SambaCry - Revision history

NKirnbauer: /* Mitagtion */

2025-02-11T14:28:29Z

Mitagtion

← Older revision		Revision as of 14:28, 11 February 2025
Line 93:		Line 93:


	== ~~Mitagtion~~ ==		== Mitigation ==

	* Firewalls: configure Fireswalls to block access from untrusted networks to the following ports:		* Firewalls: configure Fireswalls to block access from untrusted networks to the following ports:

NKirnbauer: /* Mitagtion */

2025-02-11T14:27:51Z

Mitagtion

← Older revision		Revision as of 14:27, 11 February 2025
Line 95:		Line 95:
	== Mitagtion ==		== Mitagtion ==

	Firewalls ~~can be used~~ to block access from untrusted networks to ~~port tcp/445 and tcp/139.~~		* Firewalls: configure Fireswalls to block access from untrusted networks to the following ports:

	~~samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.~~		TCP/445
			TCP/139

	~~Add~~ the ~~parameter:~~		* Update Samba Software: its important to use an updated, patched version of Samba. Samba.org has released patches, including updates for older, unsupported versions. Install the latest patch and restart the smbd service to mitigate this attack.

	~~nt pipe support = no~~		* Configure SMB Settings: In the smb.conf file, one can add the following parameter under the [global] section:

	to the [global] section ~~of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.~~

			nt pipe support = no


			This options prevent clients from accessing named pipe endpoints, which helps mitigate the vulnerability.

	== References ==		== References ==

NKirnbauer at 14:22, 11 February 2025

2025-02-11T14:22:05Z

← Older revision		Revision as of 14:22, 11 February 2025
Line 1:		Line 1:
	~~== Summary ==~~

	~~SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017.~~

	~~It allows a remote attacker to execute arbitrary code on a vulnerable server.~~

	~~This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it.~~

	~~== What is Samba? ==~~
	~~Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between systems running Unix/Linux and Windows.~~

	~~== Which systems are vulnerable? ==~~
	~~All that run a version of Samba from 3.5.0 onwards are vulnerable to this remote code execution vulnerability.~~


	~~== Exploitation ==~~

	~~=== Requirements ===~~

	* Attacker machine (eg. Kali Linux) with Metasploit
	* Vulnerable machine (eg. with Metasploitable)


	~~=== Step 1 ===~~

	~~Setup of machines.~~

	~~For the victim machine I downloaded Metasploitable 2 from this webpage: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/~~

	~~For the actacer machine I used [https://www.kali.org/get-kali/#kali-platforms Kali Linux]~~

	~~=== Step 2 ===~~

	~~First up we need to find the vulnerable machine in network, so that we know which ip to attack.~~

	~~We can do this be simply issuing the ip a command on the victims machine:~~


	~~[[File:Samba1.png\|700px]]~~


	But in a real scenario you haven´t access to the machine. Thats why we normally scan all machines on the network to determine which IP address we are interested in. To do this, we perform a network scan using tools like nmap or ping sweeps to identify active devices on the network and the services they offer. Thats how you can narrow down potential targets and further investigate their services to see if they are vulnerable to specific exploits.

	~~In our case we use the command nmap 192.168.1.0/24. This will show us all active ip addresses on the network:~~


	~~[[File:Samba2.png\|700px]]~~


	~~[[File:Samba3.png\|700px]]~~


	We can observe that the ip 192.168.1.135 has a lot of open ports, so we assume that this device could be vulnerable and invest further by running a service version detection on this ip address with nmap 192.168.1.135 -sV:


	~~[[File:Samba4.png\|700px]]~~


	This shows us that it is indeed the device that use metasploitable. Also we can see now all services and decide which one we want to exploit. As can be seen the ports 139 and 445 are open and both use Samba with a version that is in the range of the vulnerable versions of SambaCry.



	~~=== Step 3 ===~~

	~~Now that we discovered a vulnerable device we start the metasploit framework on the attacer machine with~~
	~~msfconsole~~

	~~If you don´t already have it you need to install it with~~
	~~sudo apt install metasploit-framework~~

	~~We can then search for samba do find the correct exploit or directly enter the CVE code to find it:~~


	~~[[File:Samba5.png\|700px]]~~


	~~[[File:Samba6.png\|700px]]~~


	~~We then select it by the keyword use:~~


	~~[[File:Samba7.png\|700px]]~~


	~~By using the command options, we can see all exploit options we need/can set.~~







	~~== Mitagtion ==~~

	~~Firewalls can be used to block access from untrusted networks to port tcp/445 and tcp/139.~~

	~~samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.~~

	~~Add the parameter:~~

	~~nt pipe support = no~~

	~~to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.~~




	~~== References ==~~

	* https://www.quantum.com/en/service-support/security-bulletins/sambacry/
	* https://www.samba.org/samba/security/CVE-2017-7494.html
	* https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb
	* https://es-la.tenable.com/blog/detecting-sambacry-cve-2017-7494
	* https://www.f5.com/labs/articles/threat-intelligence/sambacry-the-linux-sequel-to-wannacry

	~~[[Category:Documentation]]~~



	== Summary ==		== Summary ==

NKirnbauer: Created page with "== Summary == SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017. It allows a remote attacker to execute arbitrary code on a vulnerable server. This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it. == What is Samba? == Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between..."

2025-02-11T14:21:05Z

Created page with "== Summary == SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017. It allows a remote attacker to execute arbitrary code on a vulnerable server. This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it. == What is Samba? == Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between..."

New page

== Summary ==

SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017.

It allows a remote attacker to execute arbitrary code on a vulnerable server.

This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it.

== What is Samba? ==
Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between systems running Unix/Linux and Windows.

