Add RAP fallback to smb_enumshares for legacy SMB hosts#21123
Open
Z6543 wants to merge 1 commit into
Open
Conversation
10 tasks
smcintyre-r7
requested changes
May 7, 2026
smcintyre-r7
left a comment
smcintyre-r7
left a comment
Contributor
There was a problem hiding this comment.
This looks like it needs to be updated now that the RubySMB changes have been merged. You'll want to:
- Adjust the ruby_smb gem to pull in the latest version with your changes, use
bundle update --conservative ruby_smbto get the latest version - Adjust your code here to use the
net_share_enummethod that was added,RAP_SHARE_TYPESand formatting the hash yourself shouldn't be necessary.
github-project-automation
Bot
moved this from Todo
to Waiting on Contributor
in Metasploit Kanban
smcintyre-r7
added
module
docs
rn-modules
Contributor
|
This has conflicts that need to be resolved now that #21347 has been landed. |
The smb_enumshares module uses DCERPC/SRVSVC (net_share_enum_all) to enumerate shares. Windows 95/98/ME and other legacy SMB hosts do not support DCERPC and cause the module to fail with no results. Fall back to RAP (Remote Administration Protocol) net_share_enum over \PIPE\LANMAN when SRVSVC raises UnexpectedStatusCode or InvalidPacket. RAP is the only share-enumeration method these hosts support. ruby_smb's net_share_enum returns share types pre-formatted as strings, so share filtering, spidering, and reporting work unchanged. Pass direct: false on the SMB1/port-139 connect so NetBIOS session setup is used for legacy hosts.
Z6543
force-pushed
the
smb-enumshares-rap-fallback
branch
from
7737ebf to
88ead91
Compare
Author
|
Sorry for dropping the ball on this, should be good now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on: rapid7/ruby_smb#294 (must be merged first)
Summary
smb_enumshareswhen SRVSVC share enumeration fails, enabling share enumeration on Windows 95/98/ME and other legacy SMB hosts that don't support DCERPCdirect: falseto the SMB1 connect call on port 139 to ensure proper NetBIOS session setupVerification
UnexpectedStatusCode/InvalidPacket, module falls back to RAP and enumerates shares successfullyShareoption filtering works with both SRVSVC and RAP resultsDepends on: rapid7/ruby_smb#294 (must be merged first)