Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix endless loop bug #439

Merged
merged 1 commit into from Oct 14, 2020
Merged

Fix endless loop bug #439

merged 1 commit into from Oct 14, 2020

Conversation

vixfwis
Copy link
Contributor

@vixfwis vixfwis commented Oct 9, 2020

Main thread will be stuck in loop if recv returns SOCKET_ERROR (-1) due
to int to DWORD casting

Lines 321 to 337

Main thread will be stuck in loop if recv returns SOCKET_ERROR (-1) due
to int to DWORD casting
@smcintyre-r7 smcintyre-r7 self-assigned this Oct 12, 2020
@smcintyre-r7
Copy link
Contributor

This builds correctly and looks right to me. I did test it both with and without the patch in an x64 stageless payload and I was unable to reproduce the infinite loop. I setup ncat listening on port 4444, sent a message so I could trigger the payload to read in the header which I verified with DebugView from Sysinternals. After sending in some data and then closing the connection via ncat, in both scenarios Meterpreter moves on to cleaning up since the connection failed (as expected).

I'll go ahead and land this since it's technically correct, though I don't suspect we were running into this issue before. Thanks!

@vixfwis
Copy link
Contributor Author

vixfwis commented Oct 16, 2020

Right, I forgot to add reproduction steps. My bad. Also, I modified my local metsrv a bit, but that shouldn't affect this particular bug.

It happens with Symantec EP after migration, transport context would transfer without errors, but afterwards new process can't send data in a very weird way - select works, but recv returns -1. Not sure about send. This leads to select firing after msfconsole sends negotiate secure request, metsrv tries reading socket and hangs.

Changing DWORD to int fixed everything and metsrv reconnected into new session

Thanks and sorry for making you waste time trying to reproduce that

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants