-- Chargement des librairies
local msrpc = require 'msrpc'
local smb = require 'smb'
local nmap = require 'nmap'
local stdnse = require 'stdnse'

-- Description du module
description = [[
  Uploads a file on the remote host and starts it.
]]

-- Informations générales
author = 'Otto'
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "safe"}

-- Règle pour l'execution du script
portrule = function(host, port)
  return (port.number == 445 or port.number == 139) and port.protocol == "tcp" and port.state == "open"
end

action = function(host, port)
  -- Récupérer les paramètres
  local domain = stdnse.get_script_args(SCRIPT_NAME .. '.domain') or ''
  local username = stdnse.get_script_args(SCRIPT_NAME .. '.username') or ''
  local password = stdnse.get_script_args(SCRIPT_NAME .. '.password') or ''
  local file = stdnse.get_script_args(SCRIPT_NAME .. '.file') or ''
  if(file == '') then
    nmap.log_write('stderr', 'You must provide a file path')
    return  -- Sortie
  end
  -- Upload du fichier;
  smb.file_upload(host,file,"ADMIN$",'\\' .. file, smb.get_overrides(username, domain,password))
  ----- Creation du service
   -- Connection au serveur distant
   status, smbstate = smb.start(host)
   if (not status) then
     nmap.log_write('stderr', 'Connection to remote server failed')
     return
   end
   -- Negotiation du protocole
   status, err      = smb.negotiate_protocol(smbstate)
   if (not status) then
    nmap.log_write('stderr', 'Protocol negotiation failed')
    return
   end
   -- Authentification
   status, err      = smb.start_session(smbstate, smb.get_overrides(username, domain, password))
   if (not status) then
     nmap.log_write('stderr', string.format('Session negotiation failed: %s', err))
     return
   end
   -- Connection à l'arbre
   status, err      = smb.tree_connect(smbstate, "IPC$", smb.get_overrides(username, domain, password))
   if (not status) then
     nmap.log_write('stderr', 'Unable to connect to IPC$ share')
     return
   end
   ---- Création du service
   status, service_manager = msrpc.svcctl_openscmanagera(smbstate,host.ip)
   if (not status) then
     nmap.log_write('stderr', 'Unable to get a handle on the service manager')
     return
   end
end