luke-goddard / enumy

Linux post exploitation privilege escalation enumeration
MIT License
253 stars 33 forks source link

XFS filesystem d_type=0 #1

Closed luke-goddard closed 4 years ago

luke-goddard commented 4 years ago

I was using enumy on an OSCP box and and walking the file system would fail. All files would come up as unknown file type error. I added some extra debug statements, recompiled code an shipped off throw netcat and found that d_type returns 0?

The main filesystem is XFS

df -Th
Filesystem              Type      Size  Used Avail Use% Mounted on
/dev/mapper/centos-root xfs        18G  2.3G   16G  13% /
devtmpfs                devtmpfs  487M     0  487M   0% /dev
tmpfs                   tmpfs     497M     0  497M   0% /dev/shm
tmpfs                   tmpfs     497M     0  497M   0% /sys/fs/cgroup
tmpfs                   tmpfs     497M   13M  484M   3% /run
/dev/sda1               xfs       497M  164M  333M  33% /boot
tmpfs                   tmpfs     100M     0  100M   0% /run/user/1004
tmpfs                   tmpfs     100M     0  100M   0% /run/user/0

We can run xfs_info and see that f_type is set to 0

xfs_info / 
meta-data=/dev/mapper/centos-root isize=256    agcount=4, agsize=1144832 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=0        finobt=0
data     =                       bsize=4096   blocks=4579328, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=0
log      =internal               bsize=4096   blocks=2560, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

This prevents enumy from figuring out if a file is a file or a directory etc.

luke-goddard commented 4 years ago

I was under the assumption that d_type is portable so removing it will be difficult because of the amount of d_type usage.

luke-goddard commented 4 years ago

Issue replicated again on reiserfs https://github.com/ggreer/the_silver_searcher/issues/36

johnthesecond commented 4 years ago

See #28. Should fix issue without unnecessary overhead.

luke-goddard commented 4 years ago

closed #28