diff --git a/c/meterpreter/source/extensions/priv/server/elevate/kitrap0d.c b/c/meterpreter/source/extensions/priv/server/elevate/kitrap0d.c index 22150716..4dfb28a4 100644 --- a/c/meterpreter/source/extensions/priv/server/elevate/kitrap0d.c +++ b/c/meterpreter/source/extensions/priv/server/elevate/kitrap0d.c @@ -192,7 +192,7 @@ BOOL kitrap0d_spawn_ntvdm( char * cpProgram, HANDLE * hProcess ) /* * Find a suitable exe to host the exploit in. */ -BOOL elevate_via_exploit_getpath( char cpOutput[MAX_PATH], DWORD dwOutputLength ) +BOOL elevate_via_exploit_getpath( char *cpOutput, DWORD dwOutputSize ) { DWORD dwResult = ERROR_SUCCESS; char cWinDir[MAX_PATH] = {0}; @@ -213,17 +213,19 @@ BOOL elevate_via_exploit_getpath( char cpOutput[MAX_PATH], DWORD dwOutputLength if( !cpFileName ) break; - if( cWinDir[ strlen(cWinDir) - 1 ] == '\\' ) - _snprintf_s( cpOutput, sizeof(cpOutput), dwOutputLength, "%s%s", cWinDir, cpFileName ); - else - _snprintf_s( cpOutput, sizeof(cpOutput), dwOutputLength, "%s\\%s", cWinDir, cpFileName ); + if ( _snprintf_s( cpOutput, dwOutputSize, dwOutputSize - 1, "%s%s%s", cWinDir, + cWinDir[ strlen(cWinDir) - 1 ] == '\\' ? "" : "\\", cpFileName ) == -1 ) + { + dprintf( "[KITRAP0D] elevate_via_exploit_getpath. Path truncation: %s", cpOutput ); + break; + } dprintf( "[KITRAP0D] elevate_via_exploit_getpath. Trying: %s", cpOutput ); if( GetFileAttributes( cpOutput ) != INVALID_FILE_ATTRIBUTES ) return TRUE; - memset( cpOutput, 0, dwOutputLength ); + memset( cpOutput, 0, dwOutputSize ); dwIndex++; } @@ -266,7 +268,7 @@ DWORD elevate_via_exploit_kitrap0d( Remote * remote, Packet * packet ) BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. invalid arguments", ERROR_BAD_ARGUMENTS ); // 1. first get a file path to a suitable exe... - if( !elevate_via_exploit_getpath( (char *)&cVdmPath, MAX_PATH ) ) + if( !elevate_via_exploit_getpath( cVdmPath, MAX_PATH ) ) BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. elevate_via_exploit_getpath failed", ERROR_FILE_NOT_FOUND ); // 2. Scan kernel image for the required code sequence, and find the base address... diff --git a/c/meterpreter/source/extensions/stdapi/server/net/config/interface.c b/c/meterpreter/source/extensions/stdapi/server/net/config/interface.c index 2cdfb3bd..6716a628 100644 --- a/c/meterpreter/source/extensions/stdapi/server/net/config/interface.c +++ b/c/meterpreter/source/extensions/stdapi/server/net/config/interface.c @@ -182,10 +182,11 @@ DWORD get_interfaces_windows(Remote *remote, Packet *response) { entries[tlv_cnt].buffer = (PUCHAR)&mtu_bigendian; tlv_cnt++; - if (pCurr->Length > 68) { - // Then this is a Longhorn struct version and it contains the - // FirstPrefix member, save it for later in case we don't have - // an OnLinkPrefixLength + // According to http://msdn.microsoft.com/en-us/library/windows/desktop/aa366058(v=vs.85).aspx + // the PIP_ADAPTER_PREFIX doesn't exist prior to XP SP1. We check for this via the `Length` + // value, which is 72 in XP without an SP, but 144 in later versions. + if (pCurr->Length > 72) { + // Save the first prefix for later in case we don't have an OnLinkPrefixLength pPrefix = pCurr->FirstPrefix; } @@ -210,7 +211,8 @@ DWORD get_interfaces_windows(Remote *remote, Packet *response) { // will be populated prefixes[prefixes_cnt] = htonl(pAddr->OnLinkPrefixLength); } - if (pPrefix && 0 == prefixes[prefixes_cnt]) { + + if (pPrefix && 0 == prefixes[prefixes_cnt] ) { // Otherwise, we have to walk the FirstPrefix linked list prefixes[prefixes_cnt] = htonl(pPrefix->PrefixLength); pPrefix = pPrefix->Next;