# Samba

* I first started by searching for exploits on `Samba smbd 3.0.20-Debian`.
* It looks like [exploit DB](https://www.exploit-db.com/exploits/16320) and [metasploit](https://www.rapid7.com/db/modules/exploit/multi/samba/usermap_script/) contain information for exploiting this.
* I'll give the metasploit exploit a try out.
* After starting up the metasploit console, I'll search for Samba related exploits.

```
search samba
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FBTdOh25CODqWeiQfdXqp%2Fimage.png?alt=media&#x26;token=2669f4a8-c3cd-4812-97bb-fa1568629298" alt=""><figcaption></figcaption></figure>

* I'll use exploit #8 in the list as that is the one that matches up with what I found online on Rapid7
* I'll then verify the exploit is the correct one.

```
info
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FnpSczrDd43ZyGBkVDPjd%2Fimage.png?alt=media&#x26;token=db2d05ab-a6b8-4564-b722-3092d5497ce5" alt=""><figcaption></figcaption></figure>

* It looks like the description matches up with the version I found online.
* Next is to check the options and set them.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FJdydKv50Y5o32m4MzRrL%2Fimage.png?alt=media&#x26;token=a559dc82-3754-4fd7-ad80-abf350b60f00" alt=""><figcaption></figcaption></figure>

* Looks like all I need to do is set the `RHOSTS` to my Host IP. Also check the LHOSTS to make sure it is correct.

```
set rhosts [Target IP]
```

* Then let's run the exploit.

```
exploit
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FDOZYyWSKzqUK8U9GsIXM%2Fimage.png?alt=media\&token=3470479a-a834-4900-a52d-96ab13ab9c30)

* It should be that easy. Redirect to /root to find the root.txt

```
cat /root/root.txt
```

The root flag is: **47b8ec8b36d966e1cde25938161b5334**



