Land #12995, Add support for smbv2 to pipe auditor

rapid7 · Feb 26, 2020 · 40d068c · 40d068c
2 parents ff8bb2e + 664e235
commit 40d068c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 16 deletions.
diff --git a/lib/msf/core/exploit/smb/client/pipe_auditor.rb b/lib/msf/core/exploit/smb/client/pipe_auditor.rb
@@ -57,7 +57,7 @@ def check_named_pipes(check_first: [], return_first: false)
         return pipe_name, pipe_handle if return_first
 
         @found_pipes << [pipe_name, pipe_handle]
-      rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
+      rescue Rex::Proto::SMB::Exceptions::ErrorCode, RubySMB::Error::RubySMBError => e
         vprint_error("Inaccessible named pipe: #{pipe_name} - #{e.message}")
       end
     end

diff --git a/modules/auxiliary/scanner/smb/pipe_auditor.rb b/modules/auxiliary/scanner/smb/pipe_auditor.rb
@@ -22,7 +22,7 @@ def initialize
       'License'     => MSF_LICENSE
     )
 
-    deregister_options('RPORT')
+    deregister_options('RPORT', 'SMBDirect')
   end
 
   # Fingerprint a single host
@@ -32,23 +32,22 @@ def run_host(ip)
 
     [[139, false], [445, true]].each do |info|
 
-    datastore['RPORT'] = info[0]
-    datastore['SMBDirect'] = info[1]
+      datastore['RPORT'] = info[0]
+      datastore['SMBDirect'] = info[1]
 
-    begin
-      connect()
-      smb_login()
-      check_named_pipes.each do |pipe_name, _|
-        pipes.push(pipe_name)
-      end
+      begin
+        connect(versions: [1, 2])
+        smb_login()
+        check_named_pipes.each do |pipe_name, _|
+          pipes.push(pipe_name)
+        end
 
-      disconnect()
+        disconnect()
 
-      break
-    rescue ::Exception => e
-      #print_line($!.to_s)
-      #print_line($!.backtrace.join("\n"))
-    end
+        break
+      rescue Rex::Proto::SMB::Exceptions::SimpleClientError => e
+        vprint_error("SMB client Error with RPORT=#{info[0]} SMBDirect=#{info[1]}: #{e.to_s}")
+      end
     end
 
     if(pipes.length > 0)