> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-commands/remote-commands-via-dcerpc.md).

# Remote Commands via DCERPC

## Remote commands with SCShell

SCShell is a fileless lateral movement tool that relies on ChangeServiceConfigA to run commands. The beauty of this tool is that it does not perform authentication against SMB. Everything is performed over DCERPC.

The utility can be used remotely WITHOUT registering a service or creating a service. It also doesn't have to drop any file on the remote system\* (Depend on the technique used to execute).

Instead of creating a service it simply remotely open a service and modify the binary path name via the `ChangeServiceConfigA` API.

Then it starts the service.

Once the execution is completed the service binary path is reverted to the original one. The original service path is extracted using `QueryServiceConfigA`.

Everything is happening over DCERPC including the authentication.

## Resources

SCShell - GitHub: <https://github.com/Mr-Un1k0d3r/SCShell>