fortra/impacket

Errors with long commands in psexec.py

Open

#319 opened on Sep 14, 2017

View on GitHub
 (25 comments) (0 reactions) (0 assignees)Python (12,244 stars) (3,421 forks)batch import
help wanted

Description

First of all thanks for all the work that's gone into all of this. Great stuff!

I'd be glad to see if I could assist with this one, though I'd need some guidance for sure. I've noticed, as have others apparently, that the psexec.py example seems to fail with a status 1 on longer commands. It's hard to be sure, but it appears that this happens with commands longer than about 257 characters. Testing this with a command like "cmd /c echo 'some-long-string'" it appears that the full command is in fact running (I see the entire string echoed) but it exits with a status 1. If the command is long enough to cause this, it will fail that way every time.

Some failures attempting to run SQL with the SQLCMD program show evidence that the commands may be getting truncated. That's hard to tell however, as SQLCMD in general, although it seems to work with winexe, behaves rather strangely...sometimes outputting literal backspace characters or even nothing at all.

Again, I'd be glad to dig into this with a little guidance. I see that the command is put into a Structure with apparently 4096 characters reserved, which should be large enough for anything I've tested...so the issue must be elsewhere. Thanks!

Contributor guide

Tech stack
python
Domain
backendsecuritytooling
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Python basicsUnderstanding of network protocol structures
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Investigate the command handling in psexec.py, particularly the structure allocation (currently 4096 bytes) and how commands are sent. The issue suggests truncation at around 257 characters, so examine buffer sizes and encoding. Look at the SMB or RPC calls involved in executing commands, and check if there is any length field that might be limited. The comments may have additional hints from other contributors.