Gecko [ 196.203.21.74 ]

Name	Size	Permission
shellcode	[ DIR ]	drwxrwxrwx
BUG.txt	27.13 KB	-rw-rw-rw-
Nouveau document texte.txt	0 B	-rw-rw-rw-
README.md	3.29 KB	-rw-rw-rw-
checker.py	2.44 KB	-rw-rw-rw-
eternalblue_exploit7.py	25.12 KB	-rw-rw-rw-
eternalblue_exploit8.py	23.51 KB	-rw-rw-rw-
eternalblue_poc.py	3.71 KB	-rw-rw-rw-
eternalchampion_leak.py	1.51 KB	-rw-rw-rw-
eternalchampion_poc.py	2.53 KB	-rw-rw-rw-
eternalchampion_poc2.py	5.8 KB	-rw-rw-rw-
eternalromance_leak.py	1.61 KB	-rw-rw-rw-
eternalromance_poc.py	948 B	-rw-rw-rw-
eternalromance_poc2.py	4.99 KB	-rw-rw-rw-
eternalsynergy_leak.py	1.82 KB	-rw-rw-rw-
eternalsynergy_poc.py	2.95 KB	-rw-rw-rw-
infoleak_uninit.py	1.08 KB	-rw-rw-rw-
mysmb.py	16.28 KB	-rw-rw-rw-
mysmb.pyc	16.68 KB	-rw-rw-rw-
npp_control.py	1.8 KB	-rw-rw-rw-
pip.py	2.98 KB	-rw-rw-rw-
python	0 B	-rw-rw-rw-
smbold.py	41 KB	-rw-rw-rw-
win7.py	26.09 KB	-rw-rw-rw-
zzz_exploit.py	42.4 KB	-rw-rw-rw-

Code Editor : checker.py

from mysmb import MYSMB
from impacket import smb, smbconnection, nt_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
from struct import pack
import sys

'''
Script for
- check target if MS17-010 is patched or not.
- find accessible named pipe
'''

USERNAME = ''
PASSWORD = ''

NDR64Syntax = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')

MSRPC_UUID_BROWSER  = uuidtup_to_bin(('6BFFD098-A112-3610-9833-012892020162','0.0'))
MSRPC_UUID_SPOOLSS  = uuidtup_to_bin(('12345678-1234-ABCD-EF00-0123456789AB','1.0'))
MSRPC_UUID_NETLOGON = uuidtup_to_bin(('12345678-1234-ABCD-EF00-01234567CFFB','1.0'))
MSRPC_UUID_LSARPC   = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AB','0.0'))
MSRPC_UUID_SAMR     = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AC','1.0'))

pipes = {
	'browser'  : MSRPC_UUID_BROWSER,
	'spoolss'  : MSRPC_UUID_SPOOLSS,
	'netlogon' : MSRPC_UUID_NETLOGON,
	'lsarpc'   : MSRPC_UUID_LSARPC,
	'samr'     : MSRPC_UUID_SAMR,
}

if len(sys.argv) != 2:
	print("{} <ip>".format(sys.argv[0]))
	sys.exit(1)

target = sys.argv[1]

conn = MYSMB(target)
try:
	conn.login(USERNAME, PASSWORD)
except smb.SessionError as e:
	print('Login failed: ' + nt_errors.ERROR_MESSAGES[e.error_code][0])
	sys.exit()
finally:
	print('Target OS: ' + conn.get_server_os())

tid = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$')
conn.set_default_tid(tid)

# test if target is vulnerable
TRANS_PEEK_NMPIPE = 0x23
recvPkt = conn.send_trans(pack('<H', TRANS_PEEK_NMPIPE), maxParameterCount=0xffff, maxDataCount=0x800)
status = recvPkt.getNTStatus()
if status == 0xC0000205:  # STATUS_INSUFF_SERVER_RESOURCES
	print('The target is not patched')
else:
	print('The target is patched')
	sys.exit()

print('')
print('=== Testing named pipes ===')
for pipe_name, pipe_uuid in pipes.items():
	try:
		dce = conn.get_dce_rpc(pipe_name)
		dce.connect()
		try:
			dce.bind(pipe_uuid, transfer_syntax=NDR64Syntax)
			print('{}: Ok (64 bit)'.format(pipe_name))
		except DCERPCException as e:
			if 'transfer_syntaxes_not_supported' in str(e):
				print('{}: Ok (32 bit)'.format(pipe_name))
			else:
				print('{}: Ok ({})'.format(pipe_name, str(e)))
		dce.disconnect()
	except smb.SessionError as e:
		print('{}: {}'.format(pipe_name, nt_errors.ERROR_MESSAGES[e.error_code][0]))
	except smbconnection.SessionError as e:
		print('{}: {}'.format(pipe_name, nt_errors.ERROR_MESSAGES[e.error][0]))

conn.disconnect_tree(tid)
conn.logoff()
conn.get_socket().close()

${this.title}

Code Editor : checker.py