Skip to content

Commit d4be8ab

Browse files
author
3gstudent
committed
source
1 parent d617ee2 commit d4be8ab

9 files changed

+130
-0
lines changed

Diff for: ‎Smbtouch-1.1.1.exe

140 KB
Binary file not shown.

Diff for: ‎Smbtouch-1.1.1.xml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?xml version='1.0' encoding='utf-8'?>
2+
<config xmlns='urn:trch' name='Smbtouch' version='1.1.1' schemaversion='2.1.0' configversion='1.1.1.0' id='985f383e6edd6d9397aa5da9601c8bc867f6b713'>
3+
<inputparameters>
4+
<parameter type='S16' name='NetworkTimeout' description='Timeout for blocking network calls (in seconds). Use -1 for no timeout.'>
5+
<value>60</value>
6+
</parameter>
7+
<parameter type='IPv4' name='TargetIp' description='Target IP Address'>
8+
<value>127.0.0.1</value>
9+
</parameter>
10+
<parameter type='TcpPort' name='TargetPort' description='Port used by the SMB service'>
11+
<value>445</value>
12+
</parameter>
13+
<parameter hidden='true' required='false' type='IPv4' name='RedirectedTargetIp' description='Physical (redirected) target IP'/>
14+
15+
<parameter hidden='true' required='false' type='TcpPort' name='RedirectedTargetPort' description='Physical (redirected) target port'/>
16+
<paramchoice name='Protocol' description='SMB (default port 445) or NBT (default port 139)'>
17+
<value>SMB</value>
18+
<paramgroup name='SMB' description=''>
19+
<parameter hidden='true' type='Boolean' name='UsingNbt' description='Boolean stating to use Nbt or not'>
20+
<value>0</value>
21+
</parameter>
22+
</paramgroup>
23+
<paramgroup name='NBT' description=''>
24+
<parameter hidden='true' type='Boolean' name='UsingNbt' description='Boolean stating to use Nbt or not'>
25+
<value>1</value>
26+
</parameter>
27+
</paramgroup>
28+
</paramchoice>
29+
<parameter type='String' name='Pipe' description='Test an additional pipe to see if it is accessible (optional)'>
30+
<default/>
31+
</parameter>
32+
<parameter type='Buffer' name='Share' description='Test a file share to see if it is accessible (optional), entered as hex bytes (in unicode)'>
33+
<default/>
34+
</parameter>
35+
<paramchoice name='Credentials' description='Type of credentials to use'>
36+
<value>Anonymous</value>
37+
<paramgroup name='Anonymous' description='Anonymous (NULL session)'/>
38+
<paramgroup name='Guest' description='Guest account'/>
39+
<paramgroup name='Blank' description='User account with no password set'>
40+
<parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>
41+
</paramgroup>
42+
<paramgroup name='Password' description='User name and password'>
43+
<parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>
44+
<parameter type='Buffer' name='Password' description='Password entered as hex bytes (in unicode)'/>
45+
</paramgroup>
46+
<paramgroup name='NTLM' description='User name and NTLM hash'>
47+
<parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>
48+
<parameter type='Buffer' name='NtlmHash' description='NTLM password hash (in hex)'/>
49+
</paramgroup>
50+
</paramchoice>
51+
</inputparameters>
52+
<constants>
53+
<parameter type='U8' name='Anonymous' description=''>
54+
<value>0</value>
55+
</parameter>
56+
<parameter type='U8' name='Guest' description=''>
57+
<value>1</value>
58+
</parameter>
59+
<parameter type='U8' name='Blank' description=''>
60+
<value>2</value>
61+
</parameter>
62+
<parameter type='U8' name='Password' description=''>
63+
<value>3</value>
64+
</parameter>
65+
<parameter type='U8' name='NTLM' description=''>
66+
<value>4</value>
67+
</parameter>
68+
</constants>
69+
70+
</config>

Diff for: ‎SmbtouchScanner.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/env python
2+
#
3+
# Smbtouch Scanner
4+
# By: 3gstudent
5+
# License: BSD 3-Clause
6+
'''
7+
8+
Automatically scan the inner network.
9+
Use Smbtouch.exe to detect whether the target is vulnerable.
10+
Protocol: SMB
11+
Scan port:445
12+
Note:
13+
You can also use protocl NBT and port 139,just change the Smbtouch-1.1.1.xml
14+
15+
You can get Smbtouch.exe from this:
16+
https://github.com/x0rz/EQGRP_Lost_in_Translation/blob/master/windows/touches/Smbtouch-1.1.1.exe
17+
18+
'''
19+
import os
20+
import fileinput
21+
#Start IP,change it
22+
BeginIP = '192.168.1.1'
23+
#End IP,change it
24+
EndIP = '192.168.1.10'
25+
#Log file
26+
fp = open('log.txt', 'w+')
27+
28+
OldIP = ' <value>127.0.0.1</value>'
29+
TempIP = OldIP
30+
IP1 = BeginIP.split('.')[0]
31+
IP2 = BeginIP.split('.')[1]
32+
IP3 = BeginIP.split('.')[2]
33+
IP4 = BeginIP.split('.')[-1]
34+
EndIP_last = EndIP.split('.')[-1]
35+
36+
for i in range(int(IP4)-1,int(EndIP_last)):
37+
ip = str(IP1+'.'+IP2+'.'+IP3+'.'+IP4)
38+
int_IP4 = int(IP4)
39+
int_IP4 += 1
40+
IP4 = str(int_IP4)
41+
NewIP= ' <value>'+ip+'</value>'
42+
for line in fileinput.input('Smbtouch-1.1.1.xml',inplace=1):
43+
print line.rstrip().replace(TempIP,NewIP)
44+
TempIP = NewIP
45+
Output = os.popen(r"Smbtouch-1.1.1.exe").read()
46+
Output = Output[0:Output.find('<config',1)]
47+
fp.writelines(Output)
48+
Flag = Output.find('[-] Touch failed')
49+
if Flag == -1 :
50+
print '[+] Touch success: ' +ip
51+
else:
52+
print '[-] Touch failed: ' +ip
53+
else:
54+
fp.close( )
55+
for line in fileinput.input('Smbtouch-1.1.1.xml',inplace=1):
56+
print line.rstrip().replace(NewIP,OldIP)
57+
58+
59+
60+

Diff for: ‎posh-0.dll

11 KB
Binary file not shown.

Diff for: ‎tibe-2.dll

232 KB
Binary file not shown.

Diff for: ‎trch-1.dll

58.5 KB
Binary file not shown.

Diff for: ‎trfo-2.dll

29 KB
Binary file not shown.

Diff for: ‎tucl-1.dll

9 KB
Binary file not shown.

Diff for: ‎ucl.dll

57 KB
Binary file not shown.

0 commit comments

Comments
 (0)