fox-it/log4j-finder

Bug (Windows): Default path only scans the system partition.

sibalzer opened this issue · 4 comments

By default, the scanner uses "/" as the starting point. Under Windows, os.scandir assumes "/" as the root of the system partition, i.e. other partitions are not scanned by default.

Hi, we have a note about this in the README.md for windows that it only scans the root drive c:\

Thanks for your patch, do you think it's possible to check fi the drive is a logical drive and not a mapped network share?
I'm concerned that people deploy this in their networks and causes every host to scan the same share :D

Or maybe this is a non issue as you mention you can exclude drives using the --exclude flag. Happy to hear your thoughts.

I have added some code to do it automatic:

  1. add reference on top:
    import wmi

  2. add line 301 - 306:
    parser.add_argument(
    "-a",
    "--all-drives",
    action="store_true",
    help="all local drives (windows)"
    )

  3. add this snippet after "print (FIGLET)":

    if args.all_drives:
    args.path.remove('/')
    for d in wmi.WMI().Win32_LogicalDisk():
    if d.DriveType == 3:
    args.path.append(d.Name+'\')

I'm not a programmer. Anybody else the possibility to make a pull request with this code?

If you compile the code at yourself run once: pip install wmi

@yunzheng I didn't see this as a problem at first because under Linux all connected network drives are scanned as well. As proposed by @hvdort we can use the win32 api to get the logical drives. However i suggest to use it via ctypes to not create additional dependency. Working on it rn.

bc1be64 adds a check for local drives.