Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71468
Service Persistence (PSEDService_CF)
SECRET//NOFORN
OSB Library: Persistence
Module Name: PSEDService_CF (Constant Flow)
Module Description: This module installs the calling payload as a service and handles all appropriate Service Control Manager (SCM) interactions. The calling payload does not have to do anything additional to exist as a service. The calling payload simply calls PersistPayload and continues code execution flow as normal. The module can also persist a DLLDynamic Link Library payload if being called by RunDLL32
PSP/OS Issues: No known issues
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house
Notes:
- Can only persist payload calling module, not an external payload
- Relies on payload creating a Event to wait on so SCM can gracefully exit service upon payload completion
- If calling payload exists before Event is set, could result in SCM reporting improper stopping of service
- Must install persistence with a service name
Module Specific Structures:
struct ServiceInfo
{
WCHAR * wcServiceName; // The name of the service
DWORD dwOrdinal; // Ordinal to call, only used if isDLL is set to true
HANDLE hWaitEvent; // Event handle to be signaled and allow Service control handling to exit
BOOL isDLL; // true if payload is DLL, false otherwise
ServiceInfo() : wcServiceName(NULL), hWaitEvent(NULL), dwOrdinal(1), isDLL(FALSE){}
};Example Code:
PSEDService_CF scf;
// Create an event that we can signal for the service to die gracefully once we're done
HANDLE hWaitOn = CreateEvent(NULL, TRUE, FALSE, NULL);
// We MUST give the service a name!
ServiceInfo si;
si.wcServiceName = L"ServiceName";
si.hWaitEvent = hWaitOn;
// Persist payload
// First parameter (path normally) is ignored as calling payload is persisted as service.
// Thus we cannot use this module to persist an external payload
scf.PersistPayload(L"ignore me", &si);
// Remove payload, relies on service name we set earlier
scf.RemovePersistence(si.wcServiceName);SECRET//NOFORN