Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow search to start from root path #14821

Merged
merged 1 commit into from
Mar 3, 2021

Conversation

space-r7
Copy link
Contributor

@space-r7 space-r7 commented Feb 26, 2021

If a user is running a meterpreter session on a non-Windows OS, the search functionality cannot start a
search from the root directory because msf strips the file separator from the input used to create a
search request. Because of this, meterpreter will default to the current working directory and produce
less results than expected or none at all.

This change just makes sure that the search root is not / before chomping the file separator. This also
fixes a typo in the search help output.

Before change

meterpreter > search -f *.lib -d /
No files matching your search were found.

After change

meterpreter > search -f *.lib -d /
Found 6 results...
    /usr/src/linux-headers-4.18.0-15/scripts/Makefile.lib (14968 bytes)
    /usr/src/linux-hwe-5.4-headers-5.4.0-62/scripts/Makefile.lib (15026 bytes)
    /usr/src/linux-headers-5.4.0-65-generic/scripts/Makefile.lib (15026 bytes)
    /usr/src/linux-hwe-5.4-headers-5.4.0-65/scripts/Makefile.lib (15026 bytes)
    /usr/src/linux-headers-4.18.0-15-generic/scripts/Makefile.lib (14968 bytes)
    /usr/src/linux-headers-5.4.0-62-generic/scripts/Makefile.lib (15026 bytes)

Verification

  • Start msfconsole
  • Get a python meterpreter session on a Linux box
  • Start a search from the root directory, ex: search -f *.lib -d /
  • Verify that the search actually starts from the root directory instead of the cwd of the session

@gwillcox-r7
Copy link
Contributor

gwillcox-r7 commented Mar 3, 2021

Looks like this is working, will merge this in now.

meterpreter > search
[-] You must specify a valid file glob to search for, e.g. >search -f *.doc
meterpreter > search -f *.lib -d /
Found 11 results...
    /usr/src/linux-headers-5.8.0-43-generic/scripts/Makefile.lib (15593 bytes)
    /usr/src/linux-headers-5.4.0-58-generic/scripts/Makefile.lib (15026 bytes)
    /usr/src/linux-hwe-5.8-headers-5.8.0-43/scripts/Makefile.lib (15593 bytes)
    /usr/src/linux-hwe-5.8-headers-5.8.0-44/scripts/Makefile.lib (15593 bytes)
    /usr/src/linux-headers-5.8.0-44-generic/scripts/Makefile.lib (15593 bytes)
    /usr/src/linux-headers-5.4.0-58/scripts/Makefile.lib (15026 bytes)
    /home/gwillcox/git/metasploit-framework/data/exploits/CVE-2018-8440/ALPC-TaskSched-LPE.lib (1958 bytes)
    /home/gwillcox/git/metasploit-framework/external/source/byakugan/i386/byakugan.lib (4638 bytes)
    /home/gwillcox/git/metasploit-framework/external/source/byakugan/injectsu/lib/detoured.lib (1826 bytes)
    /home/gwillcox/git/metasploit-framework/external/source/byakugan/injectsu/lib/detours.lib (173276 bytes)
    /home/gwillcox/git/metasploit-framework/external/source/byakugan/injectsu/i386/injectsu.lib (1722 bytes)
meterpreter > pwd
/home/gwillcox/git/metasploit-framework
meterpreter > 

@gwillcox-r7 gwillcox-r7 merged commit f6fde70 into rapid7:master Mar 3, 2021
@gwillcox-r7 gwillcox-r7 added the rn-fix release notes fix label Mar 3, 2021
@gwillcox-r7
Copy link
Contributor

gwillcox-r7 commented Mar 3, 2021

Release Notes

Fixed the search command within Meterpreter to properly support searches that start at the root directory, aka /. These types of searches were previously not returning any results due to a logic bug within the code, which has now been fixed.

@space-r7 space-r7 deleted the srch-root-fix branch March 4, 2021 14:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants