diff --git a/poisoners/NBTNS.py b/poisoners/NBTNS.py index faa084c..0d550ec 100644 --- a/poisoners/NBTNS.py +++ b/poisoners/NBTNS.py @@ -16,29 +16,12 @@ # along with this program. If not, see . import socket import settings -import string import fingerprint from packets import NBT_Ans from SocketServer import BaseRequestHandler from utils import * -def NBT_NS_Role(data): - Role = { - "\x41\x41\x00":"Workstation/Redirector", - "\x42\x4c\x00":"Domain Master Browser", - "\x42\x4d\x00":"Domain Controller", - "\x42\x4e\x00":"Local Master Browser", - "\x42\x4f\x00":"Browser Election", - "\x43\x41\x00":"File Server", - "\x41\x42\x00":"Browser", - } - - if data in Role: - return Role[data] - else: - return "Service not known." - # Define what are we answering to. def Validate_NBT_NS(data): if settings.Config.AnalyzeMode: @@ -58,19 +41,6 @@ def Validate_NBT_NS(data): else: return False -def Decode_Name(nbname): - #From http://code.google.com/p/dpkt/ with author's permission. - try: - if len(nbname) != 32: - return nbname - l = [] - for i in range(0, 32, 2): - l.append(chr(((ord(nbname[i]) - 0x41) << 4) | - ((ord(nbname[i+1]) - 0x41) & 0xf))) - return filter(lambda x: x in string.printable, ''.join(l).split('\x00', 1)[0].replace(' ', '')) - except: - return "Illegal NetBIOS name" - # NBT_NS Server class. class NBTNS(BaseRequestHandler): diff --git a/servers/Browser.py b/servers/Browser.py index 664342b..f0bd726 100644 --- a/servers/Browser.py +++ b/servers/Browser.py @@ -34,7 +34,7 @@ def WorkstationFingerPrint(data): "\x06\x01" :"Windows 7/Server 2008R2", } - return Role[data] if data in Role else False + return Role[data] if data in Role else "Unknown" def RequestType(data): Type = { @@ -50,63 +50,52 @@ def RequestType(data): "\x0f": 'Local Master Announcement', } - return Type[data] if data in Type else False + return Type[data] if data in Type else "Unknown" def PrintServerName(data, entries): - if entries == 0: - pass + if entries > 0: - else: entrieslen = 26*entries chunks, chunk_size = len(data[:entrieslen]), entrieslen/entries - ServerName = [data[i:i+chunk_size] for i in range(0, chunks, chunk_size) ] + ServerName = [data[i:i+chunk_size] for i in range(0, chunks, chunk_size)] + l = [] for x in ServerName: - if WorkstationFingerPrint(x[16:18]): - l.append(x[:16].replace('\x00', '') + '\n [-] Os version is: %s'%(WorkstationFingerPrint(x[16:18]))) + FP = WorkstationFingerPrint(x[16:18]) + Name = x[:16].replace('\x00', '') + + if FP: + l.append(Name + ' (%s)' % FP) else: - l.append(x[:16].replace('\x00', '')) + l.append(Name) return l + return None + def ParsePacket(Payload): PayloadOffset = struct.unpack('. +import sys, os +import socket +import thread +import struct +import time + +BASEDIR = os.path.realpath(os.path.join(os.path.dirname(__file__), '..')) +sys.path.insert(0, BASEDIR) + +from servers.Browser import WorkstationFingerPrint, RequestType, RAPThisDomain, RapFinger +from SocketServer import UDPServer, ThreadingMixIn, BaseRequestHandler +from threading import Lock +from utils import * + +def ParseRoles(data): + + if len(data) != 4: + return '' + + AllRoles = { + 'Workstation': (ord(data[0]) >> 0) & 1, + 'Server': (ord(data[0]) >> 1) & 1, + 'SQL': (ord(data[0]) >> 2) & 1, + 'Domain Controller': (ord(data[0]) >> 3) & 1, + 'Backup Controller': (ord(data[0]) >> 4) & 1, + 'Time Source': (ord(data[0]) >> 5) & 1, + 'Apple': (ord(data[0]) >> 6) & 1, + 'Novell': (ord(data[0]) >> 7) & 1, + 'Member': (ord(data[1]) >> 0) & 1, + 'Print': (ord(data[1]) >> 1) & 1, + 'Dialin': (ord(data[1]) >> 2) & 1, + 'Xenix': (ord(data[1]) >> 3) & 1, + 'NT Workstation': (ord(data[1]) >> 4) & 1, + 'WfW': (ord(data[1]) >> 5) & 1, + 'Unused': (ord(data[1]) >> 6) & 1, + 'NT Server': (ord(data[1]) >> 7) & 1, + 'Potential Browser': (ord(data[2]) >> 0) & 1, + 'Backup Browser': (ord(data[2]) >> 1) & 1, + 'Master Browser': (ord(data[2]) >> 2) & 1, + 'Domain Master Browser': (ord(data[2]) >> 3) & 1, + 'OSF': (ord(data[2]) >> 4) & 1, + 'VMS': (ord(data[2]) >> 5) & 1, + 'Windows 95+': (ord(data[2]) >> 6) & 1, + 'DFS': (ord(data[2]) >> 7) & 1, + 'Local': (ord(data[3]) >> 6) & 1, + 'Domain Enum': (ord(data[3]) >> 7) & 1, + } + + #print 'Workstation : ', AllRoles['Workstation'] + #print 'Server : ', AllRoles['Server'] + #print 'SQL : ', AllRoles['SQL'] + #print 'Domain Controller : ', AllRoles['Domain Controller'] + #print 'Backup Controller : ', AllRoles['Backup Controller'] + #print 'Time Source : ', AllRoles['Time Source'] + #print 'Apple : ', AllRoles['Apple'] + #print 'Novell : ', AllRoles['Novell'] + #print 'Member : ', AllRoles['Member'] + #print 'Print : ', AllRoles['Print'] + #print 'Dialin : ', AllRoles['Dialin'] + #print 'Xenix : ', AllRoles['Xenix'] + #print 'NT Workstation : ', AllRoles['NT Workstation'] + #print 'WfW : ', AllRoles['WfW'] + #print 'Unused : ', AllRoles['Unused'] + #print 'NT Server : ', AllRoles['NT Server'] + #print 'Potential Browser : ', AllRoles['Potential Browser'] + #print 'Backup Browser : ', AllRoles['Backup Browser'] + #print 'Master Browser : ', AllRoles['Master Browser'] + #print 'Domain Master Browser : ', AllRoles['Domain Master Browser'] + #print 'OSF : ', AllRoles['OSF'] + #print 'VMS : ', AllRoles['VMS'] + #print 'Windows 95+ : ', AllRoles['Windows 95+'] + #print 'DFS : ', AllRoles['DFS'] + #print 'Local : ', AllRoles['Local'] + #print 'Domain Enum : ', AllRoles['Domain Enum'] + + Roles = [] + for k,v in AllRoles.iteritems(): + if v == 1: + Roles.append(k) + + return ', '.join(Roles) + +class BrowserListener(BaseRequestHandler): + + def handle(self): + #try: + data, socket = self.request + + lock = Lock() + lock.acquire() + + DataOffset = struct.unpack('