Support more named pipes?

[moshekaplan]

Metasploit uses the following list of named pipes:

netlogon
lsarpc
samr
browser
atsvc
DAV RPC SERVICE
epmapper
eventlog
InitShutdown
keysvc
lsass
LSM_API_service
ntsvcs
plugplay
protected_storage
router
SapiServerPipeS-1-5-5-0-70123
scerpc
srvsvc
tapsrv
trkwks
W32TIME_ALT
wkssvc
PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER
db2remotecmd

Would it make sense to add support for all of these named pipes?

The reason I ask is because I received the following output when running eternalblue_checker.py:

Target OS: Windows 7 Professional 7601 Service Pack 1
The target is not patched

=== Testing named pipes ===
spoolss: STATUS_ACCESS_DENIED
samr: STATUS_ACCESS_DENIED
netlogon: STATUS_ACCESS_DENIED
lsarpc: STATUS_ACCESS_DENIED
browser: STATUS_ACCESS_DENIED

[3ndG4me]

Yeah definitely. Should be fairly simple to convert those over to this checker script. Good idea. If you're interested in taking this on go for it! I'd be happy to pull it in. If not I will be sure to get on top of this ASAP.

[moshekaplan]

Better if you do it. I don't foresee having the time.

[deus-ex-silicium]

Eternalblue does not need a named pipe, only access to IPC$, it's the other eternals that need a named pipe to work. I can make a merge request with an updated mysmb.py with more pipe support and an improved zzz_exploit.py that does not use eternalblue but the other eternal vulnerabilities for getting a semi-interactive shell. @3ndG4me how does that sound ?

[3ndG4me]

@deus-ex-silicium you are absolutely correct. I was interested in this originally just from the scanner perspective, but this repo is so commonly used I think it's time we made some Proof-of-Concept improvements.

So, in short, that all sounds great to me!

I would also suggest pulling in PoCs for the other eternal exploits if you'd like. I was planning on doing that anyway as the original source (https://github.com/worawit/MS17-010) contains all the PoC exploits, but I was wanting to vet and test them first like I have with Eternal Blue (albeit zzz_exploit.py is basically all that's needed, the rest are just PoCs for controlling RIP).

Either way bringing in the named pipe support and the zzz_exploit.py to use them is a good start (and a good motivator for me to add the rest in if relevant enough).

[3ndG4me]

Merged in the PR. Looks good, everything I tested worked out 👍