metasploit-framework
metasploit-framework copied to clipboard
Stdapi::AudioOutput.play_file: raise if file +path+ is not readable
Rex::Post::Meterpreter::Extensions::Stdapi::AudioOutput.play_file(path)
opens a channel to play a file path
. The channel is opened immediately without any prior validation of path
. Opening the channel is unnecessary if the file does not exist. Worse, failure to read the file will raise an error before channel.close
is called, leaving the channel open.
This PR ensures that the file path
is readable. No audio channel is opened if the file is not readable. It also ensures that the channel is closed in the event that something goes wrong.
Before
meterpreter > channel -l
No active channels.
meterpreter > play /asdf
[*] Playing /asdf...
[-] Error running command play: Errno::ENOENT No such file or directory @ rb_sysopen - /asdf
meterpreter > channel -l
Id Class Type
-- ----- ----
11 3 audio_output
After
meterpreter > channel -l
No active channels.
meterpreter > play /asdf
[*] Playing /asdf...
[-] Error running command play: RuntimeError Could not read file: /asdf
meterpreter > channel -l
No active channels.