grke
commented
4 years ago Hello, I thought burp already supported junction points and reparse points. Search for FT_REPARSE in burp.
If you are getting 'Could not stat', it means FT_REPARSE is not getting set. The setting code is in src/client/find.c:
static void windows_reparse_point_fiddling(struct FF_PKT *ff_pkt)
{
/*
* We have set st_rdev to 1 if it is a reparse point, otherwise 0,
* if st_rdev is 2, it is a mount point.
*/
/*
* A reparse point (WIN32_REPARSE_POINT)
* is something special like one of the following:
* IO_REPARSE_TAG_DFS 0x8000000A
* IO_REPARSE_TAG_DFSR 0x80000012
* IO_REPARSE_TAG_HSM 0xC0000004
* IO_REPARSE_TAG_HSM2 0x80000006
* IO_REPARSE_TAG_SIS 0x80000007
* IO_REPARSE_TAG_SYMLINK 0xA000000C
*
* A junction point is a:
* IO_REPARSE_TAG_MOUNT_POINT 0xA0000003
* which can be either a link to a Volume (WIN32_MOUNT_POINT)
* or a link to a directory (WIN32_JUNCTION_POINT)
*
* Ignore WIN32_REPARSE_POINT and WIN32_JUNCTION_POINT
*/
if (ff_pkt->statp.st_rdev == WIN32_REPARSE_POINT) {
ff_pkt->type = FT_REPARSE;
} else if (ff_pkt->statp.st_rdev == WIN32_JUNCTION_POINT) {
ff_pkt->type = FT_JUNCTION;
}
}
#endifAnd st_rdev is set in src/win32/compat/compat.cpp:
Win32 reparse point (junction point) is like a link
though it can have many properties (directory link,
soft link, hard link, HSM, ...
A mount point is a reparse point where another volume
is mounted, so it is like a Unix mount point (change of
filesystem). */
if(*pdwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
sb->st_rdev=WIN32_MOUNT_POINT;
else
sb->st_rdev=0;
if((*pdwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
&& (*pdwReserved0 & IO_REPARSE_TAG_MOUNT_POINT))
{
sb->st_rdev=WIN32_MOUNT_POINT;
/* Now to find out if the directory is a mount point or
a reparse point, we must do a song and a dance.
Explicitly open the file to read the reparse point, then
call DeviceIoControl to find out if it points to a Volume
or to a directory. */etc...
So, why would these directories not trigger this code?
deajan
mikaku
Hello,
Reporting a problem that affects like almost all backup programs that use Windows VSS. Newer OneDrive clients allow to show online files in local filesystem without actually downloading them. When using that functionnality, it breaks backups because the actual onedrive folder becomes a reparsepoint instead of a standard folder, leading to "Could not stat" error message.
There are at least 3 folders that are known to maybe becomre reparsepoints:
The easy solution is to exclude [A-Z]:/Users/[^/]/OneDrive* from backup, but then there's the 3rd folder that isn't predictable.
Since this FS behavior may be more widespread than Microsoft OneDrive, Is there maybe a way to detect reparsepoints in burp in order to automatically exclude them (with a logging message) ?
Under windows, one can identify a reparsepoint with:
Best regards.
Link to MS forum with that problem https://social.technet.microsoft.com/Forums/en-US/d612c19a-0f18-431a-9d75-9fb5dfd11aca/windows-10-1803-client-backups-failing-media-write-protected-errors