传说中的利用SMB协议检测操作系统类型CODE

来源：互联网发布：淘宝的ipad为什么便宜编辑：程序博客网时间：2024/06/05 01:54

Samba服务工作原理

Samba服务的具体工作过程如图所示。
① 首先客户端发送一个SMB negprot请求数据报，并列出它所支持的所有SMB协议版本。服务器收到请求信息后响应请求，并列出希望使用的协议版本。如果没有可使用的协议版本则返回0XFFFFH，结束通信。
② 协议确定后，客户端进程向服务器发起一个用户或共享的认证，这个过程是通过发送SesssetupX请求数据报实现的。客户端发送一对用户名和密码或一个简单密码到服务器，然后服务器通过发送一个SesssetupX应答数据报来允许或拒绝本次连接。
③ 当客户端和服务器完成了磋商和认证之后，它会发送一个Tcon或TconX SMB数据报并列出它想访问网络资源的名称，之后服务器会发送一个TconX应答数据报以表示此次连接是否被接受或拒绝。
④ 连接到相应资源后，SMB客户端就能够通过open SMB打开一个文件，通过read SMB读取文件，通过write SMB写入文件，通过close SMB关闭文件。

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/H2SO2H2SO2/archive/2009/05/14/4182803.aspx

传说中的利用SMB协议检测操作系统类型CODE 收藏

/*
* This is a little smb OS-detection tool which gets workgroup, smbserver and OS
* works for all tested samba versions on different platforms
* like: macosx,aix,solaris,linux,bsd and all Windows platforms !
* below you can see some sample outputs:
*
* Windows 2003 gives me:
* Remote OS:
* ----------
* WINDOMAIN1
* Windows Server 2003 5.2
* Windows Server 2003 3790
*
* Windows NT gives me:
* Remote OS:
* ----------
* WINDOMAIN2
* NT LAN Manager 4.0
* Windows NT 4.0
*
* Windows 2k gives me:
* Remote OS:
* ----------
* WINDOMAIN3
* Windows 2000 LAN Manager
* Windows 5.0
*
* Windows XP gives me:
* Remote OS:
* ----------
* WINDOMAIN4
* Windows 2000 LAN Manager
* Windows 5.1
*
* Samba gives me:
* Remote OS:
* ----------
* SAMBADOMAIN1
* Samba 2.0.7
* Unix
*
* COMPILE:
*   cl THCsmbgetOS.c
*
* RUN:
*   C:/ccode/THCsmbgetOS>THCsmbgetOS.exe gnpctx01
*
* -------------------------------------------------------
* THCsmbgetOS v0.1 - gets group, server and os via SMB
*      by Johnny Cyberpunk (jcyberpunk@thc.org)
* -------------------------------------------------------
*
* [*] Connecting Port 139....
* [*] Sending session request....
* [*] Sending negotiation request....
* [*] Sending setup account request....
* [*] Successful....
*
* Remote OS:
* ----------
* MYNTDOMAIN
* Windows Server 2003 5.2
* Windows Server 2003 3790
*
* Enjoy,
*
* http://www.thc.org
*/

#include <STDIO.H>
#include <STDLIB.H>
#include <STRING.H>
#include <WINSOCK2.H>

#pragma comment(lib, "ws2_32.lib")

char sessionrequest[] =
"/x81/x00/x00/x44/x20/x43/x4b/x46/x44/x45/x4e/x45/x43/x46/x44/x45"
"/x46/x46/x43/x46/x47/x45/x46/x46/x43/x43/x41/x43/x41/x43/x41/x43"
"/x41/x43/x41/x43/x41/x00/x20/x45/x4b/x45/x44/x46/x45/x45/x49/x45"
"/x44/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43"
"/x41/x43/x41/x43/x41/x41/x41/x00";

char negotiate[] =
"/x00/x00/x00/x2f/xff/x53/x4d/x42/x72/x00/x00/x00/x00/x00/x00/x00"
"/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x5c/x02"
"/x00/x00/x00/x00/x00/x0c/x00/x02/x4e/x54/x20/x4c/x4d/x20/x30/x2e"
"/x31/x32/x00";

