Update samba_symlink_traversal to use RubySMB#21383
Update samba_symlink_traversal to use RubySMB#21383zeroSteiner wants to merge 3 commits intorapid7:masterfrom
Conversation
Points the Gemfile at the paired ruby_smb feat/smb1/symlink working tree so the new SMB1::Tree#set_unix_link method is reachable during review. REVERT / REPLACE before merge: once ruby_smb publishes a release with the symlink support, replace this with a real version bump in the gemspec (spec.add_runtime_dependency 'ruby_smb', '~> X.Y.Z'). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
zeroSteiner
force-pushed
the
feat/smb/symlink-rubysmb
branch
from
65836a9 to
ef48781
Compare
zeroSteiner
force-pushed
the
feat/smb/symlink-rubysmb
branch
from
ef48781 to
8c2b213
Compare
There was a problem hiding this comment.
Pull request overview
Switches the samba_symlink_traversal auxiliary module from the legacy Rex SMB1 client to the RubySMB backend by leveraging RubySMB’s UNIX symlink extension support, and updates dependencies accordingly.
Changes:
- Update
samba_symlink_traversalto connect withbackend: :ruby_smband create the symlink via RubySMB tree methods. - Add error handling for RubySMB
UnexpectedStatusCodein the module run path. - Move
ruby_smbdependency to a git-sourced branch and update the lockfile accordingly.
Impact Analysis:
- Blast radius: medium (framework-wide Ruby dependency change via Gemfile/Gemfile.lock; direct runtime impact primarily on SMB/RubySMB consumers).
- Data and contract effects: no schema changes; dependency source changes may affect runtime behavior/compatibility of RubySMB-based SMB operations.
- Rollback and test focus: rollback = revert Gemfile/Gemfile.lock + module change; validate SMB1 negotiation/login, share tree connect, and symlink creation on a Samba target with UNIX extensions enabled.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| modules/auxiliary/admin/smb/samba_symlink_traversal.rb | Uses RubySMB backend for SMB1 and calls the UNIX symlink operation via RubySMB. |
| lib/rex/proto/smb/simple_client.rb | Minor indentation fix in trans_pipe. |
| Gemfile.lock | Switches ruby_smb to a git source and updates transitive dependencies. |
| Gemfile | Adds git-sourced ruby_smb dependency reference. |
| print_status("Trying to mount writeable share '#{datastore['SMBSHARE']}'...") | ||
| simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") | ||
|
|
||
| print_status("Trying to link '#{datastore['SMBTARGET']}' to the root filesystem...") | ||
| simple.client.symlink(datastore['SMBTARGET'], '../' * 10) | ||
| simple.client.last_tree.set_unix_link(symlink: datastore['SMBTARGET'], target: '../' * 10) |
There was a problem hiding this comment.
Important: Problem: simple.connect(...) doesn’t provide the Tree object and the next line relies on simple.client.last_tree, which is not a pattern used elsewhere (other RubySMB-using modules store the return value of tree_connect, e.g. modules/auxiliary/scanner/smb/smb_enumshares.rb:192 and smb_enum_gpp.rb:175). Impact: this adds a hidden dependency on RubySMB client state and can break if last_tree isn’t set to the intended share/tree. Fix: call tree = simple.client.tree_connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") and invoke tree.set_unix_link(...) on that explicit tree instance.
| gem 'timecop' | ||
| end | ||
|
|
||
| gem 'ruby_smb', git: 'https://github.com/zeroSteiner/ruby_smb', branch: 'feat/smb1/symlink' |
There was a problem hiding this comment.
Important: Problem: the Gemfile pins ruby_smb to a moving git branch on a fork (zeroSteiner/ruby_smb, feat/smb1/symlink). Impact: dependency supply-chain/reproducibility risk (a branch can be force-pushed or change without notice), which can make builds non-deterministic across environments. Fix: pin to a specific commit via ref: (and ideally the upstream repo or a released gem version) so the dependency is immutable.
| gem 'ruby_smb', git: 'https://github.com/zeroSteiner/ruby_smb', branch: 'feat/smb1/symlink' | |
| gem 'ruby_smb', git: 'https://github.com/zeroSteiner/ruby_smb', ref: 'REPLACE_WITH_VETTED_COMMIT_SHA' |
This loads changes from rapid7/ruby_smb#297 and closes a feature gap between Ruby SMB and the Rex SMB client. With the feature gap closed,
modules/auxiliary/admin/smb/samba_symlink_traversal.rbcan now be switched from Rex to the RubySMB client. One less module in the way of dropping the ancient Rex client.Most of the logic is on the Ruby SMB side. The
samba_symlink_traversalmodule is the only one that appears to use the unix symlink extension in the framework, so it doesn't make sense IMHO to promote thesymlinkmethod to a first-class method on the SimpleClient instance. The abstraction provided by SimpleClient is also pretty irrelevant in this context because the module will only ever work with SMB1 anyways.Testing
Containerfile
smb.conf
Demo