Skip to content

Commit beca4b8

Browse files
committed
Fix issue with getenv failing
The call to `getenv` failed when `%` or `$` were used because of the differences between Meterpreter handling and MSF handling. Meterpreter effectively ignores (ie. strips out) the platform-specific characters which are used for environment variables. In the `getenv` call, MSF was invoking `getenvs` and getting a full hash of values, then attempting to index into the hash using a string which may be "polluted" with those platform-specific characters. This meant that there was a discrepency between what was returned and what was used to index and as a result, the value would come out as `nil`. For example, calling `getenv('%FOO%')` would result in a hash with `{'FOO'=>'bar'}`, so looking for '%FOO%' in this result would yield nothing. This commit changes this so that the name is ignored and the first value is returned.
1 parent 18816f3 commit beca4b8

File tree

1 file changed

+7
-6
lines changed
  • lib/rex/post/meterpreter/extensions/stdapi/sys

1 file changed

+7
-6
lines changed

lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def initialize(client)
3030
def getuid
3131
request = Packet.create_request('stdapi_sys_config_getuid')
3232
response = client.send_request(request)
33-
return client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_USER_NAME) )
33+
client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_USER_NAME) )
3434
end
3535

3636
#
@@ -53,14 +53,15 @@ def getenvs(*var_names)
5353
result[var_name] = var_value
5454
end
5555

56-
return result
56+
result
5757
end
5858

5959
#
6060
# Returns the value of a single requested environment variable name
6161
#
6262
def getenv(var_name)
63-
getenvs(var_name)[var_name]
63+
_, value = getenvs(var_name).first
64+
value
6465
end
6566

6667
#
@@ -92,7 +93,7 @@ def steal_token(pid)
9293
req = Packet.create_request('stdapi_sys_config_steal_token')
9394
req.add_tlv(TLV_TYPE_PID, pid.to_i)
9495
res = client.send_request(req)
95-
return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
96+
client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
9697
end
9798

9899
#
@@ -101,7 +102,7 @@ def steal_token(pid)
101102
def drop_token
102103
req = Packet.create_request('stdapi_sys_config_drop_token')
103104
res = client.send_request(req)
104-
return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
105+
client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
105106
end
106107

107108
#
@@ -114,7 +115,7 @@ def getprivs
114115
res.each(TLV_TYPE_PRIVILEGE) do |p|
115116
ret << p.value
116117
end
117-
return ret
118+
ret
118119
end
119120

120121
protected

0 commit comments

Comments
 (0)