Merge pull request #718 from zeroSteiner/fix/msf/19496

Land #718, java meterpreter - fix an issue with filesystem enumeration
rapid7 · Oct 8, 2024 · 23ebfdf · 23ebfdf
2 parents e0df256 + b5b4101
commit 23ebfdf
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/java/meterpreter/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_fs_ls.java b/java/meterpreter/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_fs_ls.java
@@ -37,7 +37,7 @@ public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket respons
         }
         String[] entries = path.list();
         for (int i = 0; i < entries.length; i++) {
-            if (entries[i].equals(".") || entries[i].equals("..")) {
+            if (entries[i] == null || entries[i].equals(".") || entries[i].equals("..")) {
                 continue;
             }
             File f = new File(path, entries[i]);

diff --git a/.../meterpreter/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_fs_search.java b/.../meterpreter/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_fs_search.java
@@ -72,13 +72,16 @@ public static List findFiles(String path, String mask, boolean recurse, Integer
                 }
             }
             path = pathfile.getCanonicalPath();
-            File[] lst = new File(path).listFiles();
+            String[] lst = new File(path).list();
             List glob = new ArrayList();
             if (lst == null) {
                 return glob;
             }
             for (int i = 0; i < lst.length; i++) {
-                File file = lst[i];
+                if (lst[i] == null) {
+                    continue;
+                }
+                File file = new File(lst[i]);
                 if (recurse && file.isDirectory()
                         // don't follow links to avoid infinite recursion
                         && file.getCanonicalPath().equals(file.getAbsolutePath())) {