CVE-2007-2447-Exploit

Exploit CVE-2007-2447 Ce dépôt contient un exploit pour Samba smbd 3.0.20 CVE-2007-2447 qui permet l'exécution de commandes à distance via des requêtes SMB manipulées. Prérequis Cet exploit nécessite Python 3 et quelques dépendances. Il est recommandé de configurer un environnement virtuel avant...

cve-2017-7494

Configuration de base Installer Samba version 4.5.9 https://download.samba.org/pub/samba/stable/samba-4.5.9.tar.gz https://wiki.samba.org/index.php/BuildSambafromSource Obtenir la version patchée d'Impacket pip install -r requirements.txt Utilisation 1. Démarrer le serveur Samba en mode interacti...

Samba-Exploit-CVE-2007-2447

🎬 Cette vidéo YouTube 1️⃣ Scanner la cible Nmap root@kitploit: nmap -sS -sV -p 139,445 192.168.56.102 Résultat attendu : 139/tcp open netbios-ssn Samba smbd 3.X 445/tcp open microsoft-ds Samba smbd 3.0.20-Debian 👉 Version de Samba : 3.0.20 Ceci est vulnérable à CVE-2007-2447. 2️⃣ Identifier...

CVE-2007-2447

CVE-2007-2447 - username map script La fonctionnalité MS-RPC dans smbd de Samba 3.0.0 à 3.0.25rc3 permet à des attaquants distants d'exécuter des commandes arbitraires via des métacaractères de shell impliquant la fonction 1 SamrChangePassword, lorsque l'option « username map script » de smb.conf...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The socket is closed after it has been accepted, even when the per-IP limit is exceeded and a connection attempt fails. When the per-IP connection limit is exceeded in ksmbdkthreadfn, the code sets ret to -EAGAIN and...

SUSE CVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

OESA-2026-3157 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A...

CVE-2026-59260

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...

CVE-2026-59260

OpenWrt luci-app-samba4 contains an ACL misconfiguration that grants file.exec permission on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments, enabling remote code execution via the SMB processing path. The vulnera...

CVE-2026-59260 OpenWrt luci-app-samba4 read ACL remote code execution via smbd

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...

PT-2026-57557

Name of the Vulnerable Software and Affected Versions luci-app-samba4 affected versions not specified Description An issue in the read Access Control List ACL grants file.exec permission on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon with command-line...

CVE-2026-53198

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL A deferred byte-range lock an SMB2LOCK that blocks registers an async work on conn-asyncrequests via setupasyncwork, with cancelfn = smb2removeblockedlock and...

PT-2026-51940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd crypt message function when using asynchronous hardware crypto engines, such as the Qualcomm Crypto Engine QCE. The function sets a NULL...

Missing access checks on reparse point

Description Starting with Samba 4.21, users can create and delete NTFS-style reparse points https://en.wikipedia.org/wiki/NTFSreparsepoint via the SMB protocol. The Reparse Point Metadata is stored in an extended attribute named "user.SmbReparse" together with the FILEATTRIBUTEREPARSEPOINT bit in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A mechToken leak was fixed when the SPNEGO decoding failed after the token allocation. The kernel’s ASN.1 BER decoder calls action callbacks incrementally as it processes the input. When ksmbddecodenegTokenInit reaches the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: The function ipcvalidatemsg now validates the response sizes. This function calculates the expected message size for each response type by adding or multiplying attacker-controlled fields from the daemon’s response to a...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. The Samba smbd file server must map Windows group identities SIDs to Unix group IDs gids. The code responsible for this mapping contained a flaw that could allow it to read data beyond the end of the array, in the event that a negative cache entry was added to the...

CLSA-2026-1778859875 samba: Fix of CVE-2025-0620

Fix CVE-2025-0620: smbd doesn't pick up group membership changes when re-authenticating an expired SMB session...

EUVD-2026-28682

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using callrcu for oplockinfo ksmbd currently frees oplockinfo immediately using kfree, even though it is accessed under RCU read-side critical sections in places like opinfoget and procshowfiles. Sinc...

SUSE CVE-2026-31609

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbdfreesendio after smbdsendbatchflush smbdsendbatchflush already calls smbdfreesendio, so we should not call it again after smbdpostsend moved it to the batch list...