Metasploit-framework: Windows meterpreter `search` builtin doesn't recurse into AppData

[jeffmcjunkin]

Steps to reproduce

How'd you do it?

1. Gained a windows/meterpreter session
2. Prepared some files:

C:\Users\student>echo secret > C:\Users\student\Desktop\hidden\hidden.file
C:\Users\student>echo secret > C:\Users\student\AppData\hidden.file
C:\Users\student>attrib appdata
    H                C:\Users\student\AppData
C:\Users\student>attrib C:\Users\student\Desktop\hidden
    H                C:\Users\student\Desktop\hidden

1. Tested search inside meterpreter:

meterpreter > search -d 'C:\Users\student' -f *.file
Found 1 result...
    C:\Users\student\Desktop\hidden\hidden.file (9 bytes)
meterpreter > search -d 'C:\Users\student\AppData' -f *.file
Found 1 result...
    C:\Users\student\AppData\hidden.file (9 bytes)

Expected behavior

I'd expect both hidden.file entries to appear.

Current behavior

Currently, it looks like search doesn't traverse each user's AppData folder. It's not just because it's hidden, either, according to my tests above. If you search AppData explicitly, however, it does recurse as normal.

My guess is https://github.com/rapid7/metasploit-framework/blob/768e3b497195fa3d4ca91795c93f10138203152e/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb#L174 isn't traversing AppData somehow... but I'm not sure.

System stuff

Metasploit version

msf5 > version
Framework: 5.0.36-dev-
Console  : 5.0.36-dev-

I installed Metasploit with:

• [X] Omnibus installer (nightly)

OS

Running Metasploit on Ubuntu 16.04.6 x64.

[bwatters-r7]

I wonder if this is related to the changes made in https://github.com/rapid7/metasploit-payloads/pull/313

[wvu-r7]

Seems likely. Are you going to fix it? :)

[github-actions[bot]]

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.

[jeffmcjunkin]

Beep boop, this is still an open issue.

/me chases away @github-actions