Scm
Provides functionality for interacting with the service control manager on a remote Windows system
Synopsis
Scm <subcommand>
Subcommands
| Command | Description |
|---|---|
| create | Creates and optionally starts a new service |
| delete | Deletes a service |
| qtriggers | Queries the status of a service |
| query | Queries the status of a service |
| start | Starts a service |
| stop | Stops a service |
For help on a subcommand, use Scm <subcommand> -h
Scm create
Creates and optionally starts a new service
Synopsis
Scm create [options] <ServerName> <ServiceName> [ <BinPath> ]
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with | |
| <ServiceName> | <String> | Name of service to create | |
| <BinPath> | <String> | Service command line |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -Dependencies | -deps | <String[]> | List of services this service depends on |
| -DisplayName | <String> | Service display name | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -ErrorControl | <ServiceErrorControl> | Error control | |
| Default: 1 | |||
| Possible values: | |||
| Ignore | |||
| Normal | |||
| Severe | |||
| Critical | |||
| -LoadOrderGroup | <String> | Load order group | |
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -ServiceType | <ServiceTypes> | Type of service | |
| Default: 16 | |||
| Possible values: | |||
| None | |||
| KernelDriver | |||
| FileSystemDriver | |||
| OwnProcess | |||
| SharedProcess | |||
| All | |||
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override | |
| -Start | <SwitchParam> | Start the service once created | |
| -StartName | <String> | Name of user account to run service as | |
| Default: LocalSystem | |||
| -StartPassword | <String> | Password of service account | |
| -StartType | <ServiceStartType> | Service start type | |
| Default: 3 | |||
| Possible values: | |||
| Boot | |||
| System | |||
| Auto | |||
| Demand | |||
| Disabled | |||
| -Tag | <Int32> | Unique tag within the load order group | |
| Default: 0 |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Examples
Example 1 - Create and start a service
Scm create LUMON-DC1 -UserName milchick -Password Br3@kr00m! -EncryptRpc myservice -DisplayName "My Service" C:\windows\system32\cmd.exe -Start
Scm delete
Deletes a service
Synopsis
Scm delete [options] <ServerName> <ServiceName>
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with | |
| <ServiceName> | <String> | Name of the service |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Examples
Example 1 - Delete a service
Scm delete LUMON-DC1 -UserName milchick -Password Br3@kr00m! myservice
Scm qtriggers
Queries the status of a service
Synopsis
Scm qtriggers [options] <ServerName> <ServiceName>
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with | |
| <ServiceName> | <String[]> | Names of services to query (* for all) |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -OutputFields | <String[]> | Fields to display in output | |
| Possible values: | |||
| ServiceName | |||
| TriggerType | |||
| TriggerTypeDescription | |||
| Action | |||
| Data0 | |||
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Scm query
Queries the status of a service
Synopsis
Scm query [options] <ServerName>
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -OutputFields | <String[]> | Fields to display in output | |
| Possible values: | |||
| ServiceName | |||
| DisplayName | |||
| ServiceType | |||
| State | |||
| Win32ExitCode | |||
| SpecificExitCode | |||
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override | |
| -States | <ServiceStates[]> | Filter by service state | |
| Possible values: | |||
| None | |||
| Active | |||
| Inactive | |||
| All | |||
| -Types | <ServiceTypes[]> | Filter by service type | |
| Possible values: | |||
| None | |||
| KernelDriver | |||
| FileSystemDriver | |||
| OwnProcess | |||
| SharedProcess | |||
| All |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Examples
Example 1 - Query all services (NTLM)
Scm query lumon-fs1 -UserName milchick@LUMON -Password Br3@kr00m!
