Giters

WithSecureLabs / doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

timeout means?

soliton4 opened this issue · comments

commented 
sol@toughbook31:~/projects/doublepulsar-detection-script$ python detect_doublepulsar_smb.py --ip 184.105.4.108                                                                                                                                                                 
Traceback (most recent call last):                                                                                                                                                                                                                                             
  File "detect_doublepulsar_smb.py", line 124, in <module>                                                                                                                                                                                                                     
    check_ip(ip)                                                                                                                                                                                                                                                               
  File "detect_doublepulsar_smb.py", line 50, in check_ip                                                                                                                                                                                                                      
    s.connect((host, port))                                                                                                                                                                                                                                                    
  File "/usr/lib/python2.7/socket.py", line 228, in meth                                                                                                                                                                                                                       
    return getattr(self._sock,name)(*args)                                                                                                                                                                                                                                     
socket.error: [Errno 110] Connection timed out

so i get a timeout. but does this mean this machine is infected or not?

commented

Most likely that TCP port 445 wasn't listening and/or was firewalled off and so cannot be tested.