From a205b580913c8caf06ecf921c5adddcd22046146 Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 15:08:42 +0200 Subject: [PATCH 1/7] Update SMB.py to fix single byte comparisons in python3 --- servers/SMB.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/servers/SMB.py b/servers/SMB.py index ff90aac..8507c33 100644 --- a/servers/SMB.py +++ b/servers/SMB.py @@ -200,7 +200,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP if not data: break - if data[0] == "\x81": #session request 139 + if data[0:1] == "\x81": #session request 139 Buffer = "\x82\x00\x00\x00" try: self.request.send(Buffer) @@ -335,7 +335,7 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version self.request.settimeout(1) data = self.request.recv(1024) Challenge = RandomChallenge() - if data[0] == b"\x81": #session request 139 + if data[0:1] == b"\x81": #session request 139 Buffer = "\x82\x00\x00\x00" self.request.send(NetworkSendBufferPython2or3(Buffer)) data = self.request.recv(1024) From 728b100bfd842fc0c8a4193d9100f0510967c12c Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 15:15:23 +0200 Subject: [PATCH 2/7] Update MSSQL.py to fix bug with single byte comparisons in python3 --- servers/MSSQL.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/servers/MSSQL.py b/servers/MSSQL.py index ed2b440..ce53f12 100755 --- a/servers/MSSQL.py +++ b/servers/MSSQL.py @@ -168,9 +168,9 @@ class MSSQLBrowser(BaseRequestHandler): if data: if data[0] in b'\x02\x03': # CLNT_BCAST_EX / CLNT_UCAST_EX self.send_response(soc, "MSSQLSERVER") - elif data[0] == b'\x04': # CLNT_UCAST_INST + elif data[0:1] == b'\x04': # CLNT_UCAST_INST self.send_response(soc, data[1:].rstrip("\x00")) - elif data[0] == b'\x0F': # CLNT_UCAST_DAC + elif data[0:1] == b'\x0F': # CLNT_UCAST_DAC self.send_dac_response(soc) def send_response(self, soc, inst): From 63954a539c78c6fb779d7962a28a67d9e44179fd Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 15:18:55 +0200 Subject: [PATCH 3/7] Update RelayMultiCore.py to fix bug with single byte comparisons in python3 --- tools/MultiRelay/RelayMultiCore.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/MultiRelay/RelayMultiCore.py b/tools/MultiRelay/RelayMultiCore.py index d82856a..3c1fa2d 100644 --- a/tools/MultiRelay/RelayMultiCore.py +++ b/tools/MultiRelay/RelayMultiCore.py @@ -636,7 +636,7 @@ def MimiKatzRPC(Command, f, host, data, s): Output = ExtractRPCCommandOutput(data)[12:] while True: dataoffset = dataoffset + buffsize - if data[64:66] == b"\x05\x00" and data[67] == b"\x02":##Last DCE/RPC Frag + if data[64:66] == b"\x05\x00" and data[67:68] == b"\x02":##Last DCE/RPC Frag LastFragLen = struct.unpack(' Date: Tue, 15 Aug 2023 15:34:08 +0200 Subject: [PATCH 4/7] Update RunFinger.py to fix bug with single byte comparisons in python3 --- tools/RunFinger.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/RunFinger.py b/tools/RunFinger.py index 7a9cd5f..bf9cadc 100755 --- a/tools/RunFinger.py +++ b/tools/RunFinger.py @@ -106,7 +106,7 @@ def ParseNegotiateSMB2Ans(data): def SMB2SigningMandatory(data): global SMB2signing - if data[70] == "\x03": + if data[70:71] == b"\x03": SMB2signing = "True" else: SMB2signing = "False" @@ -201,7 +201,7 @@ def IsDCVuln(t, host): ##################### def IsSigningEnabled(data): - if data[39] == "\x0f": + if data[39:40] == b"\x0f": return 'True' else: return 'False' @@ -364,7 +364,7 @@ def ConnectAndChoseSMB(host): return False def handle(data, host): - if data[28] == "\x00": + if data[28:29] == b"\x00": a = SMBv2Head() a.calculate() b = SMBv2Negotiate() @@ -373,7 +373,7 @@ def handle(data, host): buffer0 = longueur(packet0)+packet0 return buffer0 - if data[28] == "\x01": + if data[28:29] == b"\x01": global Bootime SMB2SigningMandatory(data) Bootime = IsDCVuln(GetBootTime(data[116:124]), host[0]) @@ -385,7 +385,7 @@ def handle(data, host): buffer0 = longueur(packet0)+packet0 return buffer0 - if data[28] == "\x02": + if data[28:29] == b"\x02": ParseSMBNTLM2Exchange(data, host[0], Bootime, SMB2signing) ################## From 4ec2631ab0aa6ab90cd14f05a0ad77154c755ced Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 15:36:10 +0200 Subject: [PATCH 5/7] Update Finger.py to fix bug with single byte comparisons in python3 --- tools/SMBFinger/Finger.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/SMBFinger/Finger.py b/tools/SMBFinger/Finger.py index 04c139a..5de42db 100755 --- a/tools/SMBFinger/Finger.py +++ b/tools/SMBFinger/Finger.py @@ -152,7 +152,7 @@ def color(txt, code = 1, modifier = 0): return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt) def IsSigningEnabled(data): - if data[39] == "\x0f": + if data[39:40] == b"\x0f": return True else: return False From b61a640747f38f0a264dd6d5fc7c73e2967f932a Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 15:50:53 +0200 Subject: [PATCH 6/7] Update SMB.py --- servers/SMB.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/servers/SMB.py b/servers/SMB.py index 8507c33..bac9c18 100644 --- a/servers/SMB.py +++ b/servers/SMB.py @@ -178,7 +178,7 @@ def IsNT4ClearTxt(data, client): WordCount = data[HeadLen] ChainedCmdOffset = data[HeadLen+1] - if ChainedCmdOffset == "\x75": + if ChainedCmdOffset == "\x75" or ChainedCmdOffset == 117: PassLen = struct.unpack(' 2: From 6063c2f77a56f23af9e461cf382dcb4444b14bd3 Mon Sep 17 00:00:00 2001 From: nobbd Date: Tue, 15 Aug 2023 16:03:30 +0200 Subject: [PATCH 7/7] Update SMB.py --- servers/SMB.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/servers/SMB.py b/servers/SMB.py index bac9c18..d6920aa 100644 --- a/servers/SMB.py +++ b/servers/SMB.py @@ -200,7 +200,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP if not data: break - if data[0:1] == "\x81": #session request 139 + if data[0:1] == b"\x81": #session request 139 Buffer = "\x82\x00\x00\x00" try: self.request.send(Buffer)