Example 2 - Query all services (Kerberos)
Scm query lumon-fs1 -UserName milchick@LUMON -Password Br3@kr00m! -Kdc LUMON-DC1
Scm start
Starts a service
Synopsis
Scm start [options] <ServerName> <ServiceName> [ <ServiceArgs> ]
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with | |
| <ServiceName> | <String> | Name of the service | |
| <ServiceArgs> | <String[]> | Optional arguments to pass to service |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Examples
Example 1 - Start a service
Scm start LUMON-DC1 -UserName milchick -Password Br3@kr00m! -EncryptRpc myservice
Example 2 - Start a service with arguments
Scm start LUMON-DC1 -UserName milchick -Password Br3@kr00m! -EncryptRpc myservice arg1 arg2 arg3
Scm stop
Stops a service
Synopsis
Scm stop [options] <ServerName> <ServiceName>
Parameters
| Name | Aliases | Value | Description |
|---|---|---|---|
| <ServerName> | <String> | RPC server to interact with | |
| <ServiceName> | <String> | Name of the service |
Options
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AuthEpm | <SwitchParam> | Authenticates EP mapper requests | |
| -AuthProxy | <EndPoint> | Endpoint of auth proxy | |
| -ConsoleOutputStyle | -OutputStyle | <OutputStyle> | Determines the output style |
| Possible values: | |||
| Freeform | |||
| Raw | |||
| Table | |||
| List | |||
| Csv | |||
| Tsv | |||
| Json | |||
| TreeTable | |||
| -Delegate | <SwitchParam> | Requests delegation (sends TGT and key for Kerberos) | |
| -EncryptEpm | <SwitchParam> | Encrypts EP mappend requests | |
| -EncryptRpc | <SwitchParam> | Encrypts RPC messages | |
| -OutputHeaders | <SwitchParam> | Print headers for table/list/CSV/TSV styles | |
| Default: True | |||
| -PreferSmb | <SwitchParam> | If the interface supports named pipes, attempt to connect over the named pipe instead of TCP | |
| -RpcCallTimeout | <Duration> | Time to wait for RPC calls | |
| -RpcConnectTimeout | <Duration> | Time to wait for RPC connections | |
| -Socks5 | <host-or-ip:port> | End point of SOCKS 5 server to use | |
| -Spnego | <SwitchParam> | Uses SP-NEGO for authentication | |
| -SpnOverride | <SpnMapping[]> | Specifies an SPN override |
Authentication
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Anonymous | <SwitchParam> | Uses anonymous login | |
| -NtlmHash | <hexadecimal hash> | NTLM hash for NTLM authentication | |
| -Password | -p | <String> | Password to authenticate with |
| -UserDomain | -ud | <String> | Domain of user to authenticate with |
| -UserName | -u | <UserPrincipalName> | User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -AesKey | <HexString> | AES key (128 or 256) | |
| -DelegateTicket | <String[]> | Sends the tickets (and keys) to the target for delegation | |
| -DesKey | <HexString> | DES key | |
| -Kdc | <host-or-ip:port> | KDC endpoint | |
| -Keytab | <String> | Name of keytab file | |
| -S4ProxyService | <SecurityPrincipalName> | Name of service to proxy through | |
| -S4UserCert | <String> | Name of file containing a certificate of a user to impersonate with S4U | |
| -S4UserName | <UserPrincipalName> | Name of user to impersonate with S4U | |
| -Tgt | <String> | Name of file containing a ticket-granting ticket (.kirbi or ccache) | |
| -TicketCache | <String> | Name of ticket cache file | |
| -Tickets | -Ticket | <String[]> | Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName | <UserPrincipalName> | User name to request TGT for U2U | |
| -UserCert | <String> | Name of file containing user’s certificate (for PKINIT) | |
| -UserKey | <String> | Name of file containing user’s key (for PKINIT) | |
| -UserKeyPassword | <String> | Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name | Aliases | Value | Description |
|---|---|---|---|
| -NtlmVersion | <Version> | NTLM version number (a.b.c.d) | |
| -Workstation | -w | <String> | Name of workstation to send with NTLM authentication |
Client Behavior
| Name | Aliases | Value | Description |
|---|---|---|---|
| -DfsReferralBufferSize | <Int32> | Specifies the size for the DFS referral buffer (default=4096) | |
| -F, -FollowDfs | <SwitchParam> | Checks for and follows DFS referrals (default=true) |
Connection
| Name | Aliases | Value | Description |
|---|---|---|---|
| -Dialects | <Smb2Dialect[]> | List of SMB2 dialects to negotiate | |
| Possible values: | |||
| Smb2_0_2 | |||
| Smb2_1 | |||
| Smb3_0 | |||
| Smb3_0_2 | |||
| Smb3_1_1 | |||
| -EncryptSmb | <SwitchParam> | Requires an encrypted connection | |
| -HostAddress | -ha | <String[]> | Network address(es) of the server |
| -RequireSecureNegotiate | <SwitchParam> | Requires the client to authenticate the negotiation | |
| -RequireSigning | -signreq | <SwitchParam> | Requires packets to be signed |
| -UseTcp4Only | -4 | <SwitchParam> | Only use TCP over IPv4 endpoint |
| -UseTcp6Only | -6 | <SwitchParam> | Only use TCP over IPv6 endpoint |
Output
| Name | Aliases | Value | Description |
|---|---|---|---|
| -ConsoleLogFormat | -LogFormat | <LogFormat> | Sets the format of log messages written to the console |
| Default: 0 | |||
| Possible values: | |||
| Text | |||
| TextWithTimestamp | |||
| Json | |||
| -DebugLog | -vvv | <SwitchParam> | Prints debug messages |
| -Diagnostic | -vv | <SwitchParam> | Prints diagnostic messages |
| -HumanReadable | <SwitchParam> | Formats file sizes as human-readable values | |
| -LogLevel | <LogMessageSeverity> | Sets the lowest level of messages to log | |
| Possible values: | |||
| Debug | |||
| Diagnostic | |||
| Verbose | |||
| Info | |||
| Warning | |||
| Error | |||
| Critical | |||
| -Verbose | -V | <SwitchParam> | Prints verbose messages |
Examples
Example 1 - Stop a service
Scm stop LUMON-DC1 -UserName milchick -Password Br3@kr00m! -EncryptRpc myservice