[
  {
    "path": "LICENSE",
    "content": "BSD 3-Clause License\n\nCopyright (c) 2017, \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\n* Neither the name of the copyright holder nor the names of its\n  contributors may be used to endorse or promote products derived from\n  this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
  {
    "path": "README.md",
    "content": "# Smbtouch-Scanner\n\n\nAuthor: 3gstudent\n\nLicense: BSD 3-Clause\n\n---\nAutomatically scan the inner network.\n\nUse Smbtouch.exe to detect whether the target is vulnerable.\n\n**List of vulnerabilities：**\n\n- ETERNALBLUE\n- ETERNALCHAMPION\n- ETERNALROMANCE\n- ETERNALSYNERGY\n\n\nProtocol: SMB\n\nScan port:445\n\n**Note:**\n\n   You can also use protocl NBT and port 139,just change the Smbtouch-1.1.1.xml\n\nYou can get Smbtouch.exe from this:\n\nhttps://github.com/x0rz/EQGRP_Lost_in_Translation/blob/master/windows/touches/Smbtouch-1.1.1.exe\n\nor\n\nhttps://github.com/fuzzbunch/fuzzbunch/blob/master/touches/Smbtouch-1.1.1.exe\n\nMore details:\n\nhttps://3gstudent.github.io/%E5%86%85%E7%BD%91%E5%AE%89%E5%85%A8-%E5%88%A9%E7%94%A8NSA-Smbtouch%E6%89%B9%E9%87%8F%E6%A3%80%E6%B5%8B%E5%86%85%E7%BD%91\n\n---\n\nMaybe need to use multithread to improve efficiency.\n"
  },
  {
    "path": "Smbtouch-1.1.1.xml",
    "content": "<?xml version='1.0' encoding='utf-8'?>\n<config xmlns='urn:trch' name='Smbtouch' version='1.1.1' schemaversion='2.1.0' configversion='1.1.1.0' id='985f383e6edd6d9397aa5da9601c8bc867f6b713'>\n  <inputparameters>\n    <parameter type='S16' name='NetworkTimeout' description='Timeout for blocking network calls (in seconds).  Use -1 for no timeout.'>\n      <value>60</value>\n    </parameter>\n    <parameter type='IPv4' name='TargetIp' description='Target IP Address'>\n      <value>127.0.0.1</value>\n    </parameter>\n    <parameter type='TcpPort' name='TargetPort' description='Port used by the SMB service'>\n      <value>445</value>\n    </parameter>\n    <parameter hidden='true' required='false' type='IPv4' name='RedirectedTargetIp' description='Physical (redirected) target IP'/>\n\n    <parameter hidden='true' required='false' type='TcpPort' name='RedirectedTargetPort' description='Physical (redirected) target port'/>\n    <paramchoice name='Protocol' description='SMB (default port 445) or NBT (default port 139)'>\n      <value>SMB</value>\n      <paramgroup name='SMB' description=''>\n        <parameter hidden='true' type='Boolean' name='UsingNbt' description='Boolean stating to use Nbt or not'>\n          <value>0</value>\n        </parameter>\n      </paramgroup>\n      <paramgroup name='NBT' description=''>\n        <parameter hidden='true' type='Boolean' name='UsingNbt' description='Boolean stating to use Nbt or not'>\n          <value>1</value>\n        </parameter>\n      </paramgroup>\n    </paramchoice>\n    <parameter type='String' name='Pipe' description='Test an additional pipe to see if it is accessible (optional)'>\n      <default/>\n    </parameter>\n    <parameter type='Buffer' name='Share' description='Test a file share to see if it is accessible (optional), entered as hex bytes (in unicode)'>\n      <default/>\n    </parameter>\n    <paramchoice name='Credentials' description='Type of credentials to use'>\n      <value>Anonymous</value>\n      <paramgroup name='Anonymous' description='Anonymous (NULL session)'/>\n      <paramgroup name='Guest' description='Guest account'/>\n      <paramgroup name='Blank' description='User account with no password set'>\n        <parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>\n      </paramgroup>\n      <paramgroup name='Password' description='User name and password'>\n        <parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>\n        <parameter type='Buffer' name='Password' description='Password entered as hex bytes (in unicode)'/>\n      </paramgroup>\n      <paramgroup name='NTLM' description='User name and NTLM hash'>\n        <parameter type='Buffer' name='Username' description='Username entered as hex bytes (in unicode)'/>\n        <parameter type='Buffer' name='NtlmHash' description='NTLM password hash (in hex)'/>\n      </paramgroup>\n    </paramchoice>\n  </inputparameters>\n  <constants>\n    <parameter type='U8' name='Anonymous' description=''>\n      <value>0</value>\n    </parameter>\n    <parameter type='U8' name='Guest' description=''>\n      <value>1</value>\n    </parameter>\n    <parameter type='U8' name='Blank' description=''>\n      <value>2</value>\n    </parameter>\n    <parameter type='U8' name='Password' description=''>\n      <value>3</value>\n    </parameter>\n    <parameter type='U8' name='NTLM' description=''>\n      <value>4</value>\n    </parameter>\n  </constants>\n\n</config>\n"
  },
  {
    "path": "SmbtouchScanner.py",
    "content": "\n#\n# Smbtouch Scanner\n# By: 3gstudent\n# License: BSD 3-Clause\n'''\n\nAutomatically scan the inner network.\nUse Smbtouch.exe to detect whether the target is vulnerable.\nProtocol: SMB\nScan port:445\nNote:\n   You can also use protocl NBT and port 139,just change the Smbtouch-1.1.1.xml\n\nYou can get Smbtouch.exe from this:\nhttps://github.com/x0rz/EQGRP_Lost_in_Translation/blob/master/windows/touches/Smbtouch-1.1.1.exe\n\n'''\nimport os\nimport fileinput\n#Start IP,change it\nBeginIP = '192.168.1.1'\n#End IP,change it\nEndIP = '192.168.1.10'\n#Log file\nfp = open('log.txt', 'w+')\n\nOldIP = '      <value>127.0.0.1</value>'\nTempIP = OldIP\nIP1 =  BeginIP.split('.')[0]\nIP2 =  BeginIP.split('.')[1]\nIP3 =  BeginIP.split('.')[2]\nIP4 = BeginIP.split('.')[-1]\nEndIP_last = EndIP.split('.')[-1]\n\nfor i in range(int(IP4)-1,int(EndIP_last)):\n     ip = str(IP1+'.'+IP2+'.'+IP3+'.'+IP4)\n     int_IP4 = int(IP4)\n     int_IP4 += 1\n     IP4 = str(int_IP4)\n     NewIP= '      <value>'+ip+'</value>'\n     for line in fileinput.input('Smbtouch-1.1.1.xml',inplace=1):  \n     \tprint line.rstrip().replace(TempIP,NewIP)\n     TempIP = NewIP\t\t\t     \n     Output = os.popen(r\"Smbtouch-1.1.1.exe\").read()\n     Output = Output[0:Output.find('<config',1)]\n     fp.writelines(Output)\n     Flag = Output.find('[-] Touch failed')\n     if Flag == -1 :\n\tprint '[+] Touch success:\t' +ip\n     else:  \n\tprint '[-] Touch failed:\t' +ip\nelse:\n     fp.close( )     \n     for line in fileinput.input('Smbtouch-1.1.1.xml',inplace=1):  \n     \tprint line.rstrip().replace(NewIP,OldIP)\n\n\n\n\n"
  }
]