Service state detection method, apparatus and electronic device

Abstract

The present disclosure provides a service state detection method and device and electronic equipment, and relates to the technical field of network security, wherein the method is applied to a low-privilege environment with a privilege lower than that of an administrator, and comprises: loading a configuration file, the configuration file containing a target service name and a target host address; according to the configuration file, calling a local security mechanism of the target host based on a remote procedure call interface, remotely querying a service account, detecting a service installation state, the target host being a detected object and having a local security account service interface and a named pipe communication capability; if it is detected that the service has been installed, accessing a named pipe associated with the service according to a server message block protocol based on a pre-set mapping relationship between the service name and the named pipe, and detecting a service running state; and combining the service installation state and the service running state, outputting a service state detection result. The present disclosure can perform concealed detection on the service state of a remote target host in a low-privilege environment.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and in particular, to a service state detection method and device and electronic equipment. BACKGROUND

[0002] In the field of information technology and network security, operation and maintenance personnel, security auditors and penetration testers often need to identify and verify the installation state and running state of certain key services on a remote target host. Such requirements exist widely in intrusion detection, antivirus / anti-spyware monitoring, terminal protection system monitoring and penetration testing scenarios.

[0003] When related technologies perform remote service detection by calling a service control manager (SCM) interface, the calling party often needs to have administrator privileges in the target system, which has a high requirement for user privileges and is difficult to apply in most practical environments, especially in network environments with limited privileges and only ordinary user privileges.

[0004] Currently, there is no effective technical solution to the problem of high user privilege requirements when performing service state detection in related technologies. SUMMARY

[0005] The main purpose of the present disclosure is to provide a service state detection method and device and electronic equipment to solve the problem of high user privilege requirements when performing service state detection in related technologies.

[0006] To achieve the above purpose, the first aspect of the present disclosure provides a service state detection method applied to a low-privilege environment with privileges lower than administrator privileges, comprising:

[0007] loading a configuration file, wherein the configuration file contains a target service name and a target host address;

[0008] According to the configuration file, calling the local security authority of the target host based on a remote procedure call interface, remotely querying a service account, and detecting a service installation state, wherein the target host is a detected object and has a local security account service interface and a named pipe communication capability;

[0009] If it is detected that the service has been installed, based on a pre-set mapping relationship between the service name and the named pipe, accessing the named pipe associated with the service according to the server message block protocol, and detecting a service running state;

[0010] Combining the service installation state and the service running state, outputting a service state detection result, wherein the service state detection result is that the service has been installed and is running, the service has been installed but is not running, or the service has not been installed.

[0011] Optionally, according to the configuration file, a local security mechanism of the target host is invoked based on a remote procedure call interface, a service account is remotely queried, and a service installation state is detected, including:

[0012] According to a target service name in the configuration file, a service account name conforming to a Windows service account naming specification is constructed, wherein the service account name is used to represent an identification format of the target service when the target service runs in a system account in a local security account manager;

[0013] An account name query interface of the target host is invoked through a remote procedure call protocol, and an account name query request is submitted to an LSA service of the target host by taking the service account name as a parameter, so as to query a security identifier of the service;

[0014] A status code returned by the target host is determined, and whether the target service has been installed in the target host is judged through the status code in a low-privilege environment, wherein the low privilege is a privilege lower than an administrator privilege;

[0015] If the status code returned by the target host is STATUS_SUCCESS, the service has been installed, otherwise, the service has not been installed.

[0016] Optionally, based on a pre-set mapping relationship between a service name and a named pipe, a named pipe associated with the service is accessed according to a server message block protocol, and a service running state is detected, including:

[0017] In a scenario of not logging in the target host, the target host is accessed in a low-privilege manner, wherein the low privilege is a privilege lower than an administrator privilege;

[0018] Based on the pre-set mapping relationship between the service name and the named pipe, the named pipe associated with the service is accessed in the low-privilege manner by opening a named pipe handle according to a server message block protocol;

[0019] The content returned by the target host is determined, and whether the target service is running is judged according to the content returned by the target host;

[0020] If the target host returns ERROR_FILE_NOT_FOUND, the named pipe does not exist, and the service is not running;

[0021] If the target host returns ERROR_ACCESS_DENIED, successfully acquires the named pipe handle, or successfully establishes a connection, the named pipe exists, and the service is running.

[0022] Further, the named pipe handle is opened in the low-privilege manner, including any one of the following:

[0023] The underlying pipe path is connected through the server message block protocol;

[0024] The communication connection is established by binding the named pipe through the RPC.

[0025] The named pipe associated with the service is accessed by mounting the remote shared manner using the NetUse command in the Windows native command.

