Skip to content

Commit 0ca0d3d

Browse files
committed
Improve nt_create_andx path parsing
1 parent c175367 commit 0ca0d3d

File tree

2 files changed

+12
-5
lines changed

2 files changed

+12
-5
lines changed

lib/msf/core/exploit/smb/server/share/command/nt_create_andx.rb

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,17 @@ def smb_cmd_nt_create_andx(c, buff)
1717
pkt = CONST::SMB_CREATE_PKT.make_struct
1818
pkt.from_s(buff)
1919

20-
payload = (pkt['Payload'].v['Payload']).downcase
21-
payload.gsub!(/^[\x00]*/, '') # delete padding
22-
payload = Rex::Text.ascii_safe_hex(payload)
23-
payload.gsub!(/\\x([0-9a-f]{2})/i, '') # delete hex chars
20+
payload = pkt['Payload'].v['Payload'].downcase
21+
22+
if pkt['Payload']['SMB'].v['Flags2'] & CONST::FLAGS2_UNICODE_STRINGS == CONST::FLAGS2_UNICODE_STRINGS
23+
# If path length is odd first character is alignment
24+
if payload.length.odd?
25+
payload = payload[1..-1]
26+
end
27+
payload = Rex::Text.to_ascii(payload)
28+
end
29+
30+
payload.gsub!(/[\x00]*/, '') # delete nulls
2431

2532
if payload.nil? || payload.empty?
2633
payload = file_name

lib/msf/core/exploit/smb/server/share/information_level/find.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ def smb_cmd_find_file_both_directory_info(c, path)
5858
# @param path [String] The path which the client is requesting info from.
5959
# @return [Fixnum] The number of bytes returned to the client as response.
6060
def smb_cmd_find_file_names_info(c, path)
61-
if path && path.include?(file_name.downcase)
61+
if path && path.ends_with?(file_name.downcase)
6262
data = Rex::Text.to_unicode(file_name)
6363
elsif path && folder_name && path.ends_with?(folder_name.downcase)
6464
data = Rex::Text.to_unicode(path)

0 commit comments

Comments
 (0)