draper7 has asked for the wisdom of the Perl Monks concerning the following question:

Fellow Monks, I'm again in the need of some help. I just can't figure out how to stop the following script from breaking. This script attempts to connect to a host via null session and then dumps out user information for that system. The problem that I'm running into is that when the null session cannot be established it breaks out of the loop, thus dies. I believe its the Win32::Lanman::NetUseAdd(\%Hash) thats causing the problem. I've tried using return in the subroutines several different ways without any luck. Any advise would be greatly appreciated.
     
--Dusty 
#!/usr/bin/perl -w
#-----
# should get local users from a subnet....
# scan.pl xxx.xxx.xxx
#----

use strict;
use Net::NBName;
use Win32::Lanman;

my $server;
my $subnet = $ARGV[0];
my $nb = Net::NBName->new;

my @users;

for my $hostbit (2..253)
{
 $server = "$subnet\.$hostbit";
 
 my $username = "";
 my $password = "";
 my $null = "";
 my $ns = $nb->node_status($server);
  if ($ns) 
  {
   if (connectipc($server, $password, $username, $null))
   {

[download]
    print "null session to $server successful.\n";
    @users = getusers($server);
    if (@users) 
     {
      foreach (@users)
      {
       my ($group,$user) = split(/:/,$_);
       print "$user\n";
      } 
     } else {
      print "Did not retrieve local users.\n";
     }
     print "\n";

    if (disconnect($server)) {
     print "Disconnected from $server.\n";
    } else {
     print "Could not disconnect.\n";
    }
   } else {
    print "failed to connect\n";
   }
  } else {
  print "$server isn't running netbios\n";
 }
}


#-----
# connect to ipc share
#----
sub connectipc {
 my($server,$password,$username,$null) = @_;
 my(%Hash) =     (
        remote => "\\\\$server\\ipc\$",
          asg_type => &USE_IPC,
        password => $password,
             username => $username,
        domainname => $null
        );

 Win32::Lanman::NetUseAdd(\%Hash);
}



#-----
# disconnect ipc connection
#----
sub disconnect {
 my(@server) = @_;
 Win32::Lanman::NetUseDel("\\\\$server\\ipc\$",&USE_FORCE);
}


#-----
# get local users
#----
sub getusers {
 my($server) = @_;
 my($err,$group,$member);
 my(@groups,@members,@users) = ();
    
 if(Win32::Lanman::NetLocalGroupEnum("\\\\$server", \@groups))
 {
  foreach $group (@groups)
  {
   if(Win32::Lanman::NetLocalGroupGetMembers("\\\\$server", ${$group}{
+'name'}, \@members))
   {
    foreach $member (@members)
    {
     push(@users, "${$group}{'name'}:${$member}{'domainandname'}");
    }
   } else {
    $err = Win32::FormatMessage Win32::Lanman::GetLastError();
    $err = Win32::Lanman::GetLastError() if ($err eq "");
    print "NetLocalGroupGetMembers error:  $err\n";    
   }    
  }    
 } else {
  $err = Win32::FormatMessage Win32::Lanman::GetLastError();
  $err = Win32::Lanman::GetLastError() if ($err eq "");
  print "NetLocalGroupEnum error:  $err\n";
 }
 return @users;
}

[download]

Edit by tye, add READMORE

Edit by jeffa, fixed font tag

Replies are listed 'Best First'.
Re: Win32::Lanman Subroutine Hell
by SyN/AcK (Scribe) on Jul 14, 2003 at 21:13 UTC
    Here, check out this link, it should help...
    I just recently wrote a program that would brute force User
    passwords using this module, although it proved a bit
    ineffecient due to a timeout built into the API. Here ya
    go!

    Null.pl
[reply]
      Thanks for the reply. I believe this script would also fail if I added the for loop around it... I would like to scan a whole subnet at a time. Any ideas?

      Thanks,

      -Dusty
[reply]
        Hmmm... no, I don't think its a problem. I haven't added that to my program
        that I've been working on (a netbios password brute forcer... if I didn't already mention),
        but I think it should be simple to add. The for loop should create no problem.
        If you are getting an error, I would have to take a better look at your code.
        I just quickly responded to this last nite cause I knew the file would be helpful and I was in a hurry.

        Another thing to consider would be to thread your program to scan all of the machines independently.

        Hope this helps.
[reply]

Back to Seekers of Perl Wisdom