Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
BadSamba — This module is used to exploit startup script execution through Windows Group Policy settings when configured to run off of a remote SMB share. | Kitploit
Tools/GitHubGitHub/strozfriedberg/badsamba
Privilege EscalationExploitationLateral MovementNetwork SecurityPenetration TestingRed Teaming
GitHubstrozfriedberg/badsamba

BadSamba

This module is used to exploit startup script execution through Windows Group Policy settings when configured to run off of a remote SMB share.

View Repository
2286 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

DESCRIPTION

This module is used to exploit startup script execution through Windows Group Policy settings when configured to run off of a remote SMB share.

Windows Group Policy can be used to configure startup scripts that will execute each time the operating system powers on. These scripts execute with a high-level of privilege, the NT AUTHORITY/SYSTEM account.

If an attacker is able to perform traffic manipulation attacks and redirect traffic flow to the malicious SMB server during reboot, it is possible to execute commands remotely as the SYSTEM account.

This module will accept all forms of authentication whether that be anonymous, domain, blank password, non-existent accounts. It will allow any user to connect to the SMB server and share.

It will also perform file spoofing and serve up the same file regardless of what file was originally requested, and regardless of which SMB share the client is connected to. If the user requests foo.vbs it will send them evil.vbs.

This was tested on Windows 7 Service Pack 1 (x86) using .bat and .vbs scripts.

Blog Post: "BadSamba - Exploiting Windows Startup Scripts Using A Malicious SMB Server" - http://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html

LIMITATIONS

  • BadSamba has been tested using .bat and .vbs remote script includes. The file extension does seem to matter, so if it’s requesting a .bat, serve up a .bat.

  • In the lab environment, testing has been against Windows 7 SP1 (English) for the proof-of-concept. Different versions of Windows may react differently, but the principal concepts should remain the same.

  • It’s not currently possible to "Browse" the files within the SMB share. This is due to the complexity of the SMB protocol, and adding this functionality would greatly increase the complexity of the module.

  • The protocol is quite noisy, and so it can be difficult to determine if the file was successfully downloaded or if it was download and executed.

  • Currently there is no exclusive lock on files being requested, and this allows for the file to be downloaded multiple times. In my experience, it only gets executed once, but it does make for noisy output within the module.

Download Tool