smb-share-find-files

#!/usr/bin/env python3

import argparse
import sys
import queue
import re
from concurrent.futures import ThreadPoolExecutor as PoolExecutor
from netaddr import *

from impacket.dcerpc.v5 import samr, transport, srvs
from impacket.dcerpc.v5.dtypes import NULL
from impacket.smbconnection import *

## FUNCTIONS

def is_ntlm(password):
    try:
        if len(password.split(':')) == 2:
            lm, ntlm = password.split(':')
            if len(lm) == 32 and len(ntlm) == 32:
                return True
            else:
                return False
    except Exception as e:
        return False

def connect(host, path, username, password, domain, timeout, recurse, patterns, quiet, out_files, out_folders):
    sys.stderr.write(f"[+] Started searching \\\\{host}\\{path}\n")
    try:
        smb = SMBConnection(host, host, sess_port=445, timeout=timeout)
        if is_ntlm(password):
            lmhash, nthash = password.split(':')
            smb.login(username, '', domain=domain,lmhash=lmhash, nthash=nthash)
        else:
            smb.login(username, password, domain=domain)
    except Exception as e:
        sys.stderr.write(f"[!] {host} : {e}\n")
        return

    seperators = path.count('\\')
    if seperators > 0:
        share, path = path.split('\\', 1)
    else:
        share, path = path, ''

    list_directory(smb, host, share, path, recurse, patterns, quiet, out_files, out_folders)

    smb.logoff()
    sys.stderr.write(f"[+] Finished searching \\\\{host}\\{share}\\{path}\n")

def list_directory(smb, host, share, path, depth, patterns, quiet, out_files, out_folders):
    path = path.strip('\\')

    try:
        paths = smb.listPath(share, f"{path}\\*")

        for p in paths:
            name = p.get_longname().strip()
            if name != '.' and name != '..':
                for pattern in patterns:
                    if re.search(pattern, name, re.IGNORECASE):
                        if (not out_folders and not out_files) or (out_folders and out_files) or (p.is_directory() and (out_folders and not out_files)) or (not p.is_directory() and (not out_folders and out_files)):
                            sys.stdout.write(f"\\\\{host}\\{share}\\{path}\\{name}\n")
                            sys.stdout.flush()

        if depth == 0:
            return

        for p in paths:
            name = p.get_longname().strip()
            if name != '.' and name != '..' and name != 'desktop.ini' and name != 'System Volume Information':
                if p.is_directory():
                    list_directory(smb, host, share, f"{path}\\{name}", (depth-1), patterns, quiet, out_files, out_folders)

    except Exception as e:
        if not (quiet and (str(e).find('STATUS_ACCESS_DENIED') != -1)):
            sys.stderr.write(f"[!] \\\\{host}\\{share}\\{path} : {e}\n")
        return

## MAIN

# parse the arguments
parser = argparse.ArgumentParser(description='Search for interesting files/folders on target hosts')
parser.add_argument('-u','--user',help='SMB user to connect with', default='', required=False)
parser.add_argument('-p','--password',help='SMB password to connect with', default='', required=False)
parser.add_argument('-d','--domain',help='SMB domain to connect with', default='', required=False)
parser.add_argument('-t','--threads',type=int,help='Number of threads (Default: 5)', default=5, required=False)
parser.add_argument('-r','--recursive',type=int,help='Recursive folder depth (Default: 0)', default=0, required=False)
parser.add_argument('-s','--search',help='Keyword to search for, i.e., *assword,secret', default='', required=False)
parser.add_argument('-sf','--searchfile',help='File of keywords to search for', default='', required=False)
parser.add_argument('--timeout',type=int,help='Connection timeout (Default: 5)', default=5, required=False)
parser.add_argument('--users',action='store_true',help='Limit searching to the C:\\Users folder', required=False)
parser.add_argument('--office',action='store_true',help='Include search for office documents', required=False)
parser.add_argument('--sensitive',action='store_true',help='Include search for sensitive files', required=False)
parser.add_argument('--quiet',action='store_true',help='Don\'t print \'Access Denied\' error messages', required=False)
parser.add_argument('--folders',action='store_true',help='Only output folders when searching', required=False)
parser.add_argument('--files',action='store_true',help='Only output files when searching', required=False)
parser.add_argument('file',
                    nargs='?',
                    type=argparse.FileType('r'),
                    action='store',
                    help='File containing a list of UNC paths split by a newline, otherwise read from STDIN',
                    metavar='FILE',
                    default=sys.stdin)
args = parser.parse_args()

try:
    uncs = [line.strip() for line in args.file if len(line.strip())>0 and line[0] != '#']
except KeyboardInterrupt:
    exit()

patterns = list()

if args.searchfile != '':
    try:
        patterns = [line.strip() for line in args.searchfile if len(line.strip())>0 and line[0] != '#']
    except KeyboardInterrupt:
        exit()

if args.search != '':
    searches = set()
    if args.search.find(',') != -1:
        instances = args.search.split(',')
        for i in instances:
            i = i.strip()
            if len(i)>0:
                searches.add(i)
    else:
        searches.add(args.search)

    for search in searches:
        patterns.append(search)

print(patterns)

if args.office:
    patterns.append('.*\.doc(|x)$')
    patterns.append('.*\.xls(|x)$')
    patterns.append('.*\.ppt(|x)$')

if args.sensitive:
    patterns.append('password')
    patterns.append('sensitive')
    patterns.append('login')
    patterns.append('secret')
    patterns.append('private')
    patterns.append('creds')
    patterns.append('credential')
    patterns.append('credit')
    patterns.append('credit[ |_|-]card')
    patterns.append('ccard')
    patterns.append('[ |_|-]cc[ |_|-]')
    patterns.append('(mastercard|visa|amex|american[ |_|-]express)')
    patterns.append('passport')
    patterns.append('ssn')
    patterns.append('social[ |_|-]security[ |_|-]number')
    patterns.append('\.kdb(|x)$')
    patterns.append('unattend.*\.(xml|txt)')
    patterns.append('^sysprep\.')
    patterns.append('\.key$')
    patterns.append('\.crt$')
    patterns.append('\.pcf$')
    patterns.append('\.ica$')
    patterns.append('vnc\.ini')
    patterns.append('^winscp\.ini$')
    patterns.append('^ws_ftp\.ini$')

if not patterns:
    patterns.append('.*')

if args.users:
    sys.stderr.write(f"[*] Note, the --users flag has been set, all supplied share names and paths will be ignored.\n")

with PoolExecutor(args.threads) as pool:
    hosts = set()
    for unc in uncs:
        try:
            host, path = unc.strip('\\').split('\\', 1)
            if args.users:
                if host in hosts:
                    continue
                hosts.add(host)
                path = 'C$\\Users'
        except ValueError as e:
            sys.stderr.write(f"[!] {unc} : No share name provided.\n")
            continue

        connect(host, path, args.user, args.password, args.domain, args.timeout, args.recursive, patterns, args.quiet, args.files, args.folders)
        #pool.submit(lambda p: connect(*p), [host, path, args.user, args.password, args.domain, args.timeout, args.recursive, patterns, args.quiet, args.files, args.folders])