![\"\"](\"http:\/\/kibilogic.com\/wp-content\/uploads\/2018\/06\/start_up.png\")
<\/a><\/p>\nWhen the OS boots up an IP is assigned. Use netdiscover to find hosts on the network.<\/p>\n
netdiscover -i eth0 -r 192.168.1.0\/24<\/strong><\/p>\n Identify services<\/p>\n nmap -T4 -O -sV -sS 192.168.1.13<\/strong><\/p>\n Need to determine which of the services has an exploitable vulnerability\u2026lowest hanging fruit wins (could be one or more\u2026)<\/p>\n one of the services running is Samba.<\/p>\n Linux (UNIX) machines can browse and mount SMB shares. Note that this can be done whether the server is a Windows machine or a Samba server.<\/p>\n An SMB client program for UNIX machines is included with the Samba distribution. It provides an ftp-like interface on the command line. You can use this utility to transfer files between a Windows ‘server’ and a Linux client. <\/p>\n Most Linux distributions include the useful smbfs package, which allows one to mount and umount SMB shares<\/p>\n \/usr\/bin\/smbclient -L host<\/strong><\/p>\n smbclient –help<\/strong><\/p>\n Where L, list shares available on the host and N, don\u2019t ask for a password<\/p>\n smbclient -L \\\\192.168.1.13 -N<\/strong><\/p>\n Samba 2.2.8 and earlier versions have a buffer overflow vulnerability that could potentially allow an adversary to execute arbitrary code remotely. <\/p>\n Launch Metasploit, msfconsole<\/strong><\/p>\n Search Metasploit for any vulnerable samba modules, search samba<\/strong><\/p>\n This exploit should work for versions of Samba between 2.2.0-2.2.8 (but it doesn’t<\/em>). <\/p>\n First attempt was to try the Samba trans2open exploit for linux (can drop the exploit\/ part)<\/p>\n Again, it did not work\u2026but turns out there is a public Samba exploit that does.<\/p>\n Search kali\u2019s local repository for exploits, searchsploit samba 2.2<\/strong><\/p>\n Exit out of Metasploit <\/p>\n Go to the location of exploit <\/p>\n cd \/usr\/share\/exploitdb\/exploits\/multiple\/remote\/<\/strong><\/p>\n Copy file to local directory and build<\/p>\n cp 10.c \/some\/where\/local list samba command line options, <\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n
\ngcc -o samba 10.c
\n<\/strong><\/p>\n