File tree Expand file tree Collapse file tree 2 files changed +12
-5
lines changed
lib/msf/core/exploit/smb/server/share Expand file tree Collapse file tree 2 files changed +12
-5
lines changed Original file line number Diff line number Diff line change @@ -17,10 +17,17 @@ def smb_cmd_nt_create_andx(c, buff)
17
17
pkt = CONST ::SMB_CREATE_PKT . make_struct
18
18
pkt . from_s ( buff )
19
19
20
- payload = ( pkt [ 'Payload' ] . v [ 'Payload' ] ) . downcase
21
- payload . gsub! ( /^[\x00 ]*/ , '' ) # delete padding
22
- payload = Rex ::Text . ascii_safe_hex ( payload )
23
- payload . gsub! ( /\\ x([0-9a-f]{2})/i , '' ) # delete hex chars
20
+ payload = pkt [ 'Payload' ] . v [ 'Payload' ] . downcase
21
+
22
+ if pkt [ 'Payload' ] [ 'SMB' ] . v [ 'Flags2' ] & CONST ::FLAGS2_UNICODE_STRINGS == CONST ::FLAGS2_UNICODE_STRINGS
23
+ # If path length is odd first character is alignment
24
+ if payload . length . odd?
25
+ payload = payload [ 1 ..-1 ]
26
+ end
27
+ payload = Rex ::Text . to_ascii ( payload )
28
+ end
29
+
30
+ payload . gsub! ( /[\x00 ]*/ , '' ) # delete nulls
24
31
25
32
if payload . nil? || payload . empty?
26
33
payload = file_name
Original file line number Diff line number Diff line change @@ -58,7 +58,7 @@ def smb_cmd_find_file_both_directory_info(c, path)
58
58
# @param path [String] The path which the client is requesting info from.
59
59
# @return [Fixnum] The number of bytes returned to the client as response.
60
60
def smb_cmd_find_file_names_info ( c , path )
61
- if path && path . include ?( file_name . downcase )
61
+ if path && path . ends_with ?( file_name . downcase )
62
62
data = Rex ::Text . to_unicode ( file_name )
63
63
elsif path && folder_name && path . ends_with? ( folder_name . downcase )
64
64
data = Rex ::Text . to_unicode ( path )
You can’t perform that action at this time.
0 commit comments