search

SnaffCon / Snaffler

a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )
GNU General Public License v3.0
2.11k stars 212 forks source link

A few changes fixing a bug with SnafflePath and adding handling of SCCM #100

Closed gumbyDE closed 1 year ago

gumbyDE commented 2 years ago

SnafflePath: I found that Path.Combine does not properly work if the second parameter starts with a backslash. I updated FileClassifier.cs in order to Trim all leading slashes from the path. It now works on my machine and stores the file in the correct directory. Before that change everything was stored on c:\ directly.

SCCM: We use SCCM in the company I work for. I added it like it was done for NETLOGON and SYSVOL and added a configuration setting for it. It's on by default, meaning the directories are being scanned. But can be turned of via a config file.

BlockingTaskScheduler: I added a delay of 100ms in order to not get into a resource constraining while loop that only does locking and unlocking.

Please feel free to leave comments and/or criticize my work :)

l0ss commented 2 years ago

Looks good! Do you know if those various SCCM shares are all replicated? Is it worth doing the same thing as SYSVOL where we scan a single copy then skip them after that?

l0ss commented 1 year ago

Hi, are you still keen to implement this? If i don't hear back in a few weeks I'll close the PR.

gumbyDE commented 1 year ago

Hey, sorry for not replying.

SYSVOL and SCCM potentially could have interesting stuff in them, but usually these folders are huge and take very long to scan. I would prefer not scanning them at all if the flag is set.

Let me check if I can update my repository and incorporate the changes that have been made in the meantime.