Loading meterpreter extensions in ms 3.0 beta (shedding new light...)

[0xlukej at gmail.com (Luke J)]

It was failing with the same ruby stack trace that Vedran had (as
below). I didn't attach a debugger but the server side didn't crash. I
could still carry on using the meterpreter perfectly.

The error code 1168 is windows system error ERROR_NOT_FOUND which seemed
 to be returned from the server side code based on my brief code analysis.

If this is definitely just due to the file size then I guess it is not
so big an issue unless people want to write some huge extensions.
However, I just figured it might be worth a little bit of investigation.

If there is anything specific you'd like me to do/test or if you'd like
me to send you an example compiled DLL that fails on win2k3 then let me
know.



failure: The core_loadlib request failed with result: 1168
//lib/rex/post/meterpreter/client_core.rb:156:in `use'
./lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:249:in
`cmd_use'
./lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:237:in
`cmd_use'
./lib/rex/ui/text/dispatcher_shell.rb:229:in `run_command'
./lib/rex/post/meterpreter/ui/console.rb:95:in `run_command'
./lib/rex/ui/text/dispatcher_shell.rb:196:in `run_single'
./lib/rex/ui/text/dispatcher_shell.rb:191:in `run_single'
./lib/rex/post/meterpreter/ui/console.rb:60:in `interact'
./lib/rex/ui/text/shell.rb:115:in `run'
./lib/rex/post/meterpreter/ui/console.rb:58:in `interact'
./lib/msf/base/sessions/meterpreter.rb:170:in `_interact'
./lib/rex/ui/interactive.rb:39:in `interact'
./lib/msf/ui/console/command_dispatcher/core.rb:614:in `cmd_sessions'
./lib/rex/ui/text/dispatcher_shell.rb:229:in `run_command'
./lib/rex/ui/text/dispatcher_shell.rb:196:in `run_single'
./lib/rex/ui/text/dispatcher_shell.rb:191:in `run_single'
./lib/rex/ui/text/shell.rb:119:in `run'
./msfconsole:63


mmiller at hick.org wrote:
> On Thu, Mar 01, 2007 at 03:05:03AM +0000, Luke J wrote:
> > Hello Vedran and Skape,
> > Skape: Does this make sense to you? Are you aware of something in win2k3
> > that would make your library loading technique fail over a certain DLL
> > size? Also, I am using Visual Studio 2005. Not sure if the default
> > compile options in that would be causing any issues?
>
> Hmmm, I can't think of anything in particular that would cause it to
> fail.  As far as I know, it should be relocated just the same as any
> other DLL.  Can you describe a bit about how it was failing?  Was the
> server side crashing?  If you attach a debugger, where does it break?