/* Note i have include a little utility pinched from ADMtoolz
 for get the netbios name

  --------------------------------------------------------------------------
------------------------------[ADMnmbname.c]----------------------------------
  --------------------------------------------------------------------------  */


#define DEFAULT_OFFSET 3500
#define DEFAULT_BUFFER_SIZE 3081
#define NOP 0x90
#define NMBHDRSIZE 13
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/ip_tcp.h>

struct nmbhdr {
unsigned short int id;

unsigned char  R:1;
unsigned char  opcode:4;
unsigned char  AA:1;
unsigned char  TC:1;
unsigned char  RD:1;
unsigned char  RA:1;
unsigned char  unless:2;
unsigned char  B:1;
unsigned char  RCODE:4;


unsigned short int que_num;
unsigned short int rep_num;
unsigned short int num_rr;
unsigned short int num_rrsup;
unsigned char namelen;
};


struct typez{
u_int type;
u_int type2;
};


unsigned int host2ip(char *serv)
{
struct sockaddr_in sin;
struct hostent *hent;

hent=gethostbyname(serv);
if(hent == NULL) return 0;
bzero((char *)&sin, sizeof(sin));
bcopy(hent->h_addr, (char *)&sin.sin_addr, hent->h_length);
return sin.sin_addr.s_addr;
}



main( int argc, char  **argv)
{
struct sockaddr_in  sin_me , sin_dst;
struct nmbhdr *nmb,*nmb2;
struct iphdr *ipz;
struct typez  *typz;
struct hostent *hent;
int socket_client,sr,num,i=1,bha,timeout=0,try=0,GO=0;
int longueur=sizeof(struct sockaddr_in);
char  *data;
char  *dataz;
char   buffer[1024];
char   buffer2[1024];
char   namezz[1024];
char   name[64]="CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0";
char   c;

if(argc <2) {
        printf("usage: ADMnmbname <ip of the victim>\n");
        exit (0);
        }


socket_client=socket(AF_INET,SOCK_DGRAM,17);
sr=socket(AF_INET,SOCK_RAW,17);
ioctl(sr,FIONBIO,&i);


sin_me.sin_family=AF_INET;
sin_me.sin_addr.s_addr=htonl(INADDR_ANY);
sin_me.sin_port=htons(2600);

sin_dst.sin_family=AF_INET;
sin_dst.sin_port=htons(137);
sin_dst.sin_addr.s_addr = host2ip(argv[1]);

nmb = (struct nmbhdr *)  buffer;
data = (char *)(buffer+NMBHDRSIZE);
typz = (struct typez *)(buffer+NMBHDRSIZE+33);
nmb2 = (struct nmbhdr *)(buffer2+20+8);
ipz   = (struct iphdr *)buffer2;
dataz = (char *)(buffer2+50+7+20+8);

memset(buffer,0,1024);
memset(buffer2,0,1024);
memset(namezz,0,1024);
memcpy(data,name,33);

           /* play with the netbios query format :) */

nmb->id=0x003;
nmb->R=0;                  /* 0 for question 1 for response */
nmb->opcode=0;             /* 0 = query */
nmb->que_num=htons(1);     /* i have only 1 question :) */
nmb->namelen=0x20;
typz->type=0x2100;
typz->type2=0x1000;

sendto(socket_client,buffer,50,0,(struct sockaddr *)&sin_dst,longueur);



  for(timeout=0;timeout<90;timeout++ )
  {
           usleep(100000);
           buffer2[0]='0';
           recvfrom(sr,buffer2,800,0,(struct sockaddr *)&sin_dst,&(int)longueur);

        if(buffer2[0]!='0')
                {



                          if(nmb2->rep_num!=0)
                            {
                            bha=0;

                                     for(;;)
                                     {

                                        c=*(dataz+bha);
                                        if(c!='\x20')
                                                        {

                                                        namezz[bha]=c;
                                                        bha++;
                                                         }
                                        if(c=='\x20')break;
                                   }

								printf("%s\n",namezz);
                                printf("netbios name of %s is %s\n",argv[1],namezz);
                                try =4;
                                GO = 4;

                                break;
                              }
                }


     }




memset(buffer,0,1024);
memset(buffer2,0,1024);

}
