Land #11860, pipe_auditor backslash normalization

rapid7 · May 23, 2019 · 4f39130 · 4f39130
1 parent d3be0d6
commit 4f39130
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/lib/msf/core/exploit/smb/client/pipe_auditor.rb b/lib/msf/core/exploit/smb/client/pipe_auditor.rb
@@ -39,7 +39,15 @@ def check_named_pipes(check_first: [], return_first: false)
 
     named_pipes.each do |pipe|
       begin
-        pipe_name   = pipe.strip
+        pipe_name = pipe.strip
+
+        # Samba 3.x requires a prefixed backslash
+        # Sambe 4.x normalizes away backslashes
+        # Windows: honey badger don't care
+        unless pipe_name.start_with?('\\')
+          pipe_name = "\\#{pipe_name}"
+        end
+
         pipe_handle = self.simple.create_pipe(pipe_name, 'o')
 
         # If we make it this far, it succeeded

diff --git a/modules/auxiliary/scanner/smb/pipe_auditor.rb b/modules/auxiliary/scanner/smb/pipe_auditor.rb
@@ -28,7 +28,7 @@ def initialize
   # Fingerprint a single host
   def run_host(ip)
 
-    pass = []
+    pipes = []
 
     [[139, false], [445, true]].each do |info|
 
@@ -39,7 +39,7 @@ def run_host(ip)
       connect()
       smb_login()
       check_named_pipes.each do |pipe_name, _|
-        pass.push(pipe_name)
+        pipes.push(pipe_name)
       end
 
       disconnect()
@@ -51,16 +51,16 @@ def run_host(ip)
     end
     end
 
-    if(pass.length > 0)
-      print_good("Pipes: #{pass.map{|c| "\\#{c}"}.join(", ")}")
+    if(pipes.length > 0)
+      print_good("Pipes: #{pipes.join(", ")}")
       # Add Report
       report_note(
         :host	=> ip,
         :proto => 'tcp',
         :sname	=> 'smb',
         :port	=> rport,
         :type	=> 'Pipes Found',
-        :data	=> "Pipes: #{pass.map{|c| "\\#{c}"}.join(", ")}"
+        :data	=> "Pipes: #{pipes.join(", ")}"
       )
     end
   end