Add ServerName argument to srvs.hNetrShareEnum #947
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I have an SMB server for which impacket
smbconnection.listShares()
doesn't return as many shares as Windows explorer shows me.Impacket only returns "C$", "F$" and a few others, and "IPC$", "print$" and "prnproc$", while Windows sees many more shares which are not only technical/admin shares but also business ones.
Through a packet capture analysis I found the difference being that Windows fills the "ServerName" field in the NetShareEnumAll request which impacket doesn't (or actually fills it with a NULL byte only coming from b4cacea):
https://github.com/SecureAuthCorp/impacket/blob/d84fca225175729bdf215adca10f3b3bd5a84733/impacket/dcerpc/v5/srvs.py#L3095-L3097
We can observe that Windows fills it with "\\<ip><NULL>"
Even though the specification mentions that this field can be NULL and that the server MUST remove any preceding "\\"
This code fixes it for
smbconnection.listShares()
only (which is what I need at the moment...). Would you like me to add something similar to all other structures in srvs.py that have a "ServerName" field?I tested it on the problematic server and a few others, but I can run a larger scale test :)
EDIT: I did a larger scale test and I did not notice any regression