o
    ~(±j´%  ã                   @   sØ   d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZdZdddddd	œZe
 ¡ Zdddddd
œZdadaddd„Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zedkrjeƒ  dS dS )uL  
scan445.py â€”â€” æ…¢é€Ÿ + æŠ–åŠ¨ + éš�æœºé¡ºåº� çš„ SMB(445) æŽ¢æµ‹è„šæœ¬

ç”¨é€”ï¼šç»�å·²å»ºç«‹çš„ SOCKS5 éš§é�“ (127.0.0.1:1080 -> ç›®æ ‡ä¾§ t.aspx HTTP relay)
      å¯¹å†…ç½‘ C æ®µå�šä½Žå™ªå£°èµ„äº§å�‘çŽ°ï¼Œä¸ºæ¨ªå�‘ç§»åŠ¨æŒ‘é€‰å�¯ç”¨ SMB ç›®æ ‡ã€‚

ç”¨æ³•ï¼š
  python3 scan445.py --cidr 10.10.10.0/24 --port 445 --workers 4       --delay 1.2 2.6 --timeout 9 --out scan445_open.txt --log scan445_full.log

OPSEC è®¾è®¡ï¼š
  * ä¸»æœºé¡ºåº�éš�æœºæ´—ç‰Œï¼Œé�¿å…�"é¡ºåº�æ‰«æ®µ"ç‰¹å¾�
  * æ¯�å�°ä¸»æœºæŽ¢æµ‹å‰�éš�æœºç­‰å¾… --delay ç§’ï¼ˆé»˜è®¤ 1.2~2.6sï¼‰ï¼Œå¹¶å�‘å�— --workers é™�åˆ¶
  * è¿žä¸Š TCP å�Žå�ªå�‘ä¸€ä¸ª SMB2 NEGOTIATE è¯·æ±‚ï¼Œè¯» DialectRevision / SecurityModeï¼š
      - ç¡®è®¤çœŸæ˜¯ SMB æœ�åŠ¡ï¼ˆè€Œé�žå…¶å®ƒæœ�åŠ¡å�  445ï¼‰
      - æ‹¿ SMB ç‰ˆæœ¬ï¼ˆ2.0.2/2.1/3.0/3.0.2/3.1.1ï¼‰
      - çœ‹æ˜¯å�¦å¼ºåˆ¶ç­¾å��ï¼ˆsigning=required åˆ™ä¸�å�¯ NTLM ä¸­ç»§ï¼‰
  * åˆ†ç±»ï¼šOPEN / CLOSED(RST æ‹’ç»�) / FILTERED(è¶…æ—¶ä¸�å�¯è¾¾) / ERR
  * å�ªæœ‰ OPEN å†™ç»“æžœæ–‡ä»¶ï¼›å…¨é‡�æ˜Žç»†å†™æ—¥å¿—æ–‡ä»¶

ç»“æžœæ–‡ä»¶æ ¼å¼�ï¼ˆæ¯�è¡Œï¼‰ï¼š
  <ip>:<port>	<dialect>	signing=<required|enabled|off>	<rtt>
é    N)z	127.0.0.1i8  zSMB2.0.2zSMB2.1zSMB3.0zSMB3.0.2zSMB3.1.1©i  i  i   i  i  )ÚopenÚclosedÚfilteredÚerrÚdoneTc                 C   s€   t j  ¡  d¡}d|| f }t�& trt |d ¡ t ¡  |r.t|dd� W d  ƒ dS W d  ƒ dS 1 s9w   Y  dS )uI   æ‰“å�° + å†™æ—¥å¿—æ–‡ä»¶ï¼›important è¡Œä¸ºå®žæ—¶æ‰“å�°ï¼ˆOPEN/ERR ç­‰ï¼‰z%H:%M:%Sz[%s] %sÚ
T)ÚflushN)ÚdatetimeÚnowÚstrftimeÚ_lockÚ_fh_logÚwriter	   Úprint)ÚlineÚ	importantÚtsÚfull© r   ú
scan445.pyÚemit1   s   û"ür   c                 C   sF   d}t |ƒ|k r!|  |t |ƒ ¡}|stdƒ‚||7 }t |ƒ|k s|S )Nó    r   )ÚlenÚrecvÚIOError)ÚsÚnÚbufÚcr   r   r   Úrecvn=   s   ür    c                 C   sÞ   t   t jt j¡}| |¡ | t¡ | d¡ t|dƒ}|dkr&td| ƒ‚z
t  	| ¡d}}W n t
yG   tt| ƒgƒ|  ¡  d}}Y nw | dt|gƒ | t d|¡ ¡ t|dƒ}|d d	krmtd
|d  ƒ‚|S )uX   é€šè¿‡æœ¬åœ° SOCKS5 ä»£ç�†å»ºç«‹åˆ° host:port çš„ TCP è¿žæŽ¥ï¼ˆæˆ�åŠŸè¿”å›žè£¸ socketï¼‰s    é   s    zsocks greet fail %ré   é   z!Hé
   r   zsocks rep=%d)ÚsocketÚAF_INETÚSOCK_STREAMÚ
settimeoutÚconnectÚPROXYÚsendallr    r   Ú	inet_atonÚOSErrorÚbytesr   ÚencodeÚstructÚpack)ÚhostÚportÚtimeoutr   ÚgÚaddrÚatypÚrepr   r   r   Úsocks_connectG   s"   



