[MUSIC PLAYING]
Exploiting Samba.
In this video, we are going to be exploring
the process of exploiting the Linux implementation of SMB,
which is Samba.
Now, during the enumeration section of this course,
we explore the process of performing SMB enumeration,
more specifically performing enumeration on Samba.
So you should be familiar with what Samba is.
However, if you're not, I'm going
to give you a basic or brief introduction to SMB and Samba.
So SMB stands for the Server Message Block,
and it is a network and file sharing
protocol that is used to facilitate the sharing of files
and peripherals between computers on a local network,
also known as a LAN.
So if you've ever worked within a Windows environment,
then you should be familiar with SMB.
SMB is used to share files or to create shares on a system,
and then those shares can be accessed by other Windows
systems within that local area network.
So SMB utilizes port 445 on TCP or rather the TCP port 445
by default. However, originally, SMB ran on top of NetBIOS
using port 139.
So that begs the question, what is Samba?
Well, Samba is the Linux implementation of SMB
and essentially allows Windows systems to access Linux shares
and devices, and vice versa.
So that's really what Samba is.
It's essentially SMB but for Linux.
And during the Windows exploitation section,
we explored the process of exploiting SMB on Windows
through the EternalBlue exploit or by exploiting the MS17-010
vulnerability.
It's going to be pretty much the same thing
here, where we are exploiting an inherent vulnerability
within Samba.
So we're not looking for a misconfigured Samba
server or a misconfigured Samba service that's
running on a target.
Instead, we are going to be targeting a vulnerability that
again in this case can be found within Samba version 3.5.0.
So Samba version 3.5.0 is vulnerable to a remote code
execution vulnerability, which allows
a malicious client or an attacker
to upload a shared library to a writable share
and then cause the server to load and execute it.
So a shared library is pretty much the Linux equivalent
of a DLL file.
So they're essentially libraries that
are called upon by services or programs.
And in this case, what we're doing--
and of course, we are going to be doing this
through a Metasploit framework exploit module.
What we're doing here is we're essentially
connecting to Samba on the Linux target
and then uploading a malicious shared
library that will consequently provide us
with a command shell.
And again, we'll take a look at how to upgrade that command
shell to interpret the session.
And of course, once the actual Samba server
loads it and executes it, we are going to get access.
So it's a really fairly simple exploit to understand.
And it works very similarly to the actual EternalBlue exploit.
In that, we are exploiting an inherent vulnerability,
not an SMB or a Samba misconfiguration.
All right.
So the lab environment in this case
will allow us to showcase or to demonstrate this.
And again, all you need to do is just start up
your lab environment, and you can then follow along.
So I'll see you within the lab environment.
All right.
So I'm back within the lab environment.
And the first step or the first thing we need to do
is of course identify the target IP address, which can
be done by typing in ifconfig.
And you want to look for the Ethernet one interface.
And this is the IP address of our current system
or the Kali Linux VM or the Kali Linux instance
that we're currently utilizing.
And the target IP address or the target system
is going to be on the same subnet.
Now, the subnet of course in your case
will change based on region, but the target IP address
is always going to be the next host or the next IP
address within this subnet.
So if our Kali Linux system or instance
has an IP address of 192.18.76.2,
then our target system is going to have
an IP address of 192.18.76.3.
So it's always going to be the third or the next IP address
within this particular subnet.
So I'm going to copy that.
We then want to start up the PostgreSQL service
so that we can interact with the Metasploit framework database.
I'm going to say start, hit Enter.
We're going to give that a few seconds.
We're then going to launch MSF console, which is also
going to take a few seconds.
We're then going to create a workspace
for our work or our assessment.
And we're going to call it Samba.
All right.
And we're then going to set the global variable for the Rhosts
option.
And we're going to specify the target
IP, so make sure to change the 2 into a 3 in your case.
The global variable option here will essentially
save us from manually or continually entering the target
IP whenever we load a new module, which is very helpful.
So we're setting up the global variable there.
The next step of course is to perform an Nmap scan
on the target to identify what version of Samba
is running on the target.
We can do this by utilizing the DB Nmap command, which again
is pretty much will allow us to perform an Nmap
scan from within the Metasploit framework console
and consequently save the results into the Metasploit
framework database.
So in this case, I'm going to perform
a SYN scan and a service detection scan,
as well as an operating system detection scan.
