Skip to content

Don't log to an invalid file #756

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 22, 2025
Merged

Conversation

smashery
Copy link
Contributor

@smashery smashery commented May 20, 2025

This fixes a bug in the debug logging behaviour in C Meterp on Windows. When MeterpreterDebugBuild was set to true, but no MeterpreterDebugLogging value was set, the call to init_logging would fail. A bug existed in the handling of this. The log_to_file method expected the global value hFile to be NULL when there was no logging; however CreateFileW returns INVALID_HANDLE_VALUE. As a result, all future calls to dprintf tried to write to an invalid file handle.

This was creating issues when GetLastError() was called after dprintf - the last error value was polluted. One way of reproducing this is to run the execute_dotnet_assembly module (misdiagnosed in #746).

  • Run with no debugging stuff should suceed.
  • Run with MeterpreterDebugBuild=true will fail (the handle is invalid).
  • Run with MeterpreterDebugBuild=true and also MeterpreterDebugLogging set to a valid value should succeed.

This resolves the issue by correctly setting hFile.

There's probably more work to be done to make sure that any GetLastError is called before any dprintf, since theoretically it is possible for that to change GetLastError (e.g. failed file write).

Copy link
Contributor

@smcintyre-r7 smcintyre-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your work tracking this down and fixing it!

Alright I was able to reproduce the original issue and verify this fixes it. Going to combine some steps for reproducing it here for posterity.

  1. Obtain a x86 Meterpreter session on a 64-bit host
  2. Background the session and use the post/windows/manage/execute_dotnet_assembly module
  3. Set the SESSION and DOTNET_EXE datastore options
  4. Run the module with run technique=SPAWN_AND_INJECT process=c:\\windows\\sysnative\\notepad.exe verbose=true

Either see a failure, or see that the executable ran correctly. I use Rubeus.exe as my executable, so a successful run was just the help menu.

@smcintyre-r7 smcintyre-r7 merged commit d8af82b into rapid7:master May 22, 2025
23 of 31 checks passed
@github-project-automation github-project-automation bot moved this from In Progress to Done in Metasploit Kanban May 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants