From f9d45e4adf078ab9e7d997b16fb9dfab9683e15f Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 12:21:53 +0100 Subject: [PATCH 01/10] Adds support for nested dirs when running mkdir --- .../extensions/stdapi/server/fs/fs_local.h | 2 +- .../extensions/stdapi/server/fs/fs_win.c | 36 ++++++++++++++----- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_local.h b/c/meterpreter/source/extensions/stdapi/server/fs/fs_local.h index 79d119654..f13942696 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_local.h +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_local.h @@ -49,7 +49,7 @@ int fs_ls(const char *directory, fs_ls_cb_t cb, void *arg); int fs_getwd(char **directory); -int fs_mkdir(const char *directory); +int fs_mkdir(char *directory); int fs_move(const char *oldpath, const char *newpath); diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 98ab4001a..b4bb38102 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -345,22 +345,42 @@ int fs_copy(const char *oldpath, const char *newpath) return rc; } -int fs_mkdir(const char *directory) +int fs_mkdir(char *directory) { int rc = ERROR_SUCCESS; - wchar_t *dir_w = met_api->string.utf8_to_wchar(directory); + struct meterp_stat s = { 0 }; + wchar_t* dir_w; + char base_dir[255]; - if (dir_w == NULL) { - rc = GetLastError(); - goto out; - } + char* dir = strtok(directory, "\\"); - if (CreateDirectoryW(dir_w, NULL) == 0) { - rc = GetLastError(); + sprintf(base_dir, "%s\\", dir); + + while (dir != NULL) + { + fs_stat(base_dir, &s); + + if (!(s.st_mode & _S_IFDIR)) { + dir_w = met_api->string.utf8_to_wchar(base_dir); + if (dir_w == NULL) { + rc = GetLastError(); + goto out; + } + + if (CreateDirectoryW(dir_w, NULL) == 0) { + rc = GetLastError(); + } + } + + dir = strtok(NULL, "\\"); + sprintf(base_dir, "%s%s\\", base_dir, dir); + memset(&s, 0, sizeof(struct meterp_stat)); } + out: free(dir_w); + free(dir); return rc; } From 7cd6726ee766574c18090dab4512acd229e0c33b Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 12:24:27 +0100 Subject: [PATCH 02/10] Fail if CreateDirectoryW fails --- c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c | 1 + 1 file changed, 1 insertion(+) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index b4bb38102..94ebfb102 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -369,6 +369,7 @@ int fs_mkdir(char *directory) if (CreateDirectoryW(dir_w, NULL) == 0) { rc = GetLastError(); + goto out; } } From 30533430a7e79bc41c22c690bd7096ee43607671 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 16:39:20 +0100 Subject: [PATCH 03/10] Adds checks --- .../source/extensions/stdapi/server/fs/fs_win.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 94ebfb102..17fdbcf9b 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -358,7 +358,10 @@ int fs_mkdir(char *directory) while (dir != NULL) { - fs_stat(base_dir, &s); + if (fs_stat(base_dir, &s) != ERROR_SUCCESS) + { + goto out; + } if (!(s.st_mode & _S_IFDIR)) { dir_w = met_api->string.utf8_to_wchar(base_dir); @@ -371,17 +374,22 @@ int fs_mkdir(char *directory) rc = GetLastError(); goto out; } + + dir_w = NULL; } dir = strtok(NULL, "\\"); - sprintf(base_dir, "%s%s\\", base_dir, dir); + if (dir != NULL){ + sprintf(base_dir, "%s%s\\", base_dir, dir); + } + memset(&s, 0, sizeof(struct meterp_stat)); + free(dir_w); } out: free(dir_w); - free(dir); return rc; } From 29b16acc804324b4196f7f4be89b6ba14878dff6 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 16:40:23 +0100 Subject: [PATCH 04/10] Removes double-free --- c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c | 1 - 1 file changed, 1 deletion(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 17fdbcf9b..fd18f7c83 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -389,7 +389,6 @@ int fs_mkdir(char *directory) out: - free(dir_w); return rc; } From b87fb3150063a33796412587ad61f169ac09ed8f Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 16:41:54 +0100 Subject: [PATCH 05/10] Frees allocated memory --- c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index fd18f7c83..dcbebd244 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -367,11 +367,13 @@ int fs_mkdir(char *directory) dir_w = met_api->string.utf8_to_wchar(base_dir); if (dir_w == NULL) { rc = GetLastError(); + free(dir_w); goto out; } if (CreateDirectoryW(dir_w, NULL) == 0) { rc = GetLastError(); + free(dir_w); goto out; } From c71859f2106753c4f087d8f4c6c259c91ffe5c2e Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 12 Feb 2026 16:42:51 +0100 Subject: [PATCH 06/10] Removes NULL assignment --- c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index