python meterpreter ls command large files are not supported.

[uyid]

In python meterpreter,if you dir exist a large file(>4GB?), Unable to display directories with ls.

in python:

Traceback (most recent call last):
File "/payload.py", line 1254, in create_response
    result = handler(request, resp)
File "", line 1304, in stdapi_fs_ls
File "", line 673, in get_stat_buffer
    error: integer out of range for 'I' format code

in msf console:
meterpreter > ls i:
[-] stdapi_fs_ls: Operation failed: Unknown error

because:

in ext_server_stdapi.py line 660
def get_stat_buffer(path):
    si = os.stat(path)
    rdev = 0
    if hasattr(si, 'st_rdev'):
        rdev = si.st_rdev
        blksize = 0
    if hasattr(si, 'st_blksize'):
        blksize = si.st_blksize
        blocks = 0
    if hasattr(si, 'st_blocks'):
        blocks = si.st_blocks
        st_buf = struct.pack('<IHHH', si.st_dev, max(min(0xffff, si.st_ino), 0), si.st_mode, si.st_nlink)
        st_buf += struct.pack('<HHHI', si.st_uid & 0xffff, si.st_gid & 0xffff, 0, rdev)
        st_buf += struct.pack('<IIII', si.st_size, long(si.st_atime), long(si.st_mtime), long(si.st_ctime))
        #                                     👆 max file size is 4GB ,int32 max value limit file size
        st_buf += struct.pack('<II', blksize, blocks)

[zeroSteiner]

Does this issue not affect the other meterpreters? I thought the structure format was standard across all of them (i.e. using a 32-bit width field).

[bwatters-r7]

Oh crap..... I forgot I assigned this to myself. @zeroSteiner I'll try to take a look today, but several months ago, the C meterpreter had this same issue. At fault was that the Windows stat object was returning 64-bit file sizes, but the meterpreter stat object only had 32 bits. We upped the C meterpreter stat struct to have a 64 bit value.

[bwatters-r7]

FYI: #195

[OJ]

Definitely an issue across all of them!

…

On Tue., 11 Dec. 2018, 00:44 Brendan ***@***.*** wrote: FYI: #195 <#195> — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#281 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABw4IrSbd4LO_QxBpnSRNaEmxD_h21Hks5u3nNlgaJpZM4TfYa8> .

[bwatters-r7]

I think this is as fixed as we can do so on the python side after landing #322 and #327. If this remains an issue, please reopen the ticket.