diff --git a/scripts/smb-print-text.nse b/scripts/smb-print-text.nse index d0b662012..3e6b5f92b 100644 --- a/scripts/smb-print-text.nse +++ b/scripts/smb-print-text.nse @@ -1,4 +1,3 @@ -local bin = require "bin" local io = require "io" local msrpc = require "msrpc" local smb = require "smb" @@ -77,7 +76,7 @@ action = function(host,port) local lanman_result local REMSmb_NetShareEnum_P = "WrLeh" local REMSmb_share_info_1 = "B13BWz" - status, lanman_result = msrpc.call_lanmanapi(smbstate,0,REMSmb_NetShareEnum_P,REMSmb_share_info_1,bin.pack("s",data,pos+14) - pos, name = bin.unpack("c14 I2", data, pos) - -- pos needs to be rounded to the next even multiple of 20 - pos = pos + ( 20 - (#name % 20) ) - 1 if share_type == 1 then -- share is printer + name = string.unpack("z", name) stdnse.debug1("Found printer share %s.", name) printer = name + break end + pos = pos + 20 end end if not printer then diff --git a/scripts/smb-vuln-ms10-061.nse b/scripts/smb-vuln-ms10-061.nse index 9bb5e84bf..a910ed982 100644 --- a/scripts/smb-vuln-ms10-061.nse +++ b/scripts/smb-vuln-ms10-061.nse @@ -1,4 +1,3 @@ -local bin = require "bin" local msrpc = require "msrpc" local smb = require "smb" local string = require "string" @@ -120,19 +119,18 @@ aka "Print Spooler Service Impersonation Vulnerability." local parameters = lanman_result.parameters local data = lanman_result.data - local pos, status, convert, entry_count, available_entries = bin.unpack("s",data,pos+14) - pos, name = bin.unpack("c14 I2", data, pos) - -- pos needs to be rounded to the next even multiple of 20 - pos = pos + ( 20 - (#name % 20) ) - 1 if share_type == 1 then -- share is printer + name = string.unpack("z", name) stdnse.debug1("Found printer share %s.", name) printer = name + break end + pos = pos + 20 end end if not printer then