CVE-2020-0796-Scanner

import socket
import binascii
import sys

payload = binascii.unhexlify('000000c8fe534d42400000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024000500010000007f0000000000000000000000000000000000000070000000030000000202100200030203110300000100260000000000010020000100000000000000000000000000000000000000000000000000000000000000000000000200060000000000020002000100000003000e000000000003000000000000000200030001000000'.encode())


#       值          含义
# NONE 0x0000         无压缩
# LZNT1 0x0001        LZNT1压缩算法
# LZ77 0x0002         LZ77压缩算法
# LZ77+Huffman 0x0003 LZ77+Huffman压缩算法

try:
    sock = socket.socket(socket.AF_INET)
    sock.settimeout(3)
    sock.connect(( sys.argv[1],  445 ))
    sock.send(payload)
    response = sock.recv(2020)
    sock.close()
    # 检测支持的SMB版本
    # 1103 -> 3.1.1
    if binascii.hexlify(response)[144:148].startswith('1103'): 
        print(sys.argv[1] + " 支持SMB协议版本3.1.1")
    # 参见上方值:含义注释
    if binascii.hexlify(response)[-36:].startswith('03'):
        if response[-2:] == b'\x01\x00':
            exit(sys.argv[1] + "\t存在漏洞!!!\t目标支持LZNT1压缩算法")
        if response[-2:] == b'\x02\x00':
            exit(sys.argv[1] + "\t存在漏洞!!!\t目标支持LZ77压缩算法")
        if response[-2:] == b'\x03\x00':
            exit(sys.argv[1] + "\t存在漏洞!!!\t目标支持LZ77+Huffman压缩算法")
except Exception as identifier:
    exit(sys.argv[1] + " " + str(identifier))

exit(sys.argv[1] + "[*] 无漏洞.")