[0026] Optionally, the method further comprises:

[0027] According to the plurality of groups of target service names in the configuration file, a plurality of groups of service account names are constructed, wherein each group of service account names corresponds to a group of target service names and a group of target host addresses;

[0028] A plurality of service state detection tasks are processed by adopting a task distribution architecture, the target host addresses corresponding to each group of service account names are combined with the target service names by Cartesian product to generate a detection task queue;

[0029] According to the hardware device, a thread pool is created, and a plurality of worker threads are configured, and each worker thread is independent of each other;

[0030] The plurality of service state detection tasks in the detection task queue are dynamically assigned to the plurality of worker threads by adopting a lock-free queue mechanism, and the plurality of service state detection tasks are concurrently executed in the plurality of target host environments, and a plurality of service state detection results are recorded;

[0031] The plurality of service state detection results are subjected to data aggregation processing according to the target host or the target service name, a structured detection report is generated, and the structured detection report is output in a preset format.

[0032] Further, after the detection task queue is generated, the method further comprises:

[0033] According to the types of the target host and the target service name, all service state detection tasks are intelligently prioritized.

[0034] Further, the method further comprises:

[0035] A corresponding timeout threshold is set for each service state detection task;

[0036] When the network delay duration or the target host response duration of the service state detection task is greater than the timeout threshold, the service state detection task is marked as failed and detailed logs are recorded;

[0037] For the target host whose response duration is greater than the timeout threshold, the frequency of sending service state detection requests to the target host is reduced.

[0038] The second aspect of the present disclosure provides a service state detection device applied to a low-privilege environment with a privilege lower than an administrator privilege, comprising:

[0039] A loading module is configured to load a configuration file, wherein the configuration file contains a target service name and a target host address;

[0040] A remote query module is configured to remotely query a service account based on a local security mechanism of the target host according to the configuration file based on a remote procedure call interface, and detect a service installation state, wherein the target host is a detection object and has a local security account service interface and a named pipe communication capability;

[0041] A named pipe detection module is configured to access a named pipe associated with the service according to a server message block protocol based on a pre-set mapping relationship between the service name and the named pipe if it is detected that the service has been installed, and detect a service running state;

[0042] An output module is configured to output a service state detection result in combination with the service installation state and the service running state, wherein the service state detection result is that the service has been installed and is running, the service has been installed but is not running, or the service has not been installed.

[0043] The third aspect of the present disclosure provides a computer readable storage medium, which stores computer instructions for causing a computer to execute the service state detection method provided in any one of the first aspect.

[0044] The fourth aspect of the present disclosure provides an electronic device, which comprises at least one processor and a memory connected with the at least one processor in communication, wherein the memory stores computer programs executable by the at least one processor, and the computer programs are executed by the at least one processor to cause the at least one processor to execute the service state detection method provided in any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the specific embodiments or related art of the present disclosure, the drawings needed in the specific embodiments or related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0046] Figure 1 A service state detection method flowchart provided by an embodiment of the present disclosure;

[0047] Figure 2 A service state detection device block diagram provided by an embodiment of the present disclosure;

[0048] Figure 3 An electronic device block diagram is provided for the embodiments of the present disclosure. DETAILED DESCRIPTION

[0049] In order for those skilled in the art to better understand the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of the present disclosure.

[0050] It should be noted that the terms "first", "second", and the like in the specification and claims of the present disclosure and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] It should be noted that the embodiments in the present disclosure and the features in the embodiments can be combined with each other without conflict. The present disclosure will be described in detail below with reference to the drawings and in combination with the embodiments.

[0052] In the field of information technology and network security, operation and maintenance personnel, security auditors and penetration testers often need to identify and verify the installation status and running status of some key services on remote target hosts. Such requirements exist widely in intrusion detection, antivirus / anti-spyware monitoring, terminal protection system monitoring and penetration testing scenarios.

[0053] The related technology performs remote service detection by calling a service control manager (SCM) interface, which allows the caller to remotely access the service controller of a target host using APIs such as OpenSCManager() and EnumServicesStatusEx(), thereby enumerating all registered services and their status information thereon; however, this calling method often requires the caller to have administrator privileges or a system service account in the target system, which has a high requirement for user permissions and is difficult to apply in most practical environments, especially in a network environment with limited permissions and only ordinary user permissions, where remote calling such as OpenSCManager() will directly fail.

[0054] In addition, the target host may close the relevant remote service management interface through firewall policies or policy group policies, further limiting the application scope of the SCM interface calling method.

