diff --git a/tools/RunFinger.py b/tools/RunFinger.py index 8190286..7a9cd5f 100755 --- a/tools/RunFinger.py +++ b/tools/RunFinger.py @@ -32,9 +32,7 @@ parser = optparse.OptionParser(usage='python %prog -i 10.10.10.224\nor:\npython parser.add_option('-i','--ip', action="store", help="Target IP address or class C", dest="TARGET", metavar="10.10.10.224", default=None) parser.add_option('-f','--filename', action="store", help="Target file", dest="Filename", metavar="ips.txt", default=None) -parser.add_option('-o','--outfile', action="store", help="Output file", dest="OutFilename", metavar="output.txt", default=None) parser.add_option('-t','--timeout', action="store", help="Timeout for all connections. Use this option to fine tune Runfinger.", dest="Timeout", type="float", metavar="0.9", default=2) -parser.add_option('-s','--smbv1', action='store_true', help="Enable smbv1 scan", dest="Smbv1", default=False) options, args = parser.parse_args() @@ -46,11 +44,9 @@ if options.TARGET == None and options.Filename == None: Timeout = options.Timeout Host = options.TARGET Filename = options.Filename -Outputfile = None if options.OutFilename==None else open(options.OutFilename,"w") SMB1 = "True" SMB2signing = "False" DB = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/RunFinger.db" -SCAN_SMBV1 = options.Smbv1 class Packet(): fields = OrderedDict([ @@ -73,10 +69,10 @@ else: if not os.path.exists(DB): - cursor = sqlite3.connect(DB) - cursor.execute('CREATE TABLE RunFinger (timestamp TEXT, Protocol TEXT, Host TEXT, WindowsVersion TEXT, OsVer TEXT, DomainJoined TEXT, Bootime TEXT, Signing TEXT, NullSess TEXT, IsRDPOn TEXT, SMB1 TEXT, MSSQL TEXT)') - cursor.commit() - cursor.close() + cursor = sqlite3.connect(DB) + cursor.execute('CREATE TABLE RunFinger (timestamp TEXT, Protocol TEXT, Host TEXT, WindowsVersion TEXT, OsVer TEXT, DomainJoined TEXT, Bootime TEXT, Signing TEXT, NullSess TEXT, IsRDPOn TEXT, SMB1 TEXT, MSSQL TEXT)') + cursor.commit() + cursor.close() def StructWithLenPython2or3(endian,data): #Python2... @@ -103,108 +99,104 @@ def longueur(payload): return length def ParseNegotiateSMB2Ans(data): - if data[4:8] == b"\xfeSMB": - return True - else: - return False + if data[4:8] == b"\xfeSMB": + return True + else: + return False def SMB2SigningMandatory(data): - global SMB2signing - if data[70] == "\x03": - SMB2signing = "True" - else: - SMB2signing = "False" + global SMB2signing + if data[70] == "\x03": + SMB2signing = "True" + else: + SMB2signing = "False" def WorkstationFingerPrint(data): - return { - b"\x04\x00" :"Windows 95", - b"\x04\x0A" :"Windows 98", - b"\x04\x5A" :"Windows ME", - b"\x05\x00" :"Windows 2000", - b"\x05\x01" :"Windows XP", - b"\x05\x02" :"Windows XP(64-Bit)/Windows 2003", - b"\x06\x00" :"Windows Vista/Server 2008", - b"\x06\x01" :"Windows 7/Server 2008R2", - b"\x06\x02" :"Windows 8/Server 2012", - b"\x06\x03" :"Windows 8.1/Server 2012R2", - b"\x0A\x00" :"Windows 10/Server 2016/2019 (check build)", - }.get(data, 'Other than Microsoft') + return { + b"\x04\x00" :"Windows 95", + b"\x04\x0A" :"Windows 98", + b"\x04\x5A" :"Windows ME", + b"\x05\x00" :"Windows 2000", + b"\x05\x01" :"Windows XP", + b"\x05\x02" :"Windows XP(64-Bit)/Windows 2003", + b"\x06\x00" :"Windows Vista/Server 2008", + b"\x06\x01" :"Windows 7/Server 2008R2", + b"\x06\x02" :"Windows 8/Server 2012", + b"\x06\x03" :"Windows 8.1/Server 2012R2", + b"\x0A\x00" :"Windows 10/Server 2016/2019 (check build)", + }.get(data, 'Other than Microsoft') def GetOsBuildNumber(data): - ProductBuild = struct.unpack("