 ÿ$
r9   c                 C   sÖ  g d¢}t  ddt|ƒdd¡}|t  dd¡7 }|t d¡7 }|t  dd¡7 }|D ]
}|t  d	|¡7 }q(d
t  d	d¡ }|t  dd¡7 }|t  dd¡7 }|t  d	d¡7 }|t  d	d¡7 }|t  dd¡7 }|t  dd¡7 }|t  dd¡7 }|t  dd¡7 }|t  dd¡7 }|t  dd¡7 }|d7 }|| }|  dt|ƒ dd¡ | ¡ d}t ¡ }t|ƒdk rÝt ¡ | dk rÝz|  d¡}W n
 t	j
yÇ   Y nw |sËn||7 }t|ƒdk rÝt ¡ | dk s¶t|ƒdk rådS t |dd… d¡d }t ¡ }t|ƒ|k �r4t ¡ | dk �r4z|  |t|ƒ ¡}W n t	j
�y   Y nw |�s n||7 }t|ƒ|k �r4t ¡ | dk �st|ƒdk �r=dS t |dd… d¡}	t |dd… d¡}
|	d@ �rXdn|	d@ �r_dnd}t |
d|
 ¡|fS )uE   å�‘ä¸€ä¸ª SMB2 NEGOTIATEï¼Œè¿”å›ž (dialect_str, signing_str) æˆ– Noner   z<HHHHé$   r"   r   z<Ié   z<Qz<Hs   þSMBé@   s                   ó    r#   Úbigr   é   é   i   NéJ   éF   éH   Úlittler!   ÚrequiredÚenabledÚoffz0x%04x)r0   r1   r   ÚosÚurandomr+   Úto_bytesÚtimer   r%   r4   ÚintÚ
from_bytesÚDIALECTSÚget)r   ÚdialectsÚbodyÚdÚhdrÚpktÚt0r   ÚneedÚsecmodeÚdialectÚsignr   r   r   Úsmb2_negotiate[   sj   ÿù ÿ ù rZ   c           
      C   s(  	 z|   ¡ }W n tjy   Y d S w t t |jd |jd ¡¡ t ¡ }�zfz©t||j	|j
ƒ}t ¡ | }d }zt|ƒ}W n ty[ } ztd||j	|f ƒ W Y d }~nd }~ww z| ¡  W n	 tyk   Y nw t�= td  d7  < td  d7  < tr¤|r•t d||j	|d |d |f ¡ nt d||j	|f ¡ t ¡  W d   ƒ n1 s®w   Y  |rÆtd	||j	|d |d |f ƒ n
td
||j	|f ƒ W n¶ t�yH } zjt|ƒ}t�9 td  d7  < d|v røtd  d7  < d}	nd|v �rtd  d7  < d}	n
td  d7  < d}	W d   ƒ n	1 �sw   Y  |	dk�r2td||j	|f ƒ ntd|	||j	f dd� W Y d }~nDd }~w t�y‡ } z3t� td  d7  < td  d7  < W d   ƒ n	1 �snw   Y  td||j	|f ƒ W Y d }~nd }~ww W |  ¡  n|  ¡  w q)NTr   r"   u#   WARN  %-15s :%d SMB æŽ¢æµ‹å¼‚å¸¸ %sr   r   z%s:%d	%s	signing=%s	%.1fs
z%s:%d	TCPOPEN_NO_SMB	-	%.1fs
z-OPEN      %-15s :%-5d %-8s signing=%-8s %.1fsu:   OPEN      %-15s :%-5d (TCP é€šï¼ŒSMB æ— å“�åº”)      %.1fszrep=4r   ÚFILTEREDzrep=5r   ÚCLOSEDr   ÚERRzERR       %-15s :%-5d %sz%-9s %-15s :%-5dF)r   )Ú
get_nowaitÚqueueÚEmptyrK   ÚsleepÚrandomÚuniformÚdelayr9   r3   r4   rZ   Ú	Exceptionr   Úcloser   Ú_statÚ
_fh_resultr   r	   r   ÚstrÚ	task_done)
ÚwqÚargsÚiprU   r   ÚrttÚinfoÚexÚmÚkindr   r   r   Úworker‘   s”   ÿ €ÿÿÿ