[0055] To solve the above problems, the embodiments of the present disclosure provide a service state detection method, which can perform concealed detection of the service state of a remote target host in a low-privilege environment without administrator privileges. The method is applied in a low-privilege environment with lower privileges than administrator privileges, and can also be applied in an administrator privilege environment, such as Figure 1 As shown in the figure, the method comprises the following steps S11 to S14:

[0056] Step S11: load a configuration file, wherein the configuration file contains a target service name and a target host address; the configuration file can be in JSON or CSV format, and the configuration file contains target network information such as the target service name and the target host address, and the target service name can be WebClient;

[0057] Step S12: according to the configuration file, call the local security authority of the target host based on the remote procedure call interface, remotely query the service account, and detect the service installation state, wherein the target host is the detected object and has a local security account service interface and a named pipe communication capability; the remote procedure call (RPC) is a communication protocol that allows programs to call each other's functions or services between different hosts through a network; the local security authority (LSA) is a key component in the Windows operating system, responsible for the execution and management of local security policies;

[0058] Based on the RPC mechanism of Windows system, the remote service account can be queried by calling the LSA of the target host. In addition, the queried service account information can be cached to reduce the network overhead caused by repeated RPC calls and improve the detection efficiency.

[0059] In an optional embodiment of the present disclosure, step S12 comprises:

[0060] According to the target service name in the configuration file, a service account name conforming to the naming specification of the Windows service account is constructed, wherein the service account name is used to represent the identification format of the target service in the local security account manager when the target service runs in the system account; the format of the service account name is a string "NT SERVICE<target service name>", for example, the target service name is WebClient, and the corresponding constructed service account name is NT SERVICE <webclient>;

[0061] The account name query interface of the target host is called through a remote procedure call protocol, and the service account name is submitted as a parameter to the LSA service of the target host to query the security identifier of the service. The account name query interface can be the LsarLookupNames() function in the LSA component of the Windows system, and the security identifier (SecurityIdentifier, SID for short) is a structured identifier in the Windows system for uniquely identifying users, groups and other security principals. The LsarLookupNames() function is used to map the account name to the SID, and the permission requirement is reduced, which can be called in a low-privilege environment (such as normal user permission, anonymous user permission, etc.). The account name query request can be submitted to the LSA service of the target host through the RPC protocol by the normal user, and it is determined whether the target service has been registered and installed in the target host without administrator permission.

[0062] The client establishes communication with the LSA service of the target host through the RPC protocol. RPC is a core IPC mechanism of Windows, supports cross-network calls, and encapsulates the underlying network transmission details. The protocol series ncacn_ip_tcp (RPC binding based on TCP) or the protocol series ncacn_np (RPC binding based on named pipes) which identifies TCP / IP as the endpoint is used as the transmission protocol in the embodiment of the disclosure, so that stable execution can be ensured in various network environments.

[0063] In order to improve compatibility, the LSA interface differences of different Windows versions (such as Windows 7, Windows 10, Windows 11, Server 2012R2+) are automatically adapted when calling LsarLookupNames().

[0064] By using the RPC interface with lower permission requirements such as LsarLookupNames() for detection, the hidden detection of the service installation state can be realized, and the risk of being monitored or monitored is reduced.

[0065] The status code returned by the target host is determined, and it is determined whether the target service has been installed in the target host through the status code in a low-privilege environment, wherein the low-privilege is a lower permission than the administrator permission.

[0066] If the status code returned by the target host is STATUS_SUCCESS, the service has been installed, otherwise, the service has not been installed.

[0067] If the LsarLookupNames() function returns a status code STATUS_SUCCESS and the corresponding relative identifier, the target service has been registered and installed; if the query returns a negative result, the output result is: the service is not installed, and in the negative result, the Windows system generally returns the status code STATUS_NONE_MAPPED, and the old version of the Windows system may return the status code STATUS_ACCESS_DENIED instead of the status code STATUS_NONE_MAPPED. In the case of adapting to different Windows versions, the secondary judgment can be combined with the status code and additional information (such as the SID resolution result) to avoid misjudgment.

[0068] Since the LsarLookupNames() function allows non-administrator users to perform single target service name lookup, in the service installation state detection aspect, the embodiment of the disclosure performs single-point query on the specified target service name by using the LsarLookupNames() function exposed by the Windows operating system, so as to determine whether the target service has been registered and installed on the target host.

[0069] Through single query of the target service name, full enumeration of the complete service list is not required, the high privilege requirement of the SCM interface in the related art is avoided, the permission limit and the monitoring of the audit system are bypassed, the risk of being monitored by the security system is reduced, and the problem that the user permission requirement is high when the service state is detected in the related art is solved.

[0070] Step S13: If it is detected that the service has been installed, based on the pre-set mapping relationship between the service name and the named pipe, the named pipe associated with the service is accessed according to the server message block protocol, and the service running state is detected; in the Windows operating system, the named pipe serves as an efficient Inter-Process Communication (IPC) mechanism and provides a reliable channel for data exchange between system services and application programs, and by using the Server Message Block (SMB) protocol, low-privilege access to the named pipe of the remote target host can be realized, which not only bypasses the dependence on the administrator permission in the related art, but also greatly improves the stealth and feasibility of detection.

