cinno

local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local vulns = require "vulns"
local json = require "json"
local base64 = require "base64"

description = [[
A simple script based on the exploit mentioned here :

cinno

#!/usr/bin/env python3
"""
This is a program to link attackers together. I have designed it to create a graph from a CSV file 
containing information from kippo honeypots. The fields in the CSV can be customized but mine are:

"src_ip","client_country","client_city",username,password,url,filehost,filename,shasum,session,"_time"

These are all available from the version of Kippo available at https://github.com/micheloosterhof/kippo.
I am using splunk to create this CSV but anything will do.

cinno

#!/usr/bin/python
"""
Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya

The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by 
ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()'
in libtalloc does not write a value on 'creds' address.

Reference:
- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/