Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2007-2447 PoC — Samba MS-RPC Shell命令注入漏洞

Source
Associated Vulnerability
Title:Samba MS-RPC Shell命令注入漏洞 (CVE-2007-2447)
Description:Samba是Samba团队开发的一套可使UNIX系列的操作系统与微软Windows操作系统的SMB/CIFS网络协议做连结的自由软件。该软件支持共享打印机、互相传输资料文件等。 Samba在处理用户数据时存在输入验证漏洞,远程攻击者可能利用此漏洞在服务器上执行任意命令。 Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时,通过对/bin/sh的MS-RPC调用提交了恶意输入的话,就可能允许攻击者以nobody用户的权限执
Readme
# Samba CVE-2007-2447 Exploit

This is a Python script for exploiting CVE-2007-2447, a vulnerability known as 'Username' map script command execution in the Samba server.

## Description

This exploit is developed to target Samba versions 3.x - 4.x. CVE-2007-2447 allows an attacker to execute arbitrary commands on a vulnerable Samba server by crafting a malicious username and password.

## Usage

1. Set up a listener on your attacker machine, for example, using Netcat: `nc -nvlp 1234`

2. Run the Python script and provide the required information:
   - Your IP (for delivering a reverse shell).
   - Victim's IP.
   - Victim's Port.
   
3. The script will construct a payload for the reverse shell and send it to the target Samba server.

4. If successful, the reverse shell will be executed on the target, connecting back to your machine. You should receive a shell session.

## Disclaimer

This script is provided for educational and research purposes only. Unauthorized access or use of this script on systems you do not own or have explicit permission to test may be illegal. Be sure to use it responsibly and follow the laws and guidelines in your jurisdiction.

## Credits

- Original exploit by jduck.
- Rewritten in Python by v1nc3.

## License

This script is released under an open-source license. See the LICENSE file for more details.

## References

- [CVE-2007-2447 Information](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2447)
- [Samba Official Website](https://www.samba.org/)

Please use this script responsibly and only in a legal and ethical manner.
File Snapshot

[4.0K] /data/pocs/299cbf962b3e2996a2c6b9e5e6238d35a892e74c ├── [ 853] exploit.py └── [1.6K] README.md 0 directories, 2 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.