[0071] According to the SMB protocol, the service running state is detected by low-privilege access to the named pipe resource of the target host; on the basis of confirming that the service has been installed, the named pipe detection is performed, and an attempt is made to access the specific named pipe associated with the service.

[0072] Services create specific named pipes for interprocess communication at runtime. For example, the WebClient service starts and registers a named pipe called \\.\pipe\c4b3e4d0\7f00\ <ip>The named pipe is \pipe\davsvc; therefore, the target host can be accessed in a low-privilege manner by combining the SMB protocol and by pre-setting the mapping relationship between the service name and the named pipe path.

[0073] In an optional embodiment of the present disclosure, step S13 comprises:

[0074] In the scenario of not logging into the target host, the target host is accessed in a low-privilege manner, wherein the low privilege is a privilege lower than the administrator privilege.

[0075] Based on the pre-set mapping relationship between the service name and the named pipe, the named pipe handle is opened in a low-privilege manner according to the server message block protocol, and the named pipe associated with the service is accessed.

[0076] The content returned by the target host is determined, and it is judged whether the target service is running according to the content returned by the target host.

[0077] If the target host returns ERROR_FILE_NOT_FOUND, the named pipe does not exist, and the service is not running; when the named pipe does not exist, the service is not currently running.

[0078] If the target host returns ERROR_ACCESS_DENIED, successfully acquires the named pipe handle, or successfully establishes a connection, the named pipe exists, and the service is running. When the named pipe exists, it is confirmed that the service is in an active state, and the service is currently running.

[0079] In order to ensure the accuracy and comprehensiveness of the detection result, a service name-named pipe mapping knowledge base can be pre-built, which stores the mapping relationship between the service name and the named pipe. The service name-named pipe mapping knowledge base not only includes the standard pipe naming specification of common Windows services such as WebClient, Spooler, and Dnscache, but also adopts an extensible design architecture, allowing users to add custom mapping relationships according to actual needs, which is particularly important for detecting third-party services or customized system services.

[0080] In addition, in terms of reliability, in order to realize an intelligent retry mechanism, a "3 attempts + exponential backoff" strategy is adopted to deal with temporary network fluctuations. The interval time of each retry increases according to an exponential law, which not only gives the network time to recover, but also avoids resource waste caused by blind retries. At the same time, historical detection data is continuously recorded, and through comparative analysis of these data, occasional false positives can be identified, further improving the accuracy of the judgment.

[0081] The embodiments of the present disclosure detect whether the known named pipe identifiers exist on the target host based on the fact that a service usually creates specific named pipes to communicate with external modules during running;

[0082] By the mapping relationship between the service name and the named pipe path, whether the service is running can be determined under the condition of low authority in combination with whether the named pipe exists; the inherent characteristics of the named pipe are fully utilized, the limitation of the high authority requirement of the SCM interface in the related technology is avoided, and the operation is extremely good in concealment, and the problem of high authority requirement for the user when the service state is detected in the related technology is solved.

[0083] In a preferred embodiment of the present disclosure, the named pipe handle is opened in a low-privilege manner, including any one of the following:

[0084] The underlying pipe path is connected through the server message block protocol;

[0085] The communication connection is established by binding the named pipe through RPC;

[0086] The NetUse command in the Windows native command is used to access the named pipe associated with the service by mounting the remote shared manner. The NetUse command is a native command of Windows, which is used to manage and operate network connection, map network shared drive or connect network shared folder.

[0087] The embodiments of the present disclosure adopt a multi-level pipe detection strategy to adapt to different network environments. The most basic detection method is to directly access the named pipe through the SMB protocol to construct a standard UNC path ( <ip>The pipe (\\.\pipe\davsvc) initiates a connection request, and then analyzes the returned error code carefully: when ERROR_ACCESS_DENIED is returned, although the current user has insufficient permissions, this response proves the existence of the named pipe; and when ERROR_FILE_NOT_FOUND is returned, it is explicitly indicated that the named pipe has not been created, and the corresponding service is naturally not running. Considering the firewall restrictions that exist in enterprise networks, the embodiment of the present disclosure also designs a backup detection scheme, which indirectly detects through the RPC over Named Pipe mode. This mode uses the system's inherent pipe (such as \pipe\lsarpc) as a communication channel, and even if the SMB port is blocked, the detection task can still be completed. For some special environments that implement strict security policies, the embodiment of the present disclosure can also intelligently switch to the Windows native command NetUse simulation mode, and access the target pipe through the mounting of remote shares. This flexible adaptability ensures that the detection work can be carried out smoothly in various complex scenarios.

