Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle SMB2 compound related requests #264

Merged

Conversation

zeroSteiner
Copy link
Contributor

This adds handling for compound SMB2 requests as defined here: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/46dd4182-62d3-4e30-9fe5-e2ec124edca1

I ran into this while working on an exploit that triggered a load over a UNC path from a Python app running on a Windows Server 2022 host. In this case, there was a create request followed by another request whose #file_id attribute was not populated leading the higher level read operation to fail.

@cdelafuente-r7
Copy link
Contributor

Thanks @zeroSteiner! It looks good to me. I tested using the examples/virtual_file_server.rb script and made sure compound requests are handled correctly. However, I was not able to reproduce the same use case as you described. I only observed Create requests chained with Find requests. That said, the file_id is correctly populated and the find operations properly works. I'll go ahead and land it. Thanks!

@cdelafuente-r7 cdelafuente-r7 closed this pull request by merging all changes into rapid7:master in 352b62e Apr 11, 2024
@cdelafuente-r7
Copy link
Contributor

Release Notes

This adds handling for compound SMB2 requests. Now, chained requests are correctly following the protocol and attributes like session_id, tree_id and file_id are properly populated across these requests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants