-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FileDropper hangs indefinitely when trying to delete a file in use #15992
Comments
@wvu-r7 If you can paste some details on what you did to cause this issue I'd be more than happy to take a look into this and try get a fix in place 👍 |
I had used |
This should do for replicating the bug: wvu@kharak:~/rapid7/metasploit-framework:master$ git diff
diff --git a/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb b/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
index a8566331ed..d2a21d5a10 100644
--- a/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
+++ b/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
@@ -10,6 +10,7 @@ class MetasploitModule < Msf::Exploit::Remote
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
+ include Msf::Exploit::FileDropper
def initialize(info = {})
super(
@@ -106,6 +107,9 @@ class MetasploitModule < Msf::Exploit::Remote
fail_with(Failure::NotVulnerable, 'Failed to upload msiexec.exe')
end
+ # Working directory is C:\Program Files\ManageEngine\ServiceDesk\site24x7
+ register_file_for_cleanup('..\\bin\\msiexec.exe')
+
print_good('Successfully uploaded msiexec.exe')
end
@@ -122,12 +126,4 @@ class MetasploitModule < Msf::Exploit::Remote
}, 0)
end
- # XXX: FileDropper dies a miserable death if the file is in use
- def on_new_session(_session)
- super
-
- # Working directory is C:\Program Files\ManageEngine\ServiceDesk\site24x7
- print_warning("Yo, don't forget to clean up ..\\bin\\msiexec.exe")
- end
-
end
wvu@kharak:~/rapid7/metasploit-framework:master$ Untested against current code. |
In the file dropper mixin, the following line times out when attempting to delete a file:
It looks like the regression was introduced in commit 4f8e435 with the addition of
Reverting the metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb Lines 113 to 126 in 365badb
Because the two metasploit-framework/lib/msf/core/session/provider/single_command_shell.rb Lines 58 to 85 in 365badb
I initially thought that the issue might be with the Timeout block itself after reading a few articles on it, but removing it and breaking the inner loop on some arbitrary condition still resulted in the Backtrace
|
Thank you, @space-r7! |
I did some additional tests and I found out the issue might be due to the repeated call to
This call ends up timing out and returns However, as mentioned in a comment in metasploit-framework/lib/msf/base/sessions/meterpreter.rb Lines 217 to 222 in 1000b35
The timeout expires locally and not on the victim side. When the method returns due to a timeout, the process on the remote host is still trying to read something. This seems to block further write commands until the process on the victim side actually times out at some point. This can be demonstrated by adding a breakpoint in
Whereas, calling
So, I'm not sure where to fix this: removing the extra calls to
But it doesn't look like it is enough since |
Thank you, @cdelafuente-r7! |
Clearing my assignment since Christophe and Shelby seem to have more of a handle on this than I do. Feel free to pick this up 👍 |
I miss y'all!! |
Observed while testing #15950. Might be a regression, but I haven't had much time to debug.
The text was updated successfully, but these errors were encountered: