Skip to content

fix(pre2k): fix directory traversal and arbitrary file write vulnerabilities (#1261) - #1334

Closed
Char0n1507 wants to merge 2 commits into
Pennyw0rth:mainfrom
Char0n1507:fix/issue-1261-pre2k-vuln
Closed

Char0n1507 wants to merge 2 commits into
Pennyw0rth:mainfrom
Char0n1507:fix/issue-1261-pre2k-vuln

Conversation

@Char0n1507

Copy link
Copy Markdown

Description

This PR fixes the Directory Traversal and Arbitrary File Write vulnerabilities reported in #1261 within the pre2k module.

Changes made:

  1. Sanitizes connection.domain to remove illegal path characters (such as ../) to prevent directory traversal out of the NXC_PATH/modules/pre2k directory when writing output files.
  2. Validates sAMAccountName against Microsoft's documented restrictions, ensuring it does not contain illegal characters ("[]:;|=+*?<>/\\,). If an illegal character is found, it is skipped and logged to debug instead of being written, which prevents an attacker from injecting arbitrary file contents via a malicious LDAP server.

Fixes #1261

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas

@github-actions

Copy link
Copy Markdown

It looks like the PR template may not have been filled out. The following sections appear to be missing:

  • Setup guide for the review

Please edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks!

@NeffIsBack

Copy link
Copy Markdown
Member

Hi and thanks for the PR, but I will close this one because it is duplicate to #1243. Regarding the samaccountname I'll either just implement a file jail so you can't stored data outside of the nxc folder or simply remove the samaccountname from the filename entirely.

@NeffIsBack NeffIsBack closed this Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pre2k Directory Traversal + Arbitrary File Write

2 participants