rapid7/metasploit-framework — pull request #903 by agix (2012-10-14 09:34:21+00:00)
Title: added services_payload + psexec patch + asm shellcode service

refer to http://dev.metasploit.com/redmine/issues/7231

In psexec, exe is generated by "generate_payload_exe_service" which uses a template that all the AVs know.
The purpose of this stagers is to add the "service" functions to the payload so you can use "generate_payload_exe" instead of "generate_payload_exe_service".
Used with https://dev.metasploit.com/redmine/issues/7156 exe-only, you can bypass a lot of AVs at the moment ;).
To run and to keep running, a service must change his status from START_PENDING to RUNNING.
Here is how the shellcode does :
It first loads advapi32.dll
it constructs a ServiceTableEntry with the ServiceName randomly generated by psexec. And a pointer on ScvMain.
It then calls StartServiceCtrlDispatcherA with the ServiceTableEnry before calling ExitProcess.
The service controller will now load ScvMain
This functions must call RegisterServiceCtrlHandlerExA with the ServiceName and a pointer on a SvcCtrlHandler.
(SvcCtrlHandler just return NO_ERROR all the time)
The shellcode can pass in RUNNING status by calling SetServiceStatus function on the Handler returned by RegisterServiceCtrlHandlerExA with a SERVICE_STATUS structure with dwCurrentState = SERVICE_RUNNING.
It can now do the reverse_tcp stuff or bind_tcp...