rapid7/metasploit-framework — pull request #924 by Meatballs1 (2012-10-17 21:07:17+00:00)
Title: Fix to SMB Client when using find_first on a directory with exactly 20 f...

Using smb.client.find_first against a directory containing 20 files (including . and ..) will cause a SMB Error: STATUS_INVALID_HANDLE

http://pastie.org/5075263

This occurs against Windows hosts.

The bug occurs as we request 20 results from the server, and for some reason, windows tells us we can continue searching. When calling find_next it is succesful (but no results are returned), but it tells us we can continue searching, but gives us no offset to search from. We perform a second find_first but this results in an error.

As per MS specification:

http://msdn.microsoft.com/en-us/library/ee441704(prot.20).aspx

If EndOfSearch = 0 we can continue searching, but if LastNameOffset is 0 the server cannot resume the search. In this case both values are 0 which seems like MS isn't sticking to the spec properly..?

I have therefore added a check for LastNameOffset as well as EndOfSearch.

I have also adjusted the loop logic slightly to check for 0 rather than != 1 as this is more inline with the specification.

Fix in action:

http://pastie.org/5075338

Related pull: #627