github/Responder
1
0
Fork 0
mirror of https://github.com/lgandx/Responder.git synced 2025-07-14 17:12:53 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Subnet support, error handling, minor improvements

Browse source
This commit is contained in:
myst404 2017-11-30 16:05:14 +01:00
parent c6bc263b5e
commit 97aeac26d8
1 changed files with 45 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

67
tools/FindSMB2UPTime.py
View file

@ -14,11 +14,11 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
import sys import re,sys,socket,struct
import os import os
import datetime import datetime
import struct import multiprocessing
import socket from socket import *
sys.path.insert(0, os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))) sys.path.insert(0, os.path.realpath(os.path.join(os.path.dirname(__file__), '..')))
from packets import SMBHeaderReq, SMB2NegoReq, SMB2NegoDataReq from packets import SMBHeaderReq, SMB2NegoReq, SMB2NegoDataReq
@ -30,7 +30,7 @@ def GetBootTime(data):
return time, time.strftime('%Y-%m-%d %H:%M:%S') return time, time.strftime('%Y-%m-%d %H:%M:%S')
def IsDCVuln(t): def IsDCVuln(t, host):
Date = datetime.datetime(2014, 11, 17, 0, 30) Date = datetime.datetime(2014, 11, 17, 0, 30)
if t[0] < Date: if t[0] < Date:
print "System is up since:", t[1] print "System is up since:", t[1]
@ -39,34 +39,55 @@ def IsDCVuln(t):
if t[0] < Date: if t[0] < Date:
print "System is up since:", t[1] print "System is up since:", t[1]
print "This system may be vulnerable to MS17-010" print "This system may be vulnerable to MS17-010"
print "DC is up since:", t[1] print "Server", host[0], "is up since:", t[1]
def run(host): def run(host):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s = socket(AF_INET, SOCK_STREAM)
s.connect(host)
s.settimeout(5) s.settimeout(5)
Header = SMBHeaderReq(Cmd="\x72",Flag1="\x18",Flag2="\x53\xc8")
Nego = SMB2NegoReq(Data = SMB2NegoDataReq())
Nego.calculate()
Packet = str(Header)+str(Nego)
Buffer = struct.pack(">i", len(Packet)) + Packet
s.send(Buffer)
try: try:
s.connect(host)
Header = SMBHeaderReq(Cmd="\x72",Flag1="\x18",Flag2="\x53\xc8")
Nego = SMB2NegoReq(Data = SMB2NegoDataReq())
Nego.calculate()
Packet = str(Header)+str(Nego)
Buffer = struct.pack(">i", len(Packet)) + Packet
s.send(Buffer)
data = s.recv(1024) data = s.recv(1024)
if data[4:5] == "\xff": if data[4:5] == "\xff":
print "This host doesn't support SMBv2" print "Server", host[0], "doesn't support SMBv2"
if data[4:5] == "\xfe": if data[4:5] == "\xfe":
IsDCVuln(GetBootTime(data[116:124])) IsDCVuln(GetBootTime(data[116:124]), host)
except Exception:
except KeyboardInterrupt:
s.close() s.close()
raise sys.exit("\rExiting...")
except:
s.close()
pass
def atod(a):
return struct.unpack("!L",inet_aton(a))[0]
def dtoa(d):
return inet_ntoa(struct.pack("!L", d))
if __name__ == "__main__": if __name__ == "__main__":
if len(sys.argv)<=1: if len(sys.argv)<=1:
sys.exit('Usage: python '+sys.argv[0]+' System-IP-address') sys.exit('Usage: python '+sys.argv[0]+' 10.1.3.37\nor:\nUsage: python '+sys.argv[0]+' 10.1.3.37/24')
host = sys.argv[1],445
run(host) m = re.search("/", str(sys.argv[1]))
if m :
net,_,mask = sys.argv[1].partition('/')
mask = int(mask)
net = atod(net)
threads = []
for host in (dtoa(net+n) for n in range(0, 1<<32-mask)):
p = multiprocessing.Process(target=run, args=((host,445),))
threads.append(p)
p.start()
else:
run((str(sys.argv[1]),445))