6.5 pre5 resolve windows bug

Author: adfoster-r7

c/meterpreter/source/extensions/stdapi/server/net/socket/tcp.c

@@ -108,7 +108,7 @@ DWORD tcp_channel_client_close(Channel *channel, Packet *request, LPVOID context
 {
 	TcpClientContext *ctx = (TcpClientContext *)context;
 
-	dprintf( "[TCP] tcp_channel_client_close. channel=0x%08X, ctx=0x%08X", channel, ctx );
+	dprintf("[TCP] tcp_channel_client_close. channel=%p id=%u ctx=%p", (void*)channel, met_api->channel.get_id(channel), (void*)ctx);
 
 	if (ctx)
 	{
@@ -185,15 +185,27 @@ DWORD tcp_channel_client_local_notify(Remote * remote, TcpClientContext * ctx)
 
 		if (dwBytesRead == 0)
 		{
-			dprintf("[TCP] tcp_channel_client_local_notify. [closed] channel=0x%08X read=0x%.8x", ctx->channel, dwBytesRead);
+			dprintf("[TCP] tcp_channel_client_local_notify. [closed] channel=0x%08X id=%u fd=%u read=0x%.8x", ctx->channel, ctx->channel ? met_api->channel.get_id(ctx->channel) : 0, (DWORD)ctx->fd, dwBytesRead);
 
-			// Set the native channel operations context to NULL
-			met_api->channel.set_native_io_context(ctx->channel, NULL);
+			// Set the native channel operations context to NULL so the channel
+			// close handler won't try to free the context again.
+			if (ctx->channel)
+			{
+				met_api->channel.set_native_io_context(ctx->channel, NULL);
+			}
 
-			// Sleep for a quarter second
+			// NULL out the channel pointer before sleeping/freeing to prevent a
+			// race where the framework sends core_channel_close concurrently,
+			// channel_destroy fires with ctx=NULL (skipping the ctx->channel=NULL
+			// assignment in tcp_channel_client_close), and free_socket_context
+			// subsequently calls channel_close on a dangling/recycled pointer.
+			ctx->channel = NULL;
+
+			// Sleep for a quarter second to let the framework drain buffered data
+			// before the socket is closed.
 			Sleep(250);
 
-			// Free the context
+			// Free the context (closes the socket)
 			free_tcp_client_context(ctx);
 
 			// Stop processing
@@ -418,6 +430,9 @@ VOID free_socket_context(SocketContext *ctx)
 {
 	dprintf("[TCP] free_socket_context. ctx=0x%08X", ctx);
 
+	// Capture fd before closing so it can be logged accurately below
+	SOCKET originalFd = ctx->fd;
+
 	// Close the socket and notification handle
 	if (ctx->fd)
 	{
@@ -427,6 +442,7 @@ VOID free_socket_context(SocketContext *ctx)
 
 	if (ctx->channel)
 	{
+		dprintf("[TCP] free_socket_context. closing channel=0x%08X id=%u fd=%u", ctx->channel, met_api->channel.get_id(ctx->channel), (DWORD)originalFd);
 		met_api->channel.close(ctx->channel, ctx->remote, NULL, 0, NULL);
 		ctx->channel = NULL;
 	}

c/meterpreter/source/extensions/stdapi/server/net/socket/tcp_server.c

@@ -90,7 +90,7 @@ VOID free_tcp_server_context(TcpServerContext * ctx)
 			break;
 		}
 
-		dprintf("[TCP-SERVER] free_tcp_server_context. ctx=0x%08X", ctx);
+		dprintf("[TCP-SERVER] free_tcp_server_context. ctx=0x%08X channel=0x%08X id=%u fd=%u", ctx, ctx->channel, ctx->channel ? met_api->channel.get_id(ctx->channel) : 0, (DWORD)ctx->fd);
 
 		if (ctx->fd)
 		{
@@ -129,7 +129,7 @@ DWORD tcp_channel_server_close(Channel * channel, Packet * request, LPVOID conte
 
 	do
 	{
-		dprintf("[TCP-SERVER] tcp_channel_server_close. channel=0x%08X, ctx=0x%08X", channel, ctx);
+		dprintf("[TCP-SERVER] tcp_channel_server_close. channel=0x%08X id=%u ctx=0x%08X", channel, met_api->channel.get_id(channel), ctx);
 
 		if (!ctx)
 		{

c/meterpreter/source/metsrv/channel.c

@@ -599,7 +599,7 @@ DWORD channel_write(Channel *channel, Remote *remote, Tlv *addend, DWORD addendL
 			packet_add_tlv_raw(request, TLV_TYPE_CHANNEL_DATA, buffer, length);
 		}
 
-		packet_add_tlv_uint(request, TLV_TYPE_LENGTH, channel_get_id(channel));
+		packet_add_tlv_uint(request, TLV_TYPE_LENGTH, length);
 
 		// Initialize the packet completion routine
 		if (completionRoutine)
@@ -628,6 +628,8 @@ DWORD channel_close(Channel *channel, Remote *remote, Tlv *addend,
 	DWORD res = ERROR_SUCCESS;
 	Tlv commandIdTlv;
 
+	dprintf("[CHANNEL] channel_close ENTER. channel=%p id=%u", (void*)channel, channel ? channel_get_id(channel) : 0);
+
 	do
 	{
 		Packet *request = packet_create(PACKET_TLV_TYPE_REQUEST, 0);
@@ -658,7 +660,7 @@ DWORD channel_close(Channel *channel, Remote *remote, Tlv *addend,
 			realRequestCompletion = &requestCompletion;
 		}
 
-		dprintf("[CHANNEL] channel_close. channel=0x%08X completion=0x%.8x", channel, completionRoutine);
+		dprintf("[CHANNEL] channel_close. channel=0x%08X id=%u completion=0x%.8x", channel, channel ? channel_get_id(channel) : 0, completionRoutine);
 
 		// Transmit the packet with the supplied completion routine, if any.
 		res = packet_transmit(remote, request, realRequestCompletion);

gem/Rakefile

@@ -95,13 +95,15 @@ end
 
 task :win_compile do
   Dir.chdir(c_source) do
-    system('cmd.exe /c make.bat')
+    success = system('cmd.exe /c make.bat')
+    abort('win_compile failed: make.bat could not be executed or exited with a non-zero status. Check the build output for errors.') unless success
   end
 end
 
 task :java_compile do
   Dir.chdir(java_source) do
-    system('mvn package -Ddeploy.path=output -Dandroid.sdk.path=$ANDROID_HOME -Dandroid.ndk.path=$ANDROID_NDK_HOME -Dandroid.release=true -q -P deploy')
+    success = system('mvn package -Ddeploy.path=output -Dandroid.sdk.path=$ANDROID_HOME -Dandroid.ndk.path=$ANDROID_NDK_HOME -Dandroid.release=true -q -P deploy')
+    abort('java_compile failed: mvn could not be executed or exited with a non-zero status. Check the build output for errors.') unless success
   end
 end