[0088] Step S14: combining the service installation state and the service running state, outputting the service state detection result, wherein the service state detection result is that the service has been installed and is running, the service has been installed but is not running, or the service has not been installed. By initiating the RPC query and the SMB pipe detection request, and combining the return results of the RPC query and the named pipe detection, the complete state of the service can be accurately determined, and the dual detection of the service installation state and the service running state is realized.

[0089] If it is confirmed that the service has been installed and the named pipe exists, the service state detection result is that the service has been installed and is running; if the service has been installed but the named pipe does not exist, the service state detection result is that the service has been installed but is not running; if the RPC query returns that the service is not registered for installation after excluding the named conflict or false alarm, regardless of whether the named pipe exists or not, the service state detection result is that the service has not been installed.

[0090] The present disclosure combines the security account management mechanism and the named pipe characteristics of the Windows operating system to realize the dual detection of the service installation state and the service running state. This dual detection mechanism significantly reduces the false positive rate and covers the detection requirements in the installation and running dimensions. Through logical judgment and multi-dimensional information integration, accurate, low-privilege and stealthy detection of the service state of the target host is realized, and the problem of high user permission requirement in related art is solved.

[0091] The technical solutions of the present disclosure will be further explained and described in combination with the first embodiment.

[0092] [First embodiment]

[0093] This embodiment is based on the remote target host detection task in Windows network environment, the goal is to determine whether the remote target host installed and running WebClient service, and the results are classified output. This embodiment to detect the status of the remote target host WebClient service as the goal, complete the whole process from the initialization configuration to the final results output work process.

[0094] When running, the client will first generate a special configuration file, which contains the standardized service account name "NT SERVICE\WebClient", this specific format of string is the standard naming rules set by Windows system for service account. After the configuration is completed, the client initiates LsarLookupNames() function call request to the target host through RPC protocol, this key step uses the characteristics of Windows local security authentication mechanism, can complete the service registration state verification under normal user permission.

[0095] When the remote target host returns the status code STATUS_SUCCESS, it indicates that the corresponding service account has been registered in the target host system, thus it can be determined that WebClient service has been installed on the target host. In order to further confirm the real-time running state of the service, the second stage of detection process is started, the client tries to establish a named pipe connection with the target host, the specific access path is constructed as <ip>\pipe\davsvc, this specific pipe name has a fixed correspondence with the WebClient service. The return result of the connection attempt is intelligently parsed: if the system returns the error code ERROR_FILE_NOT_FOUND, this explicit negative response indicates that the named pipe does not exist, and it can be determined that the WebClient service is not currently running; conversely, if the error code ERROR_ACCESS_DENIED is returned or the connection is successfully established, it is strong evidence that the named pipe exists, indicating that the service is in an active state.

[0096] After the entire detection process is completed, clear and explicit detection results are generated, which use standardized expression methods such as "WebClient service is installed and running", "WebClient service is installed but not running", or "WebClient service is not installed". This structured output not only facilitates manual reading and understanding, but also facilitates subsequent automated processing and analysis.

[0097] In an optional embodiment of the present disclosure, the method further comprises:

[0098] According to the multiple sets of target service names in the configuration file, multiple sets of service account names are constructed, wherein each set of service account names corresponds to a set of target service names and a set of target host addresses; the multiple sets of target service names (such as WebClient, W32Time, Dnscache, etc.) form a list of services to be detected, and the list of target host addresses can be an IP address segment or a host name. According to the multiple sets of target service names, multiple sets of service account names can be constructed in batches. Each set of service account names, the corresponding set of target service names, and the set of target host addresses form a service state detection task, and the target service names, service account names, and target host addresses are maintained in groups;

[0099] An intelligent task scheduling mechanism is used to dynamically load target network information from a preset configuration file at startup, including IP address segments (such as CIDR representation such as 192.168.1.0 / 24) and service lists to be detected (such as WebClient, W32Time, and other key system services). These raw data are converted into standardized service state detection tasks after parsing, and each service state detection task contains the corresponding relationship between the target IP address and the service name;

[0100] A task distribution architecture is used to process multiple service state detection tasks, and the target host addresses corresponding to each set of service account names are combined with the target service names to generate a detection task queue;

[0101] According to the hardware device, a thread pool is created, a plurality of working threads are configured, and each working thread is independent of each other; the thread pool is used to optimize resource utilization, and a thread pool of a proper size is automatically created according to the performance of the hardware device in the initialization stage, and the default configuration is 10 working threads, and the specific number of working threads supports flexible adjustment according to the actual network environment and the performance of the device; each working thread maintains complete independence and can orderly execute respective detection tasks, including core operations such as RPC interface calling and named pipe detection;