char setupaccount[] =
"/x00/x00/x00/x48/xff/x53/x4d/x42/x73/x00/x00/x00/x00/x00/x00/x00"
"/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x5c/x02"
"/x00/x00/x00/x00/x0d/xff/x00/x00/x00/xff/xff/x02/x00/x5c/x02/x00"
"/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x01/x00/x00/x00/x0b"
"/x00/x00/x00/x6e/x74/00/x70/x79/x73/x6d/x62/x00";

int main(int argc, char *argv[])
{
unsigned short smbport=139;
unsigned char *infobuf;
unsigned int sock,addr,i;
int rc;
struct sockaddr_in smbtcp;
struct hostent * hp;
WSADATA wsaData;
unsigned int zeroc=0;

printf("/n-------------------------------------------------------/n");
printf(" THCsmbgetOS v0.1 - gets group, server and os via SMB/n");
printf("       by Johnny Cyberpunk (jcyberpunk@thc.org)/n");
printf("-------------------------------------------------------/n");

if(argc<2)
{
printf("gimme host or ip/n");
exit(-1);
}

if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0)
{
printf("WSAStartup failed !/n");
exit(-1);
}
hp = gethostbyname(argv[1]);

if (!hp){
addr = inet_addr(argv[1]);
}
if ((!hp) && (addr == INADDR_NONE) )
{
printf("Unable to resolve %s/n",argv[1]);
exit(-1);
}

sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (!sock)
{
printf("socket() error.../n");
exit(-1);
}

if (hp != NULL)
memcpy(&(smbtcp.sin_addr),hp->h_addr,hp->h_length);
else
smbtcp.sin_addr.s_addr = addr;

if (hp)
smbtcp.sin_family = hp->h_addrtype;
else
smbtcp.sin_family = AF_INET;

smbtcp.sin_port=htons(smbport);

//infobuf=malloc(256);
infobuf = new unsigned char[256];
memset(infobuf,0,256);
printf("/n[*] Connecting Port 139..../n");

rc=connect(sock, (struct sockaddr *) &smbtcp, sizeof (struct sockaddr_in));
if(rc==0)
{
printf("[*] Sending session request..../n");
send(sock,sessionrequest,sizeof(sessionrequest)-1,0);
Sleep(500);
rc=recv(sock,(char*)infobuf,256,0);
if(rc<0)
{
   printf("error = %d (rc=%u)/n/n",WSAGetLastError(),rc);
   return (-1);
}
memset(infobuf,0,256);
printf("[*] Sending negotiation request..../n");
send(sock,negotiate,sizeof(negotiate)-1,0);
Sleep(500);
rc=recv(sock,(char*)infobuf,256,0);
if(rc<0)
{
   printf("error = %d (rc=%u)/n/n",WSAGetLastError(),rc);
   return (-2);
}
memset(infobuf,0,256);
printf("[*] Sending setup account request..../n");
send(sock,setupaccount,sizeof(setupaccount)-1,0);
Sleep(500);
rc=recv(sock,(char*)infobuf,256,0);
if(rc<0)
{
   printf("error = %d (rc=%u)/n/n",WSAGetLastError(),rc);
   return (-3);
}
else if (rc==0)
{
   printf("[*] Successful..../n");
   printf("/nRemote OS:/n");
   printf("----------");
   printf("/nI got back a null buffer ! WINXP sometimes does it/n");
}
else
{
   printf("[*] Successful..../n");
   printf("/nRemote OS:/n");
   printf("----------");
   i=rc;
   while ((--i>0)&&(zeroc<4))
   {
    if (infobuf[i]==0x00)
    {
     printf("%s/n",(char *)&(infobuf[i+1]));
     zeroc++;
    }
   }
}

printf("/n/n");
}
else
printf("can't connect to smb port 139!/n");

shutdown(sock,1);
closesocket(sock);
free(infobuf);
exit(0);
}

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/H2SO2H2SO2/archive/2009/05/14/4182623.aspx