SambaCry

Repository contains an operational remote root exploit for Samba CVE-2017-7494. The primary entry point is cve_2017_7494.py (Python 2), which uses an embedded copy of the Impacket library to: (1) optionally compile a malicious shared object payload (libimplantx32.so/libimplantx64.so) via Makefile by generating config.h with attacker rhost/rport and shell path; (2) authenticate to the target Samba server over SMB (default TCP/445, optional 139); (3) enumerate shares via SRVSVC (\\srvsvc) and attempt to upload the .so to a writable share with a randomized filename; and (4) trigger the vulnerability by connecting to a crafted named pipe path (ncacn_np:<target>[\pipe\<module>]) causing Samba to load the uploaded library, yielding code execution as root and a reverse shell back to the attacker. Key files: - cve_2017_7494.py: exploit logic, options for credentials (-u/-P), target (-t/-p), reverse shell callback (--rhost/--rport), architecture (-x), old Samba entrypoint handling (-o), skip compilation (-n), and custom .so (--custom). - Makefile + config.h: build system for the implant shared objects; config.h is overwritten by the script unless compilation is disabled. - README.md: usage instructions (netcat listener, running exploit, reusing uploaded module path). - impacket/: large vendored Impacket codebase and examples; mostly unrelated to the CVE exploit but provides additional tooling code (e.g., ntlmrelayx, secretsdump) if executed separately. Overall purpose: deliver and load a malicious Samba module from a writable share to achieve reliable remote root RCE with a reverse shell callback.

This repository contains a fully operational exploit for CVE-2017-7494, a remote code execution vulnerability in Samba. The exploit consists of a Python script (cve_2017_7494.py) that automates the process of compiling a malicious shared object payload (implant.c, built as libimplantx32.so or libimplantx64.so), uploading it to a writable share on the target Samba server, and triggering its execution via the Samba module loading mechanism. The payload, when loaded, spawns a reverse shell as root to the attacker's specified host and port. The repository also includes a large number of files from the impacket library, which are used to handle SMB and DCE/RPC communication. The main entry point is cve_2017_7494.py, which provides various options for targeting different Samba versions, architectures, and custom payloads. The exploit is reliable as long as the target is vulnerable and a writable share is available. Notable fingerprintable endpoints include the default reverse shell IP (202.124.201.135), the shell binary (/bin/sh), and the uploaded .so files. The exploit is not part of a framework and is a standalone operational exploit.

This repository provides a working exploit for the SambaCry vulnerability (CVE-2017-7494) affecting Samba servers. The exploit consists of a C source file (bindshell-samba.c) that compiles into a shared object (libbindshell-samba.so), which, when uploaded to a writable Samba share and loaded via the exploit, opens a bind shell on TCP port 6699. The Python script (exploit.py) uses the impacket library to trigger the vulnerability by instructing the Samba server to load the malicious shared object from a specified path. The README.md provides detailed instructions for compiling the payload, uploading it to the target, and executing the exploit, including guidance for path guessing using paths.txt. The exploit requires the attacker to have write access to a Samba share and knowledge (or a good guess) of the absolute path to the uploaded file on the server. The main attack vector is network-based, targeting vulnerable Samba services. The repository is operational and provides all necessary components for exploitation, including payload source, exploit script, and usage documentation.

This repository is an operational exploit for CVE-2017-7494, a remote code execution vulnerability in Samba (3.5.0 and above, up to 4.6.4, 4.5.10, 4.4.14). The exploit works by compiling a malicious shared object (.so) payload for various architectures, uploading it to a writable SMB share on the target, and then instructing Samba to load the library, resulting in arbitrary code execution. The payload, as defined in config.h, typically spawns a shell or reverse shell to the attacker's host and port. The exploit is reliable if the target is vulnerable and the payload matches the target's architecture. The repository includes both the exploit script (noSAMBAnoCRY.py) and the payload source (implant.c/config.h), as well as supporting files from the impacket library for SMB communication. The attack vector is network-based, targeting SMB (TCP port 445 or custom). Fingerprintable endpoints include the reverse shell IP/port and the path to the shell binary. The exploit is not part of a framework but is a standalone operational exploit with customizable payloads.