dcbebd244..0c1f14da9 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -376,8 +376,6 @@ int fs_mkdir(char *directory) free(dir_w); goto out; } - - dir_w = NULL; } dir = strtok(NULL, "\\"); From 9b5ebef7e69889139707ab552778fad578fb99e7 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Tue, 17 Feb 2026 10:08:35 +0100 Subject: [PATCH 07/10] Adds sprintf_s --- c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 0c1f14da9..6730cfcf2 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -354,7 +354,7 @@ int fs_mkdir(char *directory) char* dir = strtok(directory, "\\"); - sprintf(base_dir, "%s\\", dir); + sprintf_s(base_dir, 255, "%s\\", dir); while (dir != NULL) { @@ -380,7 +380,7 @@ int fs_mkdir(char *directory) dir = strtok(NULL, "\\"); if (dir != NULL){ - sprintf(base_dir, "%s%s\\", base_dir, dir); + sprintf_s(base_dir, 255, "%s%s\\", base_dir, dir); } memset(&s, 0, sizeof(struct meterp_stat)); From e8d6b5355ba9fead51d51c30c603f7dd312cfa86 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Wed, 18 Feb 2026 10:47:21 +0100 Subject: [PATCH 08/10] Adds better detection for non-existing files --- .../extensions/stdapi/server/fs/fs_win.c | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 6730cfcf2..da792897e 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -350,24 +350,23 @@ int fs_mkdir(char *directory) int rc = ERROR_SUCCESS; struct meterp_stat s = { 0 }; wchar_t* dir_w; - char base_dir[255]; + size_t directory_length; + char* base_dir; + char* dir; + + // Add 2 because of NULL character and additional backslash + directory_length = lstrlenA(directory)+2; + base_dir = (char *)HeapAlloc(GetProcessHeap(), 0, directory_length); + dir = strtok(directory, "\\"); - char* dir = strtok(directory, "\\"); - - sprintf_s(base_dir, 255, "%s\\", dir); + sprintf_s(base_dir, directory_length, "%s\\", dir); while (dir != NULL) { - if (fs_stat(base_dir, &s) != ERROR_SUCCESS) - { - goto out; - } - - if (!(s.st_mode & _S_IFDIR)) { + if (fs_stat(base_dir, &s) != ERROR_SUCCESS) { dir_w = met_api->string.utf8_to_wchar(base_dir); if (dir_w == NULL) { rc = GetLastError(); - free(dir_w); goto out; } @@ -376,19 +375,21 @@ int fs_mkdir(char *directory) free(dir_w); goto out; } + free(dir_w); } dir = strtok(NULL, "\\"); + if (dir != NULL){ - sprintf_s(base_dir, 255, "%s%s\\", base_dir, dir); + sprintf_s((char*)(base_dir+lstrlenA(base_dir)), directory_length, "%s\\",dir); } - + memset(&s, 0, sizeof(struct meterp_stat)); - free(dir_w); } out: + HeapFree(GetProcessHeap(),0, base_dir); return rc; } From 0cda05cd3b42b3602a0f14f44d627c2057580d74 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Tue, 24 Feb 2026 09:53:33 +0100 Subject: [PATCH 09/10] Adds additional checks --- .../source/extensions/stdapi/server/fs/fs_win.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index da792897e..36f1d87b5 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -353,10 +353,20 @@ int fs_mkdir(char *directory) size_t directory_length; char* base_dir; char* dir; - + + if(directory == NULL){ + return ERROR_INVALID_PARAMETER; + } + // Add 2 because of NULL character and additional backslash directory_length = lstrlenA(directory)+2; base_dir = (char *)HeapAlloc(GetProcessHeap(), 0, directory_length); + + if(base_dir == NULL){ + rc = GetLastError(); + return rc; + } + dir = strtok(directory, "\\"); sprintf_s(base_dir, directory_length, "%s\\", dir); From 4584a758a2671c25adf363661ed575d673636d91 Mon Sep 17 00:00:00 2001 From: msutovsky-r7 Date: Thu, 9 Apr 2026 09:43:32 +0200 Subject: [PATCH 10/10] Adds additional check when allocating heap --- .../source/extensions/stdapi/server/fs/fs_win.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c index 36f1d87b5..5f02bdfa9 100644 --- a/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c +++ b/c/meterpreter/source/extensions/stdapi/server/fs/fs_win.c @@ -353,14 +353,22 @@ int fs_mkdir(char *directory) size_t directory_length; char* base_dir; char* dir; + HANDLE process_heap = NULL; if(directory == NULL){ return ERROR_INVALID_PARAMETER; } + process_heap = GetProcessHeap(); + + if(process_heap == NULL){ + rc = GetLastError(); + return rc; + } + // Add 2 because of NULL character and additional backslash directory_length = lstrlenA(directory)+2; - base_dir = (char *)HeapAlloc(GetProcessHeap(), 0, directory_length); + base_dir = (char *)HeapAlloc(process_heap, 0, directory_length); if(base_dir == NULL){ rc = GetLastError(); @@ -399,7 +407,7 @@ int fs_mkdir(char *directory) out: - HeapFree(GetProcessHeap(),0, base_dir); + HeapFree(process_heap,0, base_dir); return rc; }