HackTool.Python.Impacket.SVC

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Information Theft

This Hacking Tool does not have any information-stealing capability.

Other Details

This Hacking Tool does the following:

• Operates as a core lateral movement helper library within the open-source Impacket framework, utilized by tools such as psexec and smbrelayx to deploy and manage remote Win32 services over SMB and MSRPC.
• Validates whether the active SMB session is authenticated as a Guest account; if so, aborts execution to prevent access denial.
• Scans enumerated network shares to identify a writable share (prioritizing ADMIN$ or root administrative shares like C$) by attempting to create and remove temporary directory objects.
• Uploads the designated binary payload (exeFile) to the identified writable share via SMB write operations (copy_file).
• Calls hROpenSCManagerW to open the target machine's Service Control Manager with administrative privileges.
• Queries whether a service with the target name already exists via hROpenServiceW; if found, removes it via hRDeleteService to prevent conflicts.
• Creates a new demand-start Win32 service via hRCreateServiceW (dwStartType=SERVICE_DEMAND_START), configuring the service binary path to %systemroot%\ (if ADMIN$ was selected) or \\\.
• Starts the registered service using hRStartServiceW, triggering execution of the payload with NT AUTHORITY\SYSTEM privileges.
• Implements an automated uninstall() method that connects to the Service Control Manager, issues hRControlService(SERVICE_CONTROL_STOP) to halt the service process, deletes the service definition via hRDeleteService, and deletes the uploaded binary from the remote share via deleteFile.
• Connects to the MSRPC Server Service (srvsvc) interface using hNetrShareEnum (Level 1) to enumerate all shared network resources on the remote host.
• Binds to the MSRPC Service Control Manager (svcctl) interface over the named pipe \pipe\svcctl.

It accepts the following parameters:

• SMBObject {Object} → used to specify an active authenticated SMB or SMB3 connection object
• binary_service_name {String} → used to define the remote executable file name (defaults to a randomized 8-character alphanumeric string appended with '.exe')
• exeFile {String / Binary Stream} → used to designate the local executable binary payload or file-like object to upload and execute on the target host
• serviceName {String} → used to designate the target Windows service name (defaults to a randomized 4-character alphanumeric string)

It does not exploit any vulnerability.