feature request: non-blocking read on SMB named pipes

[msftsecurityteam]

Hi, is there a way to do a non-blocking read on an SMB named pipe? If not, could there be support added? I have been trying to hack something together, similar to netcat, but over an SMB named pipe using impacket. Maybe my Python skills are just inept, but I'm having a hard time getting both reading/writing working when poll()'ing on the SMBConnection.get_socket()

[msftsecurityteam]

Im pretty much trying to implement this exact issue:

#28

[nnam]

@msftsecurityteam did you get any kind of resolution to this issue or find a work around?

[msftsecurityteam]

@nnam No. I also opened up another issue (#365) related to this but haven't seen any movement on it.

I went through and tried to really modify the impacket source to get this to work to no avail. I had implemented non-blocking type stuff, or close where there is some delay, but the impacket SMB layer doesn't ingest it properly. tcpdump will see the data come over, the NMB portion of impacket will see it (I made a debug print statement everytime an NMB packet comes in), but the SMB portion either doesn't parse it correctly or drops it (silently). I don't know enough about SMB/NMB or impacket to figure out why this is happening to fix this bug. I'd rather not say in an open forum why I want this, as I am sure you do too, but there is definitely a red teaming idea why you would want to have a netcat'ish type of pipe over an SMB listener, on say for example, a DC or other Microsoft service server.

Anyway. my right now my code is in a stalled state at this point and maybe there will be some traction soon!

[asolino]

Hey guys... sorry I haven't been able to dig on this. Can you send me a piece of code that replicates the issue? That would make things easier for fixing given the amount of time available.

[msftsecurityteam]

Unfortunately I don't have those changes anymore I made to impacket. But it was a small hack in which I set a socket to non-blocking somewhere. I'm trying to poll() / select() on the socket, pretty much a netcat type tool that tunnels over SMB, so in theory you should be able to connect via impacket to a Windows machine that has a named pipe listener, and tunnel any data over it.

I was able to get it kind of working in a blocking fashion with a timeout, but was only getting partial data on either side that i was seeing in issue #365 . Sorry I don't have any code to share, I must have accidentally cleared out the changes in my local git repo.... If you want me to try and hack something together again I can

[asolino]

Hey @msftsecurityteam

I'd appreciate if you can come up with some code that replicates the issue. Thanks

[asolino]

No answer, closing.