winexe

Donate:
 
winexe remotely executes commands on WindowsNT/2000/XP/2003 systems from GNU/Linux (probably also other Unices capable to compile Samba4).
  1. Requirements
  2. Usage
  3. How does it work
  4. How to get it
  5. Remarks
  6. Changelog
  7. Donations


Requirements


Usage

winexe started without arguments shows list of options, using "--help" will show their descriptions. Most of the tasks can be done using syntax:
winexe -U [Domain/]User%Password //host command
Where 'host' can be given as ip number or DNS hostname and 'command' is a command which will be run on remote system.
Examples:

# winexe -U HOME/Administrator%Pass123 //192.168.0.10 "ipconfig /all"

# winexe -U HOME/Administrator%Pass123 //host 'cmd /C dir C:\'

# winexe -U HOME/Administrator%Pass123 //host.com 'cmd /C net stop wuauserv && net start wuauserv && echo AutoUpdates service restarted'

# cat | winexe -U HOME/Administrator%Pass123 //host cmd <<EOF
>net stop wuauserv
>net start wuauserv
>echo AutoUpdates service restarted
>exit
>EOF

Many options of winexe are the same as for Samba tools and you can check for their description in Samba documentation. Below description of most important options:
winexe specific
hostWindows hostname provided as ip address or DNS name. Using NETBIOS names should be also possible after playing with Samba specific options.
commandCommand which will be run on remote system. If command contains spaces and/or parameters use quotes and/or double quotes, ex. '"long name.exe" -option -"option with spaces"', if you like to run internal cmd interpreter command use "cmd /C" syntax, ex. "cmd /C ver". If command interact with desktop GUI check option --interactive.
--uninstallUninstall winexesvc service after remote execution
--reinstallReinstall winexesvc service before remote execution
--systemRun command using SYSTEM account
--runas=[DOMAIN/]USERNAME%PASSWORDRun command as user (BEWARE: password is sent in cleartext over net)
--interactive=0|1Desktop interaction: 0 - disallow, 1 - allow. If you allow use also --system switch (Win requirement). Windows Vista do not support this option.
General
-U [DOMAIN/]USERNAME[%PASSWORD]User with admin privileges for Windows authentication. If not overrided by other options 'command' will be run on this account. If you omit password you will be prompted.
-d DEBUGLEVELSet debug level, 0 - no debug (default), 11 - highest level (it is safe to use bigger numbers)
Exit code: winexe returns exit code of remote process.

How does it work

  1. winexe connects to IPC$ share of host.
  2. Next it tries to open winexesvc control named pipe (to make things easier pipe is called "ahexe" :)).
  3. If there is not such pipe, winexe copies winexesvc.exe to ADMIN$ share, creates winexesvc service, starts it and tries to connect to control pipe again.
  4. After succesfull connection it passess optional parameters (ex. --runas, --system) and the command itself to winexesvc process via the pipe.
  5. winexesvc creates two pipes: ahexec_stdio%08X, and ahexec_stderr%08X(where %08X is replaced by unique number) and runs command with I/O redirected to those pipes.
  6. winexe redirects those pipes to Linux console.
  7. After command exit winexe return its exit code to system.

How to get it

winexe sources are hosted on Zenoss together with DCOM/WMI client for Linux.
You can get also 'release' sources from here: winexe-source-071026.tar.bz2


How to get it:
I have not tested those instructions step by step, but I hope idea is clear.


Remarks


Changelog

Development changelog is located at Zenoss trac.
Release changelog:
0.80 - 26/10/07 Added --interactive option.
    winexesvc is replaced only if version differs on more than last digit.
0.77 - 11/10/07 Fixed bug causing winexe crash during service uninstallation.
0.76 - 10/10/07 Service status is checked during service (un)installation.
    Corrected service installation code(case of deleted winexesvc.exe file).
0.75 - 09/07/07 Added workaround for delayed pipe handle destruction(error 0x000000E7).
    Removed token handle leaks in case of error condition.
0.74 - 04/07/07 Added version checking and automatic service reinstallation
    Pipe names now depends on ProcessID(should solve issue with unterminated winexe processes)
0.73 - 29/06/07 Corrected bug in signal handling
0.72 - 26/06/07 Added winexe INT/TERM signal handling
0.71 - 22/05/07 Workarounds for win2003sp2 service (re)installation issues
    Removed token handle leaks in winexesvc 
0.7 - 25/07/06 Making code more pretty.
    By default commands run on user's account.
    Added --system - commands run on system account.
    Added --runas - any user can be impersonated(BEWARE: passwords are sent in clear text).
    Many changes in winexesvc.
0.61 - 07/07/06 Fixed bug in svcctl.idl
    Changed types of 'dependencies' and 'password' params in CreateServiceW.
0.6 - 07/07/06 svcctl.idl cosmetics
    Linux code style applied, semi automatic.
    Removed // style comments.
    Changed includes  to 
0.5 - 06/07/06 Cleaned up winexe/service code.
    Changed deps in winexe/config.mk.
    Renamed directory service to winexesvc.
    STDIN read corrected.
    async_write serialized - now server should receive input in correct order.
0.4 - 02/07/06 Added dependencies in winexe/config.mk to auto rebuild service.
    Turned off timeouts - proces do not disconnect after 60sec.
    Added some debug messages.
    Removed small leaks in winexesvc.
0.3 - 02/07/06 winexe is fully integrated with smb_build system. Now there is
    no need to separately compile winexe/service. I have also removed symlink
    to winexesvc_exe.c, should be cleaner.
0.2 - 02/07/06 Now it works with NT - all pipes are created with security 
    descriptor allowing admins to open it.
    Added options --reinstall/--uninstall.
    Added error messages, cleaned debug messages(-d 1).
    Some code cleaning.
    Added 'precompiled' winexe/service/winexesvc_exe.c, for users without 
    crosscompiler or windows compile enironment.
0.1 - 01/07/06 In winexe dir added link to winexe/service/winexesvc_exe.c, 
    I am not sure if patch utility supports it.
0.0 - 30/06/06 Initial release


Donations

You can support developement of winexe by making donations via PayPal or Moneybookers:
Donate:
 

My e-mail: andrzej.hajda at wp.pl