Skip to content

Commit 719db5d

Browse files
committed
Fix rapid7#4119 - SMB lost search ID (sid) in find_first method
This will fix issue rapid7#4119. A bug in the find_first method in rex SMB. When the SMB client requests a TRANS2_FIND_FIRST2 for retriving information about what items a directory has, the server returns a response that contains an SID - a search identifier for the transaction. If the SMB client wants more data, it must send a TRANS2_FIND_NEXT2 request with the same SID. And then the server will continue sending more until it runs out. The root cause of this bug is that after the TRANS2_FIND_FIRST2 request is sent, our SMB's find_first method forgets the SID at the end of the loop (out of scope).
1 parent 96ba6da commit 719db5d

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

lib/rex/proto/smb/client.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1872,6 +1872,7 @@ def queryfs_fs_attribute
18721872

18731873
# Enumerates a specific path on the mounted tree
18741874
def find_first(path)
1875+
sid = nil
18751876
files = { }
18761877
parm = [
18771878
26, # Search for ALL files

0 commit comments

Comments
 (0)