARTF_USESHOWWINDOW

invoke CreateProcess,NULL,addr explorerbuf,NULL,NULL,TRUE,\
CREATE_NEW_CONSOLE,NULL,NULL,addr startinfo,addr procinfo

invoke Sleep,500
ret
MyFunction ENDP
;-----------------------------------------------------
end start

illwill
OpenSCManager & CreateService
White Scorpion
Yep, but those aren't needed in the service itself... I have written an "installer", but since that works like it should, i don't have to focus on that....

illwill
oh basically u need your app to interact with servicemanager for stop pause start etc
White Scorpion
yeah i know ;-)) but as you can see above it won't really work sad.gif
Mr_X
I have the same problem as White_scorpion.
I had a service program that i wrote in C. It works fine
But when i translate it in assembly, it doesn't work anymore, I got
CODE

Le service ne répond pas à la fonction de maintenance.

In cas you want to know what it means, type "NET HELPMSG 2186"
Mr_X
double posted (due to browser error), deleted
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.