[0102] The plurality of service state detection tasks in the detection task queue are dynamically allocated to the plurality of working threads by using a lock-free queue mechanism, and the plurality of service state detection tasks are concurrently executed in the plurality of target host environments, and the plurality of service state detection results are recorded; the architecture design combining multi-thread concurrency and the task queue is adopted, and batch service state detection is performed on the plurality of target hosts in a multi-thread concurrency or thread pool manner through parallel processing, so that the overall scanning efficiency is improved; and in order to maximize the concurrent efficiency, the task allocation between threads adopts an efficient lock-free queue mechanism, and no lock mechanism (such as a mutex or a read-write lock) is used to realize thread safety, so that the performance loss and potential deadlock risk caused by the traditional lock mechanism are effectively avoided, and the task distribution process almost does not produce additional system overhead;

[0103] The plurality of service state detection results are subjected to data aggregation processing according to the target host or the target service name, a structured detection report is generated, and the structured detection report is output in a preset format. After all the service state detection tasks are executed, the service state detection results of the working threads are collected, an aggregation algorithm is used to remove duplicates, check and classify the original results, a structured report is generated, and various abnormal states such as "the service is installed but not running" and other special conditions are clearly marked in the report, and detailed error codes and possible reason analysis are attached, so that comprehensive basis is provided for subsequent fault troubleshooting and security analysis. In addition, the finally generated structured report supports multiple output formats, including a CSV format and a JSON format convenient for machine processing, and an HTML format more suitable for manual reading.

[0104] In a preferred embodiment of the present disclosure, after the detection task queue is generated, the method further includes:

[0105] According to the types of the target host and the target service name, the intelligent priority of all the service state detection tasks is sorted. According to the importance of the services and the target host, the intelligent priority of the service state detection tasks is sorted, so that the detection of key services and important hosts can be preferentially executed.

[0106] In a preferred embodiment of the present disclosure, the method further includes:

[0107] Set a corresponding timeout threshold for each service state detection task; for example, the timeout threshold can be 5 seconds;

[0108] When the network delay duration or the target host response duration of the service state detection task is greater than the timeout threshold, mark the service state detection task as failed and record detailed logs; when the network delay or the slow target host response causes timeout, mark the service state detection task as failed and record detailed logs, without waiting indefinitely to affect the overall progress;

[0109] For the target host with a response duration greater than the timeout threshold, reduce the frequency of sending service state detection requests to the target host. For the host with high response delay, automatically enable the dynamic frequency adjustment function to appropriately reduce the sending frequency of the probe request.

[0110] This adaptive timeout control and fault tolerance processing mechanism can not only ensure the continuity of detection, but also effectively avoid triggering the security protection strategy of the target host, such as the anti-brute-force cracking mechanism or the alarm threshold of the intrusion detection system, due to frequent requests.

[0111] The technical solutions of the present disclosure will be further explained and described in conjunction with the second embodiment.

[0112] [Second embodiment]

[0113] The present disclosure is applicable to concurrent execution of service state detection tasks in a plurality of target host environments. In this embodiment, the client can construct a plurality of service account names in batches according to a plurality of groups of target service names (such as WebClient, W32Time, Dnscache, etc.), and perform batch service state detection on a plurality of hosts in a multi-threaded concurrent or thread pool manner by pre-maintaining a group of target host address lists (such as IP addresses or host names) and a group of service names to be detected, thereby improving the overall scanning efficiency and being suitable for tasks such as horizontal penetration testing and enterprise compliance scanning.

[0114] An advanced task distribution architecture is used to process these detection requirements. Intelligent algorithms are used to combine target host addresses and service names in Cartesian product to generate a complete detection task queue. Each task unit accurately corresponds to a specific detection target and contains explicit host address and service name information. In order to maximize the parallel processing capability of modern computing devices, an optimized thread pool technology is introduced to dynamically allocate detection tasks to multiple worker threads for concurrent execution. Each worker thread follows a standardized detection process: first, query the registration status of the service account to the specified target host through the LsarLookupNames() interface, which can accurately determine whether the target service has been installed in the system; then immediately initiate a probe request to the service-associated named pipe to confirm the real-time running state of the service by analyzing whether the named pipe exists.

[0115] During the task execution process, each detection result is monitored and recorded in real time, and a standardized state description (such as "installed and running", "installed but not running", or "not installed") is used to accurately reflect the specific situation of each service. After all the work threads complete the detection task, a comprehensive data aggregation process is performed, and the scattered detection results are systematically arranged according to the target host, service, and other dimensions, and finally a structured detection report is generated. The report supports multiple output formats, and users can select different formats such as CSV, JSON, or HTML according to subsequent processing needs. This flexibility greatly facilitates the integration and application of detection results in enterprise security management systems.

