Security

Hacking a Samba server with Metasploit - Exploit on Metasploitable

A step-by-step walkthrough of the Metasploit usermap_script exploit against the Samba server of a Metasploitable2 machine, from the nmap scan to the shell.

· 4 min read · level: intermediate · on Samba 3.0.20

In this walkthrough the Kali-Linux system will be used as the attacker and the Metasploitable2 system as the victim.

The Samba server running by default on ports 445/139 will be targeted.

First of all, it is possible to scan the target with nmap -sV in order to find the ports and services open on the network.

nmap -sV 192.168.133.128
Illustration 1 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

The Metasploit framework is used for its many exploits. To do so, open a new terminal on the attacking system, then run the msfconsole command.

msfconsole
Illustration 2 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

First, it can be useful to open an auxiliary module in order to run a scan that will identify the version of Samba in use. To do this, use the use command and indicate the path module auxiliary/scanner/smb/smb_version to be used to run the scan.

use auxiliary/scanner/smb/smb_version

Now that the module is loaded, the options can be listed with the show options command and will then have to be set.

show options
Illustration 3 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

The RHOSTS option has to be set, because the Required column says yes and the Current Setting column is currently empty.

To set an option, use the set command followed by the name of the option RHOSTS, then by its value 192.168.133.128, the IP address of our target. (IP to be adapted)

set RHOSTS 192.168.133.128

The run command is used to launch the selected module.

run
Illustration 4 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

This scan retrieves the version used by SAMBA and does nothing harmful. The Samba version detected is apparently 3.0.20.

After a short Google search, it turns out that version 3.0.20 is affected by an exploit published on the first page of results by Rapid7, the very company that develops Metasploit.

Illustration 5 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

By going to the link, the path of the exploit to be used as well as the available options appear very quickly at the top of the page.

To carry out our attack, another module will have to be used, reachable through the path exploit/multi/samba/usermap_script, which is to be indicated with the use command.

use exploit/multi/samba/usermap_script

As with the previous module, it is always a good idea to look at the options.

show options
Illustration 6 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

The IP address of the remote target RHOSTS has to be entered again.

set RHOSTS 192.168.133.128

To launch the brute force attack, the run command has to be used again.

run
Illustration 7 — Hacker un serveur Samba avec metasploit - Exploit sur Metasploitable

A shell session has indeed been established with the target server, and this makes it possible to run commands from that server. By running a few commands such as whoami, pwd, ls -al and so on, it is possible to get a very quick sense of the environment.

Other pages are available to learn more about penetration testing.