This repository is a functional exploit for CVE-2017-7494, a remote code execution vulnerability in Samba (the open-source SMB server) affecting versions 3.5.0 to 4.6.3 on Linux and macOS. The exploit consists of a Python script (exploit.py) that automates the attack: it compiles a malicious shared object (payload.so) with attacker-specified IP and port, uploads it to a writable share on the target via SMB, and then triggers Samba to load the module using the vulnerable code path. The payload, written in C, forks a process and executes a Python command to connect back to the attacker's machine, providing a reverse shell. The repository also includes a Makefile for building the payload, a shell script to install dependencies (including a modified impacket library for SMB communication), and configuration files. The README provides detailed usage instructions, including how to set up a listener and how to use precompiled payloads for macOS. The exploit requires network access to the target's SMB service and a writable share. The main attack vector is network-based, and the exploit is operational, providing a working reverse shell if successful.

This repository provides a full exploit environment for CVE-2017-7494 (SambaCry), a remote code execution vulnerability in Samba. The structure includes: - `exploit.py`: The main exploit script (Python) that authenticates to a vulnerable Samba server, uploads a malicious shared object (payload), and triggers its execution via a crafted named pipe. It supports arguments for target host, credentials, share, remote path, and shell port. - `bindshell-samba.c` and `bindshell-samba.h`: C source code for a bind shell payload. When compiled as a shared object and loaded by Samba, it spawns a shell on TCP port 6699. - `Dockerfile` and `docker-compose.yml`: Provide a vulnerable Samba environment for testing, exposing SMB ports (137/udp, 138/udp, 139/tcp, 445/tcp) and the bind shell port (6699/tcp). - `smb.conf`: Samba configuration with a writable share (`/data`) accessible to the user `sambacry`. - `README.md`: Detailed usage instructions, including how to build the payload, run the exploit, and test against the provided Docker environment. - `src/`: Contains the full Samba source code and build system, used to create the vulnerable environment. The exploit is operational and weaponized, providing a working remote code execution chain against vulnerable Samba servers. The main attack vector is network-based, requiring SMB access and the ability to upload files to a writable share. The exploit is not part of a framework but is a standalone, full-featured exploit with a customizable payload. The repository is well-structured for both exploitation and testing, including all necessary components to simulate and exploit the vulnerability.

This repository is a full exploit implementation for CVE-2017-7494, a remote code execution vulnerability in Samba. The main exploit script is cve_2017_7494.py, which automates the process of compiling a malicious shared object payload (implant.c, built as libimplantx32.so or libimplantx64.so), uploading it to a writable share on the target Samba server, and triggering the vulnerability to load the payload. The payload, when executed, provides a root reverse shell to the attacker's specified host and port. The exploit supports various options for targeting different Samba versions, architectures, and custom payloads. The repository includes a large number of supporting files from the impacket library, which are used for SMB and DCE/RPC communication. The attack vector is network-based, requiring access to the Samba service and a writable share. The exploit is operational and provides a working root shell if the target is vulnerable and properly configured.

This repository contains a Python exploit script (sambahunter.py) and a README.md for exploiting the Samba remote code execution vulnerability CVE-2017-7494. The exploit targets Samba versions 3.5.0 through 4.5.4, 4.5.10, and 4.4.14 on Linux systems. The script works by generating a malicious C shared object (.so) file that executes an arbitrary shell command provided by the attacker. It uploads this payload to all writeable shares it can find on the target server, then attempts to trigger the payload via the Samba IPC$ share, exploiting the vulnerability to achieve remote code execution. The script requires the target server's address and the command to execute. The README provides usage instructions and example output. The exploit is operational and automates the process of finding writeable shares, uploading the payload, and triggering the exploit. The main attack vector is network-based, requiring access to the target's Samba service. The script fingerprints and attempts to use a variety of common file paths for payload upload, which are useful for detection and defense.

This repository is a proof-of-concept exploit for CVE-2017-7494, a remote code execution vulnerability in Samba (version 4.5.9). The exploit consists of a Python script (exploit.py) that connects to a target Samba server using the DCERPC protocol and attempts to load a user-supplied shared object (.so) file onto the server. The payload is a simple C shared object (libpoc.so) that, when loaded, prints a message to demonstrate code execution. The repository includes a build script for compiling the payload, a requirements file for a patched version of Impacket, and setup instructions. The exploit requires the attacker to upload the shared object to a writable share on the Samba server and then trigger its loading via the exploit script. The main attack vector is network-based, targeting exposed Samba services. The repository is structured with clear separation between the exploit script, payload source, and build instructions, and is intended for demonstration and research purposes.