关联漏洞
标题：
Samba MS-RPC Shell命令注入漏洞
(CVE-2007-2447)
描述：Samba是Samba团队开发的一套可使UNIX系列的操作系统与微软Windows操作系统的SMB/CIFS网络协议做连结的自由软件。该软件支持共享打印机、互相传输资料文件等。 Samba在处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时，通过对/bin/sh的MS-RPC调用提交了恶意输入的话，就可能允许攻击者以nobody用户的权限执
介绍
# Samba CVE-2007-2447 Exploit
This is a Python script for exploiting CVE-2007-2447, a vulnerability known as 'Username' map script command execution in the Samba server.
## Description
This exploit is developed to target Samba versions 3.x - 4.x. CVE-2007-2447 allows an attacker to execute arbitrary commands on a vulnerable Samba server by crafting a malicious username and password.
## Usage
1. Set up a listener on your attacker machine, for example, using Netcat: `nc -nvlp 1234`
2. Run the Python script and provide the required information:
- Your IP (for delivering a reverse shell).
- Victim's IP.
- Victim's Port.
3. The script will construct a payload for the reverse shell and send it to the target Samba server.
4. If successful, the reverse shell will be executed on the target, connecting back to your machine. You should receive a shell session.
## Disclaimer
This script is provided for educational and research purposes only. Unauthorized access or use of this script on systems you do not own or have explicit permission to test may be illegal. Be sure to use it responsibly and follow the laws and guidelines in your jurisdiction.
## Credits
- Original exploit by jduck.
- Rewritten in Python by v1nc3.
## License
This script is released under an open-source license. See the LICENSE file for more details.
## References
- [CVE-2007-2447 Information](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2447)
- [Samba Official Website](https://www.samba.org/)
Please use this script responsibly and only in a legal and ethical manner.
文件快照
[4.0K] /data/pocs/299cbf962b3e2996a2c6b9e5e6238d35a892e74c
├── [ 853] exploit.py
└── [1.6K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。