what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

THCsmbgetOS.c

THCsmbgetOS.c
Posted Apr 20, 2004
Authored by thc, Johnny Cyberpunk | Site thc.org

A small, but very useful SMB OS-detection tool which gets workgroup, smbserver and operating system. It works for all tested samba versions on different platforms like Mac OSX, AIX, Solaris, Linux, BSD, and all Microsoft Windows platforms.

systems | linux, windows, solaris, bsd, aix, apple
SHA-256 | 15e66dd0f9ffc8a4ba1ade94a6b6fa5ed858378503b48dd688db6c38623db32a

THCsmbgetOS.c

Change Mirror Download
/*
* This is a little smb OS-detection tool which gets workgroup, smbserver and OS
* works for all tested samba versions on different platforms
* like: macosx,aix,solaris,linux,bsd and all Windows platforms !
* below you can see some sample outputs:
*
* Windows 2003 gives me:
* Remote OS:
* ----------
* WINDOMAIN1
* Windows Server 2003 5.2
* Windows Server 2003 3790
*
* Windows NT gives me:
* Remote OS:
* ----------
* WINDOMAIN2
* NT LAN Manager 4.0
* Windows NT 4.0
*
* Windows 2k gives me:
* Remote OS:
* ----------
* WINDOMAIN3
* Windows 2000 LAN Manager
* Windows 5.0
*
* Windows XP gives me:
* Remote OS:
* ----------
* WINDOMAIN4
* Windows 2000 LAN Manager
* Windows 5.1
*
* Samba gives me:
* Remote OS:
* ----------
* SAMBADOMAIN1
* Samba 2.0.7
* Unix
*
* COMPILE:
* cl THCsmbgetOS.c
*
* RUN:
* C:\ccode\THCsmbgetOS>THCsmbgetOS.exe gnpctx01
*
* -------------------------------------------------------
* THCsmbgetOS v0.1 - gets group, server and os via SMB
* by Johnny Cyberpunk (jcyberpunk@thc.org)
* -------------------------------------------------------
*
* [*] Connecting Port 139....
* [*] Sending session request....
* [*] Sending negotiation request....
* [*] Sending setup account request....
* [*] Successful....
*
* Remote OS:
* ----------
* MYNTDOMAIN
* Windows Server 2003 5.2
* Windows Server 2003 3790
*
* Enjoy,
*
* http://www.thc.org
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>

#pragma comment(lib, "ws2_32.lib")

char sessionrequest[] =
"\x81\x00\x00\x44\x20\x43\x4b\x46\x44\x45\x4e\x45\x43\x46\x44\x45"
"\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43\x41\x43\x41\x43\x41\x43"
"\x41\x43\x41\x43\x41\x00\x20\x45\x4b\x45\x44\x46\x45\x45\x49\x45"
"\x44\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"
"\x41\x43\x41\x43\x41\x41\x41\x00";

char negotiate[] =
"\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"
"\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e"
"\x31\x32\x00";

char setupaccount[] =
"\x00\x00\x00\x48\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"
"\x00\x00\x00\x00\x0d\xff\x00\x00\x00\xff\xff\x02\x00\x5c\x02\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0b"
"\x00\x00\x00\x6e\x74\00\x70\x79\x73\x6d\x62\x00";

int main(int argc, char *argv[])
{
unsigned short smbport=139;
unsigned char *infobuf;
unsigned int sock,addr,i;
int rc;
struct sockaddr_in smbtcp;
struct hostent * hp;
WSADATA wsaData;
unsigned int zeroc=0;

printf("\n-------------------------------------------------------\n");
printf(" THCsmbgetOS v0.1 - gets group, server and os via SMB\n");
printf(" by Johnny Cyberpunk (jcyberpunk@thc.org)\n");
printf("-------------------------------------------------------\n");

if(argc<2)
{
printf("gimme host or ip\n");
exit(-1);
}

if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0)
{
printf("WSAStartup failed !\n");
exit(-1);
}

hp = gethostbyname(argv[1]);

if (!hp){
addr = inet_addr(argv[1]);
}
if ((!hp) && (addr == INADDR_NONE) )
{
printf("Unable to resolve %s\n",argv[1]);
exit(-1);
}

sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (!sock)
{
printf("socket() error...\n");
exit(-1);
}

if (hp != NULL)
memcpy(&(smbtcp.sin_addr),hp->h_addr,hp->h_length);
else
smbtcp.sin_addr.s_addr = addr;

if (hp)
smbtcp.sin_family = hp->h_addrtype;
else
smbtcp.sin_family = AF_INET;

smbtcp.sin_port=htons(smbport);

infobuf=malloc(256);
memset(infobuf,0,256);

printf("\n[*] Connecting Port 139....\n");

rc=connect(sock, (struct sockaddr *) &smbtcp, sizeof (struct sockaddr_in));
if(rc==0)
{
printf("[*] Sending session request....\n");
send(sock,sessionrequest,sizeof(sessionrequest)-1,0);
Sleep(500);
rc=recv(sock,infobuf,256,0);
if(rc<0)
{
printf("error = %d (rc=%u)\n\n",WSAGetLastError(),rc);
return (-1);
}
memset(infobuf,0,256);
printf("[*] Sending negotiation request....\n");
send(sock,negotiate,sizeof(negotiate)-1,0);
Sleep(500);
rc=recv(sock,infobuf,256,0);
if(rc<0)
{
printf("error = %d (rc=%u)\n\n",WSAGetLastError(),rc);
return (-2);
}
memset(infobuf,0,256);
printf("[*] Sending setup account request....\n");
send(sock,setupaccount,sizeof(setupaccount)-1,0);
Sleep(500);
rc=recv(sock,infobuf,256,0);
if(rc<0)
{
printf("error = %d (rc=%u)\n\n",WSAGetLastError(),rc);
return (-3);
}
else if (rc==0)
{
printf("[*] Successful....\n");
printf("\nRemote OS:\n");
printf("----------");
printf("\nI got back a null buffer ! WINXP sometimes does it\n");
}
else
{
printf("[*] Successful....\n");
printf("\nRemote OS:\n");
printf("----------");
i=rc;
while ((--i>0)&&(zeroc<4))
{
if (infobuf[i]==0x00)
{
printf("%s\n",(char *)&(infobuf[i+1]));
zeroc++;
}
}
}

printf("\n\n");
}
else
printf("can't connect to smb port 139!\n");

shutdown(sock,1);
closesocket(sock);
free(infobuf);
exit(0);
}
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close