Utilize metasploit from a Kali Linux machine to exploit a well-known samba vulnerability (CVE-2007-2447). This is done in order to infiltrate a Metasploitable 2 machine with a reverse shell to access the root folder. Once this folder has been accessed, it should reveal the /etc/shadow folder which would give proof of compromise.
vig9610/exploiting-samba-on-metasploitable-2
My goal here was to utilize metasploit from a Kali Linux machine to exploit a well-known samba vulnerability (CVE-2007-2447). This is done in order to infiltrate a Metasploitable 2 machine with a reverse shell to access the root folder. Once this folder has been accessed, it should reveal the /etc/shadow folder which would give proof of compromise.
Nmap Scan & Target Enumeration
First I begin by identifying each IP address of each host machine.
Metasploitable 2: 192.168.1.3
Kali: 192.168.1.4
Next I ping the Metasploitable 2 machine from the kali linux machine to make sure that there is a connection between the two.
I then conduct an nmap scan from the kali machine using the -sV flag in order to determine which ports are open on the machine, (in this case port 445) which shows that the Server Message Block (SMB) has a version of Samba 3.X - 4.X on it which is the one that happens to be vulnerable.
Metasploit Exploit Execution Now I launch metasploit on the Kali Linux Machine by using the command “msfconsole”.
Next I utilize the “use exploit/multi/samba/usermap_script” to leverage CVE-2007-2447 in order to execute arbitrary commands. Then I set the RHOSTS to the Metasploitable 2 target IP address and LHOST to the Kali Attacker machine IP address. Then I initiate the “payload/cmd/unix/reverse_netcat” command to spawn the shell back to the host machine, and then “exploit” to begin the exploit.
Reverse Shell Access Now that the shell session has been initiated, I can begin to test the command line in order to confirm that I am connected to the target Metasploitable 2 machine. The “whoami” command shows that I am running as the root user, “uname -a” shows what the kernel version is which could help the attacker verify more vulnerabilities, and “id” verifies the privileges that are given to the root user.
Proof of Compromise (/etc/shadow) Lastly, we must verify whether or not we can access the /etc/shadow folder which proves full compromise, which in this case it does. We can now see all of the hash passwords listed for users on the machine.
Mitigation Strategies
In order to mitigate against these vulnerabilities, it is important to ensure that regular updates are being conducted to prevent outdated versions from causing serious vulnerabilities to important systems. Constant patches of software are important to prevent unnecessary risks that may have been mitigated otherwise. Secondly, restricting SMB access through firewalls can help to prevent threat actors from having access to this vulnerability and even monitor the traffic that is going in and out of the network to ensure that unauthorized access is prohibited altogether. Implementing the principle of least privilege (PoLP) and Role-based access can help ensure only select users are able to have root access and be able to view the /etc/shadow folder. Lastly, implementing network segmentation can help to separate the different layers of the network so that if a threat actor is able to infiltrate, they are unable to easily move laterally through the network without being noticed by Security Analysts.
Professionalism, Clarity & Reflection
This project helped me to understand just how important it is to keep live systems patched and up to date. Legacy systems are also extremely at risk since they can sometimes have expired updates that make it difficult to keep properly secured. In this case, utilizing Samba’s “usermap_script” vulnerability shows just how easy it can be to take advantage of misconfigured and unpatched services to infiltrate the root folder and achieve full system compromise. Seeing as SMB is commonly used for file sharing, this can be detrimental to a company's cyber safety.
