Ability to run as a windows service

[ChrisPritchard]

In a few 'engagements' I have needed to replace a windows service binary to hijack the account running the service. reverse_ssh golang clients compiled for windows do not respond to the start/status requests made by the windows service system, so do not start properly and are quickly killed.

To get around this, I have built basic .NET windows service projects that simply call the reverse_ssh binary on start, but this is a bit annoying.

The x/sys golang library suports creating windows services - this issue proposes that this functionality be built into the windows client build so that the windows client can serve both as a standalone executable and a windows service as needed - there is a .IsWindowsService method in this library that should be able to change the operating mode based on context

[ChrisPritchard]

Existing state of this shamblesdelightful example of a project:

[NHAS]

The project already uses what you describe to determine if its in a windows service.

[NHAS]

Whats missing seems to be the start command

[ChrisPritchard]

Oh. Alright ill tweak that and test it

[NHAS]

For some additional info, rssh can install itself as a service, and I have used it there. So Im not sure what the issue is here.

[ChrisPritchard]

The issue is described in the original comment, where you are hijacking an existing service to assume its identity. That is, for example, you have write access over a binary or a binary's location used by a service that isn't presently running or you can stop and start. You replace the binary then start the service - at present this will fail with the message in the prior screenshot.

[NHAS]

Hm, thanks.

I think it may be due to this: golang/go#44921

As I cant spot anything that would make rssh unable to communicate as a service otherwise

[ChrisPritchard]

Hmm okay. Ill do some testing - see if it functions properly with a low privilege service

[NHAS]

Please try with the unstable branch, I've just bumped the modules

[ChrisPritchard]

Just tried and it starts fine now, ta. Working well with nt authority\system coming through for a service run as LocalSystem. However, it won't stop properly:

Somewhat debatable if this is an issue - a service that won't stop is possibly suspicious, but stopping a rssh client is not really what you want anyway

[ChrisPritchard]

It can still be stopped by killing the client from the rssh catcher interface. I'm fine to close this issue, ta.

[NHAS]

Ah yes, actually thats a bug funny enough. The break statement is breaking the switch rather than the outer for loop

[NHAS]

This change is now on unstable