from scapy.all import *
import scapy.layers.smb
import sys
import hashlib

test2 = "\x00\x00\x10N\xffSMB2\x00\x00\x00\x00\x18\x07\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xfe\x00\x08B"

a = rdpcap(sys.argv[1])

pkts = [x for x in a if hasattr(x, 'dport') and x.dport in [139,445]]

for i in range(len(pkts)):
	try:
		if test2 in pkts[i].load:
			break
	except:
		continue
d = pkts[i].dst

temp = [x for x in pkts if x.dst == d and hasattr(x, 'load')]
temp2 = [x for x in temp if test2 == x.load[:len(test2)]]

blob = ""
for i in range(len(temp2)):
	blob += temp2[i].load

key = blob[-4:]

blob = blob[blob.find(key) % 4:]

blob = bytearray(blob)
key = bytearray(key)

for i in range(len(blob)):
	blob[i] ^= key[i%len(key)]

off = blob.find('This program cannot be run in DOS')
off -= 78
f = blob[off:]

open(hashlib.sha256(f).hexdigest(), 'wb').write(f)
