Skip to content

Comments

fix(snipped): properly parse and set output file for saved screenshots#1122

Merged
Marshall-Hallenbeck merged 1 commit intomainfrom
marshall_smb_snipped_vuln_fix
Feb 23, 2026
Merged

fix(snipped): properly parse and set output file for saved screenshots#1122
Marshall-Hallenbeck merged 1 commit intomainfrom
marshall_smb_snipped_vuln_fix

Conversation

@Marshall-Hallenbeck
Copy link
Collaborator

Description

After #1121, I looked at our other uses of saving files automatically and how we constructed paths for the output files and found one location that was somewhat vulnerable. The snipped module does not parse served pathnames correctly, so you can write to arbitrary folders via absolute paths, but you can't control what the filename is mostly, so this is more so a bugfix than anything (the module was redundantly adding the path to the saved filename as well, so I fixed that).

I used AI to help create a POC, but the code in this PR itself was written by me.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Requires files in the $User/Screenshots/ directory

Screenshots (if appropriate):

Before:
image

After:
image

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@Marshall-Hallenbeck Marshall-Hallenbeck self-assigned this Feb 23, 2026
@Marshall-Hallenbeck Marshall-Hallenbeck added the bug-fix This Pull Request fixes a bug label Feb 23, 2026
Copy link
Member

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Marshall-Hallenbeck Marshall-Hallenbeck merged commit c7dc286 into main Feb 23, 2026
7 checks passed
@Marshall-Hallenbeck Marshall-Hallenbeck deleted the marshall_smb_snipped_vuln_fix branch February 23, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug-fix This Pull Request fixes a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants