rapid7/metasploit-framework — pull request #987 by mephos (2012-10-29 16:42:42+00:00)
Title: add meterpreter/command support to samba exploit using ROP

add support for arbitrary payload in samba CVE-2012-1182 exploit

ROP is performed against libgcrypt.so which is rarely modified/updated
Libgcrypt has been patched/modified after samba CVE was released, so if libgcrypt was updated on the system, samba was _very_ probably updated too and is no longer vulnerable

This way, ROP chain can be generic across minor versions of samba( 3.5.8~dfsg-1ubuntu2 , ubuntu2.1, ubuntu2.2 ...)

I left ROP chains for smbd binaries if someone's interested in it

ROP chain does mmap(PROT_WRITE|PROT_EXEC), memcpy and jmp on shellcode

Tested on ubuntu 10.10, 11.04, 11.10 and debian squeeze using meterpreter/reverse_tcp