Skip to content

fix(pre2k): fix directory traversal and arbitrary file write vulnerabilities (#1261) #1334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Char0n1507 wants to merge 2 commits into from
Closed

fix(pre2k): fix directory traversal and arbitrary file write vulnerabilities (#1261) #1334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d592eb1
fix: db_execute lock scope to prevent thread-safety race (#1320)
Jul 28, 2026
5bf7e17
fix: pre2k directory traversal and arbitrary file write (#1261)
Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions nxc/database.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,10 +204,9 @@ def clear_database(self):
self.db_execute(table.delete())

def db_execute(self, *args):
self.lock.acquire()
res = self.sess.execute(*args)
self.lock.release()
return res
with self.lock:
res = self.sess.execute(*args)
return res.freeze()() if res.returns_rows else res

def get_keys(self, key_id=None, cred_id=None):
"""Return an empty list by default. Protocols that support keys (e.g. SSH) override this."""
Expand Down
15 changes: 13 additions & 2 deletions nxc/modules/pre2k.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,13 @@ def on_login(self, context, connection):
computers[computer["sAMAccountName"]] = computer["userAccountControl"]
context.log.debug(f"Added computer: {computer['sAMAccountName']}")

# Save computers to file
domain_dir = os.path.join(f"{NXC_PATH}/modules/pre2k", connection.domain)
import re

# Sanitize domain to prevent directory traversal (Issue #1261)
safe_domain = re.sub(r'[^a-zA-Z0-9.-]', '_', connection.domain)
safe_domain = safe_domain.replace('..', '_')

domain_dir = os.path.join(f"{NXC_PATH}/modules/pre2k", safe_domain)
output_file_pre2k = os.path.join(domain_dir, "precreated_computers.txt")
output_file_non_pre2k = os.path.join(domain_dir, "non_precreated_computers.txt")

Expand All @@ -63,6 +68,12 @@ def on_login(self, context, connection):

with open(output_file_pre2k, "w") as pre2k_file, open(output_file_non_pre2k, "w") as non_pre2k_file:
for computer, uac in computers.items():
# Validate sAMAccountName to prevent arbitrary file writes (Issue #1261)
invalid_chars = '"[]:;|=+*?<>/\\\\,'
if any(c in computer for c in invalid_chars):
context.log.debug(f"Skipping invalid sAMAccountName: {computer}")
continue

if int(uac) == 4128:
pre2k_file.write(f"{computer}\n")
else:
Expand Down
Loading