diff --git a/CHANGELOG b/CHANGELOG index a096e0888..c5b5c8586 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,8 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] smb library's share_get_list now properly uses anonymous connections + first before falling back authenticating as a known user. + o [NSE] New script smb-vuln-cve-2017-7494 detects a remote code execution vulnerability affecting Samba versions 3.5.0 and greater with writable shares. [Wong Wai Tuck] diff --git a/nselib/smb.lua b/nselib/smb.lua index efd31e2cd..1c03f58ea 100644 --- a/nselib/smb.lua +++ b/nselib/smb.lua @@ -2498,6 +2498,7 @@ end -- data is given as a string, not a file. -- --@param host The host object +--@param data The string containing the data to be written --@param share The share to upload it to (eg, C$). --@param remotefile The remote file on the machine. It is relative to the share's root. --@param use_anonymous [optional] If set to 'true', test is done by the anonymous user rather than the current user. @@ -3189,7 +3190,7 @@ function share_get_list(host) -- Ensure that the server returns the proper error message -- first try anonymously, then using a user account (in case anonymous connections are not supported) for _, anon in ipairs({true, false}) do - status, result = share_host_returns_proper_error(host) + status, result = share_host_returns_proper_error(host, anon) if(status == true and result == false) then return false, "Server doesn't return proper value for non-existent shares; can't enumerate shares"