ÿ€öÿ
ÿ€
€ö
€þ €ü€Ärs   c               	      s*  t  ¡ } | jddd� | jdtdd� | jdtdd� | jd	td
ddgdd� | jdtdd� | jdddd� | jddd� | jddd� | jdtd d� |  ¡ ‰ tdd„ ˆ j d¡D ƒƒ‰dd„ t	j
ˆ jdd � ¡ D ƒ}‡fd!d„|D ƒ}t ˆ j¡ t |¡ tˆ jd"d#d$�atˆ jd"d#d$�atd%ˆ jˆ jt|ƒˆ jˆ jd& ˆ jd# ˆ jf ƒ td'ˆ jtˆƒp³d(f ƒ t ¡ ‰|D ]}ˆ |¡ q½t   ¡ }‡ ‡fd)d„t!ˆ jƒD ƒ}|D ]}| "¡  qØ|D ]}| #¡  qát   ¡ | }td*|t$d+ t$d, t$d- t$d. f ƒ td/ˆ jˆ jf ƒ t %¡  t %¡  d S )0Nz--cidrz10.10.10.0/24)Údefaultz--porti½  )Útypert   z	--workersr?   z--delayr!   g333333ó?gÍÌÌÌÌÌ@)ÚMINÚMAX)ru   Únargsrt   Úmetavarz	--timeoutg      "@z	--excludeÚ u   é€—å�·åˆ†éš”çš„æŽ’é™¤ IP)rt   Úhelpz--outzscan445_open.txtz--logzscan445_full.logz--shuffle-seedc                 s   s    � | ]}|  ¡ r|  ¡ V  qd S )N)Ústrip)Ú.0Úxr   r   r   Ú	<genexpr>à   s   € zmain.<locals>.<genexpr>ú,c                 S   s   g | ]}t |ƒ‘qS r   )ri   ©r}   Úhr   r   r   Ú
<listcomp>á   s    zmain.<locals>.<listcomp>F)Ústrictc                    s   g | ]}|ˆ vr|‘qS r   r   r�   )Úexclr   r   rƒ   â   s    Úar"   )Ú	bufferinguY   === scan445 å�¯åŠ¨: cidr=%s port=%d hosts=%d workers=%d delay=%.1f~%.1f timeout=%.1fs ===r   u-   === é¡ºåº�å·²éš�æœºåŒ–(seed=%s) æŽ’é™¤=%s ===u   æ— c                    s    g | ]}t jtˆˆ fd d�‘qS )T)Útargetrl   Údaemon)Ú	threadingÚThreadrs   )r}   Ú_)rl   rk   r   r   rƒ   ð   s    ÿuC   === å®Œæˆ�: ç”¨æ—¶ %.0fs | OPEN=%d CLOSED=%d FILTERED=%d ERR=%d ===r   r   r   r   u6   === å¼€æ”¾æ¸…å�•å·²å†™å…¥ %s ï¼ˆå…¨é‡�æ—¥å¿— %sï¼‰ ===)&ÚargparseÚArgumentParserÚadd_argumentrL   ÚfloatÚ
parse_argsÚsetÚexcludeÚsplitÚ	ipaddressÚ
ip_networkÚcidrÚhostsrb   ÚseedÚshuffle_seedÚshuffler   Úoutrh   Úlogr   r   r3   r   Úworkersrd   r4   Úsortedr_   ÚQueueÚputrK   ÚrangeÚstartÚjoinrg   rf   )Úpr˜   r‚   rU   ÚthsÚthÚdtr   )rl   r…   rk   r   ÚmainÑ   sT   ÿ
(ÿÿ

ÿr©   Ú__main__)T)Ú__doc__r�   r
   r•   rH   r_   rb   r%   r0   ÚsysrŠ   rK   r*   rN   ÚLockr   rg   rh   r   r   r    r9   rZ   rs   r©   Ú__name__r   r   r   r   Ú<module>   s:   ÿ

6@-
ÿ