[0116] The present disclosure can detect the service state of a remote target host under low-privilege conditions, while considering both the installation and running of the service, and minimizing the dependence on the target host's privileges, configuration, and response behavior.

[0117] From the above description, it can be seen that the present disclosure achieves the following technical effects:

[0118] The present disclosure avoids the high-privilege requirement of the SCM interface in related technologies by querying the target service name only once without enumerating the complete service list, bypasses the privilege restrictions and monitoring of the audit system, reduces the risk of being monitored by the security system, and solves the problem of high user privilege requirement for service state detection in related technologies.

[0119] The present disclosure makes full use of the inherent characteristics of the named pipe, avoids the high-privilege requirement of the SCM interface in related technologies, and has excellent operational concealment.

[0120] The present disclosure combines the security account management mechanism of the Windows operating system and the named pipe characteristics to achieve dual detection of service installation state and service running state. This dual detection mechanism significantly reduces the false positive rate and covers the detection requirements of both installation and running dimensions.

[0121] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0122] The present disclosure also provides a service state detection device for implementing the above-mentioned method embodiments, which is applied to a low-privilege environment with a privilege lower than that of an administrator, such as Figure 2 As shown in the figure, the service state detection device 20 includes:

[0123] The loading module 21 is configured to load a configuration file, wherein the configuration file comprises a target service name and a target host address.

[0124] The remote query module 22 is configured to remotely query a service account of the target host based on a local security mechanism of the target host according to the configuration file, and detect a service installation state, wherein the target host is a detection object, and has a local security account service interface and a named pipe communication capability.

[0125] The named pipe detection module 23 is configured to, if it is detected that the service is installed, access a named pipe associated with the service according to a server message block protocol based on a pre-set mapping relationship between the service name and the named pipe, and detect a service running state.

[0126] The output module 24 is configured to output a service state detection result in combination with the service installation state and the service running state, wherein the service state detection result is that the service is installed and running, the service is installed but not running, or the service is not installed.

[0127] The specific manners in which the units in the apparatus embodiments perform operations have been described in detail in the embodiments of the method, and will not be described here.

[0128] The embodiments of the present disclosure further provide an electronic device, as shown in the figure. Figure 3 The electronic device comprises one or more processors 31 and a memory 32. Figure 3 Herein, the processor 31 is taken as an example.

[0129] The controller can further comprise an input device 33 and an output device 34.

[0130] The processor 31, the memory 32, the input device 33 and the output device 34 can be connected through a bus or other means, Figure 3 Herein, the connection through the bus is taken as an example.

[0131] The processor 31 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or combinations thereof, or combinations of the foregoing. The general-purpose processor can be a microprocessor or any conventional processor, or the like.

[0132] The memory 32 is a non-transitory computer-readable storage medium, and can be used to store non-transitory software programs, non-transitory computer-executable programs and modules, such as program instructions / modules corresponding to the control method in the embodiments of the present disclosure. The processor 31 executes various functions and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, implements the service state detection method of the above method embodiments.

[0133] The memory 32 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created according to the use of the processing device of the server, and the like. In addition, the memory 32 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 32 can optionally include a memory disposed remotely with respect to the processor 31, and these remote memories can be connected to the network connection device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The input device 33 can receive input digital or character information, and generate key signal inputs related to user settings and function controls of the processing device of the server. The output device 34 can include a display device such as a display screen.

[0135] One or more modules are stored in the memory 32, and when executed by the one or more processors 31, perform the method as shown in Figure 1 .

[0136] Those skilled in the art can understand that all or part of the processes in the above-mentioned method embodiments can be completed by instructing the relevant hardware through a computer program. The program can be stored in a computer readable storage medium. When the program is executed, the program can include the processes of the above-mentioned method embodiments. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0137] Although the embodiments of the present disclosure are described in conjunction with the drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present disclosure, and such modifications and changes fall within the scope defined by the appended claims.< / ip> < / ip> < / ip> < / webclient>

Claims

1. A service status detection method, characterized in that, Applicable to low-privilege environments where permissions are lower than administrator privileges, including: Load the configuration file, which contains the target service name and the target host address; According to the configuration file, the local security authority of the target host is invoked based on the remote procedure call interface to remotely query the service account and detect the service installation status. The target host is the object being detected and has a local security account service interface and named pipe communication capability. If a service is detected to be installed, the service's running status is checked by accessing the named pipe associated with the service according to the server message block protocol, based on the pre-configured mapping relationship between the service name and the named pipe. Based on the service installation status and the service running status, a service status detection result is output, wherein the service status detection result is: the service is installed and running, the service is installed but not running, or the service is not installed; The step of calling the local security authority of the target host based on the configuration file and the remote procedure call interface to remotely query the service account and detect the service installation status includes: Based on the target service name in the configuration file, construct a service account name that conforms to the Windows service account naming convention, wherein the service account name is used to represent the identification format of the target service in the local security account manager when the system account is running; The target host's account name query interface is invoked via the remote procedure call protocol, and the service account name is used as a parameter to submit an account name query request to the target host's LSA service to query the service's security identifier. Determine the status code returned by the target host. In a low-privilege environment, use the status code to determine whether the target service has been installed on the target host. Here, low privileges are those lower than administrator privileges. If the target host returns a status code of STATUS_SUCCESS, the service is installed; otherwise, the service is not installed.