== Which systems are vulnerable? ==
All that run a version of Samba from 3.5.0 onwards are vulnerable to this remote code execution vulnerability.

== Exploitation ==

=== Requirements ===

* Attacker machine (eg. Kali Linux) with Metasploit
* Vulnerable machine (eg. with Metasploitable)

=== Step 1 ===

Setup of machines.

For the victim machine I downloaded Metasploitable 2 from this webpage: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

For the actacer machine I used [https://www.kali.org/get-kali/#kali-platforms Kali Linux]

=== Step 2 ===

First up we need to find the vulnerable machine in network, so that we know which ip to attack.

We can do this be simply issuing the ip a command on the victims machine:

[[File:Samba1.png|700px]]

But in a real scenario you haven´t access to the machine. Thats why we normally scan all machines on the network to determine which IP address we are interested in. To do this, we perform a network scan using tools like nmap or ping sweeps to identify active devices on the network and the services they offer. Thats how you can narrow down potential targets and further investigate their services to see if they are vulnerable to specific exploits.

In our case we use the command nmap 192.168.1.0/24. This will show us all active ip addresses on the network:

[[File:Samba2.png|700px]]

[[File:Samba3.png|700px]]

We can observe that the ip 192.168.1.135 has a lot of open ports, so we assume that this device could be vulnerable and invest further by running a service version detection on this ip address with nmap 192.168.1.135 -sV:

[[File:Samba4.png|700px]]

This shows us that it is indeed the device that use metasploitable. Also we can see now all services and decide which one we want to exploit. As can be seen the ports 139 and 445 are open and both use Samba with a version that is in the range of the vulnerable versions of SambaCry.

=== Step 3 ===

Now that we discovered a vulnerable device we start the metasploit framework on the attacer machine with
msfconsole

If you don´t already have it you need to install it with
sudo apt install metasploit-framework

We can then search for samba do find the correct exploit or directly enter the CVE code to find it:

[[File:Samba5.png|700px]]

[[File:Samba6.png|700px]]

We then select it by the keyword use:

[[File:Samba7.png|700px]]

By using the command options, we can see all exploit options we need/can set.

== Mitagtion ==

Firewalls can be used to block access from untrusted networks to port tcp/445 and tcp/139.

samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.

Add the parameter:

nt pipe support = no

to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.

== References ==

* https://www.quantum.com/en/service-support/security-bulletins/sambacry/
* https://www.samba.org/samba/security/CVE-2017-7494.html
* https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb
* https://es-la.tenable.com/blog/detecting-sambacry-cve-2017-7494
* https://www.f5.com/labs/articles/threat-intelligence/sambacry-the-linux-sequel-to-wannacry

[[Category:Documentation]]

== Summary ==

SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017.

It allows a remote attacker to execute arbitrary code on a vulnerable server.

This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it.

== What is Samba? ==
Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between systems running Unix/Linux and Windows.

== Which systems are vulnerable? ==
All that run a version of Samba from 3.5.0 onwards are vulnerable to this remote code execution vulnerability.

== Exploitation ==

=== Requirements ===

* Attacker machine (eg. Kali Linux) with Metasploit
* Vulnerable machine (eg. with Metasploitable)

=== Step 1 ===

Setup of machines.

For the victim machine I downloaded Metasploitable 2 from this webpage: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

For the actacer machine I used [https://www.kali.org/get-kali/#kali-platforms Kali Linux]

=== Step 2 ===

First up we need to find the vulnerable machine in network, so that we know which ip to attack.

We can do this be simply issuing the ip a command on the victims machine:

[[File:Samba1.png|700px]]

But in a real scenario you haven´t access to the machine. Thats why we normally scan all machines on the network to determine which IP address we are interested in. To do this, we perform a network scan using tools like nmap or ping sweeps to identify active devices on the network and the services they offer. Thats how you can narrow down potential targets and further investigate their services to see if they are vulnerable to specific exploits.

In our case we use the command nmap 192.168.1.0/24. This will show us all active ip addresses on the network:

[[File:Samba2.png|700px]]

[[File:Samba3.png|700px]]

We can observe that the ip 192.168.1.135 has a lot of open ports, so we assume that this device could be vulnerable and invest further by running a service version detection on this ip address with nmap 192.168.1.135 -sV:

[[File:Samba4.png|700px]]

This shows us that it is indeed the device that use metasploitable. Also we can see now all services and decide which one we want to exploit. As can be seen the ports 139 and 445 are open and both use Samba with a version that is in the range of the vulnerable versions of SambaCry.

=== Step 3 ===

Now that we discovered a vulnerable device we start the metasploit framework on the attacer machine with
msfconsole

If you don´t already have it you need to install it with
sudo apt install metasploit-framework

We can then search for samba do find the correct exploit or directly enter the CVE code to find it:

[[File:Samba5.png|700px]]

[[File:Samba6.png|700px]]

We then select it by the keyword use:

[[File:Samba7.png|700px]]

By using the command options, we can see all exploit options we need/can set.

When all options are set you can start the exploit by the command "run" or "exploit".
It then opens a reverse shell where you can issue the commands you like on the victims machine.

== Mitagtion ==

Firewalls can be used to block access from untrusted networks to port tcp/445 and tcp/139.

samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.

Add the parameter:

nt pipe support = no

to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.

== References ==

* https://www.quantum.com/en/service-support/security-bulletins/sambacry/
* https://www.samba.org/samba/security/CVE-2017-7494.html
* https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb
* https://es-la.tenable.com/blog/detecting-sambacry-cve-2017-7494
* https://www.f5.com/labs/articles/threat-intelligence/sambacry-the-linux-sequel-to-wannacry

[[Category:Documentation]]