Giters

WithSecureLabs / doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Script not working

13lackWidow opened this issue · comments

commented

It seems as though this script doesn't work for me. I'm on the most recent version of kali-rolling. Here is my input-output.

Input:
python detect_doublepulsar.py --ip 192.168.1.19

Output:
Traceback (most recent call last):
File "detect_doublepulsar.py", line 124, in
check_ip(ip)
File "detect_doublepulsar.py", line 98, in check_ip
final_response = s.recv(1024)
socket.error: [Errno 104] Connection reset by peer

commented

Some OS versions do not support the protocol sequence used by DOUBLEPULSAR or the script e.g. 2012 and so the target system will close the connection before the sequence is complete.

If you find an OS version that is exploitable with ETERNALBLUE and DOUBLEPULSAR works with but the script does not then please report it. For now, I'm the versions I've been able to test that do not work with the script also do not work with DOUBLEPULSAR.

If you try testing with Windows 7 or 2008 R2 at the very least you should find it works.

commented

Ah, okay. I was testing it against windows 10 machines. Thank you for the information.