2. The method according to claim 1, characterized in that, The process of accessing the named pipe associated with the service and detecting the service's running status based on the pre-set mapping relationship between service names and named pipes, according to the server message block protocol, includes: In the scenario of not logging into the target host, access the target host in a low-privilege manner, wherein the low privilege is a privilege lower than the administrator privilege; Based on the pre-set mapping relationship between service names and named pipes, and in accordance with the server message block protocol, the named pipe handle is opened in a low-privilege manner to access the named pipe associated with the service. Determine the content returned by the target host, and determine whether the target service is running based on the content returned by the target host; If the target host returns ERROR_FILE_NOT_FOUND, the named pipe does not exist and the service is not running. If the target host returns ERROR_ACCESS_DENIED, successfully obtains a named pipe handle, or successfully establishes a connection, then the named pipe exists and the service is running.

3. The method according to claim 2, characterized in that, Opening a named pipe handle in a low-privilege manner includes any of the following: Connect to the underlying pipeline path via the Server Message Block Protocol; Establish a communication connection by binding named pipes via RPC; Use the NetUse command from the native Windows command line to access named pipes associated with services by mounting remote shares.

4. The method according to claim 1, characterized in that, The method further includes: Based on the multiple sets of target service names in the configuration file, multiple sets of service account names are constructed accordingly, wherein each set of service account names corresponds to a set of target service names and a set of target host addresses; A task distribution architecture is used to process multiple service status detection tasks. The target host address and target service name corresponding to each group of service account names are combined by performing a Cartesian product to generate a detection task queue. Create a thread pool based on the hardware device, configure multiple worker threads, and each worker thread is independent of the others; A lock-free queue mechanism is adopted to dynamically allocate multiple service status detection tasks in the detection task queue to multiple worker threads, execute the multiple service status detection tasks concurrently in multiple target host environments, and record multiple service status detection results. The multiple service status detection results are aggregated according to the target host or target service name to generate a structured detection report, which is then output in a preset format.

5. The method according to claim 4, characterized in that, After generating the detection task queue, the method further includes: All service status detection tasks are intelligently prioritized based on the type of the target host and the target service name.

6. The method according to claim 4, characterized in that, The method further includes: Set a corresponding timeout threshold for each service status detection task; When the network latency or target host response time of the service status detection task exceeds the timeout threshold, the service status detection task is marked as failed and a detailed log is recorded. For target hosts whose response time exceeds the timeout threshold, reduce the frequency of sending service status detection requests to the target host.

7. A service status detection device, characterized in that, Applicable to low-privilege environments where permissions are lower than administrator privileges, including: A loading module is used to load a configuration file, wherein the configuration file contains the target service name and the target host address; The remote query module is used to call the local security authority of the target host based on the configuration file and the remote procedure call interface to remotely query the service account and detect the service installation status. The target host is the object being detected and has a local security account service interface and named pipe communication capability. The named pipe detection module is used to detect the service's running status by accessing the named pipe associated with the service according to the server message block protocol, based on the pre-set mapping relationship between the service name and the named pipe. The output module is used to combine the service installation status and the service running status to output a service status detection result, wherein the service status detection result is: the service is installed and running, the service is installed but not running, or the service is not installed; The step of calling the local security authority of the target host based on the configuration file and the remote procedure call interface to remotely query the service account and detect the service installation status includes: Based on the target service name in the configuration file, construct a service account name that conforms to the Windows service account naming convention, wherein the service account name is used to represent the identification format of the target service in the local security account manager when the system account is running; The target host's account name query interface is invoked via the remote procedure call protocol, and the service account name is used as a parameter to submit an account name query request to the target host's LSA service to query the service's security identifier. Determine the status code returned by the target host. In a low-privilege environment, use the status code to determine whether the target service has been installed on the target host. Here, low privileges are those lower than administrator privileges. If the target host returns a status code of STATUS_SUCCESS, the service is installed; otherwise, the service is not installed.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the service status detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the at least one processor to perform the service status detection method according to any one of claims 1 to 6.

Images