From ac00eff3a0580cb5f08dacd84fc886b6794819a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jordan=20Ovr=C3=A8?= Date: Fri, 17 Apr 2026 11:17:58 +0200 Subject: [PATCH] Fix UnboundLocalError on parentDir when accessing Samba (Linux) shares MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When connecting to a Samba/Linux SMB share using SMB3 dialect >= 3.0 with directory leasing support, the SMB2 CREATE handler in smb3.py crashes with: "cannot access local variable 'parentDir' where it is not associated with a value" Root cause: an indentation bug at line 1271. The variable `parentDir` is only assigned inside `if len(fileName.split('\\')) > 2:` (i.e. when the file is NOT at the share root), but the block that references `parentDir` (the GlobalFileTable lookup and parent entry creation) was incorrectly placed outside that conditional. When accessing a root-level path — which is common on Samba shares — the condition is false, `parentDir` is never assigned, and Python raises UnboundLocalError. The fix moves the `if parentDir in self.GlobalFileTable` block and its `else` branch inside the `if len(...) > 2:` guard, which matches the original intent described by the comment "Is this file NOT on the root directory?". Parent directory lease tracking only makes sense when a parent directory actually exists, so skipping it for root-level paths is the correct behavior. This bug affects any tool built on impacket (nxc, smbclient-ng, etc.) when targeting Samba/Linux shares with SMB3 directory leasing enabled. --- impacket/smb3.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/impacket/smb3.py b/impacket/smb3.py index 3c6118f975..cec880b9ea 100644 --- a/impacket/smb3.py +++ b/impacket/smb3.py @@ -1261,13 +1261,13 @@ def create(self, treeId, fileName, desiredAccess, shareMode, creationOptions, cr # Is this file NOT on the root directory? if len(fileName.split('\\')) > 2: parentDir = ntpath.dirname(pathName) - if parentDir in self.GlobalFileTable: - raise Exception("Don't know what to do now! :-o") - else: - parentEntry = copy.deepcopy(FILE) - parentEntry['LeaseKey'] = uuid.generate() - parentEntry['LeaseState'] = SMB2_LEASE_NONE - self.GlobalFileTable[parentDir] = parentEntry + if parentDir in self.GlobalFileTable: + raise Exception("Don't know what to do now! :-o") + else: + parentEntry = copy.deepcopy(FILE) + parentEntry['LeaseKey'] = uuid.generate() + parentEntry['LeaseState'] = SMB2_LEASE_NONE + self.GlobalFileTable[parentDir] = parentEntry packet = self.SMB_PACKET() packet['Command'] = SMB2_CREATE