dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix for smb_login errors 

do not try the TreeConnect if the SESSION_SETUP
has already failed.
This commit is contained in:
David Maloney 2017-05-18 11:26:03 -05:00
parent 57dc86bdec
commit 94e4dc2938
No known key found for this signature in database
GPG Key ID: DEDBA9DC3A913DB2
2 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Gemfile.lock
View File

@ -343,7 +343,7 @@ GEM
rspec-mocks (~> 3.6.0)
rspec-support (~> 3.6.0)
rspec-support (3.6.0)
ruby_smb (0.0.12)
ruby_smb (0.0.14)
bindata
rubyntlm
windows_error

26
lib/metasploit/framework/login_scanner/smb.rb
View File

@ -100,19 +100,21 @@ module Metasploit
client = RubySMB::Client.new(self.dispatcher, username: username, password: password, domain: realm)
status_code = client.login
# Windows SMB will return an error code during Session
# Setup, but nix Samba requires a Tree Connect. Try admin$
# first, since that will tell us if this user has local
# admin access. Fall back to IPC$ which should be accessible
# to any user with valid creds.
begin
tree = client.tree_connect("\\\\#{host}\\admin$")
# Check to make sure we can write a file to this dir
if tree.permissions.add_file == 1
access_level = AccessLevels::ADMINISTRATOR
if status_code == WindowsError::NTStatus::STATUS_SUCCESS
# Windows SMB will return an error code during Session
# Setup, but nix Samba requires a Tree Connect. Try admin$
# first, since that will tell us if this user has local
# admin access. Fall back to IPC$ which should be accessible
# to any user with valid creds.
begin
tree = client.tree_connect("\\\\#{host}\\admin$")
# Check to make sure we can write a file to this dir
if tree.permissions.add_file == 1
access_level = AccessLevels::ADMINISTRATOR
end
rescue Exception => e
client.tree_connect("\\\\#{host}\\IPC$")
end
rescue Exception => e
client.tree_connect("\\\\#{host}\\IPC$")
end
case status_code.name