$ cat writeup.md…
$ cat writeup.md…
hackviser
Task: Samba 4.6.3 server with writable anonymous share, exploit CVE-2017-7494 (SambaCry) to read /secret.txt. Solution: upload malicious .so to writable share, trigger dlopen via IPC$ named pipe with full Unix path, monkey-patch impacket to preserve forward slashes.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Samba is an open-source network file system protocol that provides services such as file and printer sharing. This laboratory contains the CVE-2017-7494 vulnerability found in Samba versions since 3.5.0 and before 4.6.4, 4.5.10, and 4.4.14. This vulnerability allows attackers to perform remote code execution attacks, enabling the execution of arbitrary commands on the server and potentially taking control of the system. What is the secret in the /secret.txt file? Target: 172.20.26.134
English summary: A Samba 4.6.3 server is running on the target with a writable share accessible via anonymous/guest authentication. The goal is to exploit CVE-2017-7494 (SambaCry / is_known_pipename) to achieve remote code execution and read the contents of /secret.txt.
This vulnerability exists in Samba's is_known_pipename() function. When a client opens a named pipe on the IPC$ share, Samba checks whether the pipe name is a "known" pipe. If the pipe name contains a forward slash /, Samba treats it as a filesystem path and calls dlopen() on it, loading the file as a shared library and executing its samba_init_module() function.
Attack chain:
.so shared library with a samba_init_module() entry point.sodlopen() on the path → arbitrary code execution as the Samba processPort 445 (SMB) is open. Samba version 4.6.3 is identified — vulnerable to CVE-2017-7494.
Share enumeration via smbclient -L //172.20.26.134 -N revealed:
myshare (Disk) — writable with anonymous accessIPC$ — standard IPC share...
$ grep --similar