So that is denoted by SS, SV, and O.
We then paste in the target IP address.
Of course, make sure to change that to a 3.
And we start the Nmap scan.
So you want to give that a few seconds to a couple of minutes.
All right.
So the Nmap scan completes.
And as you can see, the target is running SMB
or has the SMB port open.
And the service version of SMB is Samba,
but it doesn't give us the exact version.
We only get a rough estimate, which
in this case what Nmap tells us is that it's either
running Samba version 3.X to 4.X, so anything
in between this, which in our case, we can actually check.
And of course, we can see that SMB is also
running on port 139 facilitated by NetBIOS,
which is again perfectly fine.
So what we can do now is of course run a quick search.
And in this case, we are going to again limit our search
results to the exploit modules.
And then for the name, we are just going to say Samba.
All right.
And the exploit module that we want to utilize
is the exploit Linux Samba is known pipename exploit module.
As you can see, the rank is set to excellent, which means
it works without any issues.
And as you can see, this is the Samba
is known pipename arbitrary module load.
So that's the exact module that we want to use.
So I'm going to copy that.
And we're going to say use and paste in the module name there.
If we show the options here, you can
see that we need to set up the target IP
address and the target SMB port, which is set correctly.
In this case, we don't need to set a payload
because it already has a payload configured.
However, we will need to actually configure or upgrade
our command shell into a meterpreter session, which
we can do really easily as we explored in the previous video.
We can also provide the SMB folder,
which again allows us to specify the directory to use
within the writable SMB share.
In our case, we have no idea or we
haven't enumerated any information regarding
the actual SMB folders or the share names that contains
the writable directory.
So all we need to do in this case is first of all run
the check command, which will actually check
if the target is vulnerable.
And in this case, you can see it says Samba version 4.1.17 found
with writable share.
In this case, we know that the target is really not
running version 4.1.7.
However, we do know that this particular exploit module runs
on version 3.5.0 to 4.4.14.
So it will work on the target system.
So we can hit Run.
That is going to execute the exploit
and is going to open up a command shell session.
So again, we can type in LS.
And let's see whether we get any output.
We can also try and run a few other commands like PWD.
And as you can see, that will print out our current working
directory on the Linux target system.
So we can put this in the background using the keyboard
combination Control and Z. It's going to prompt
us to put it in the background.
I'm going to say Yes.
And if we type or list out our sessions here,
you can see that we currently have a command shell
session on the target.
We want to upgrade this to a meterpreter session
because a meterpreter session is much better in regards
to access on the target system.
So we are going to search for a post-exploitation module called
shell to meterpreter.
And this is the module here.
So we're going to copy that and say use, paste in the module
there.
We show the options.
In this case, we need to set the Lhost option, that
is going to be the IP address of the host that
will receive the connection from the payload.
So this is going to be our Kali Linux instance IP.
And then the Lport is going to be the port for the payload
to connect to.
And then we need to set up the session ID, which in this case
is 1 because that's the session that we want to actually
upgrade or rather here it is.
So that's the actual command session
that we want to upgrade.
So we'll set the Lhost value to the IP address of the Kali
Linux instance.
And in this case, we can utilize the interface name
to set the IP address automatically,
and it does exactly that.
We're going to leave the default port here
because that port is currently open.
And we're then going to set the session to 1 and hit Run.
And that's going to upgrade our command shell session
into a meterpreter session.
So we're going to give that a few seconds.
There we are.
It says meterpreter session to open.
And if we list out our sessions now,
you can see that we have a meterpreter
session on the target system.
So if we type in sessions 2, you can
see that we have a meterpreter session on the target system.
And we can type in the sysinfo command
to get an idea of what the system is running
in regards to the distribution release version as well
as the kernel version.
In this case, we can see the target is running Debian 8.
And the Linux version or the Linux kernel version is 5.4.
We can enumerate the permissions that we currently
have by typing in get user ID.
And as you can see, we have the user ID
of 0, which is the root user, which consequently means
that we have the highest privileges
available on the Linux target.
And consequently means that we don't
need to elevate our privileges.
So that is how to exploit Samba on Linux.
And that is going to conclude the practical demonstration
within this video.
In the next video, we are going to be exploring
the process of exploiting a vulnerable SSH server running
on a Linux target.
So I'll see you there.