eSDee
Source-scoped identity with 6 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
ExploitDBSamba < 2.2.8 (Linux/BSD) - Remote Code Execution
ExploitDB exploitPublished 2003-04-10ExploitCVE-2003-02011 file
Analysis
Technical assessment
This C source code is a remote root exploit for Samba versions prior to 2.2.8. It exploits a buffer overflow in the call_trans2open function (CVE-2003-0201) by sending a crafted SMBtrans2 request. It includes shellcode for Linux and BSD variants, supports both bind and connect-back payloads, and provides a bruteforce mode to guess the return address.
Backdoor review
No backdoor observed in reviewed code
The supplied C source code is a public exploit for CVE-2003-0201, a buffer overflow in Samba. It sends crafted SMB packets to trigger remote code execution and establishes a shell (bind or connect-back) on the target. All behavior is consistent with the stated purpose of exploiting the vulnerability; no concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2003-0201 by constructing and sending a malicious SMBtrans2 packet that overwrites the return address to execute arbitrary shellcode, and then provides an interactive shell to the attacker. This is the definition of an exploit.
exploits/multiple/remote/10.c:636-689exploits/multiple/remote/10.c:485-528Requirements
- Target must be running a vulnerable version of Samba (2.2.x before 2.2.8a, 2.0.10 and earlier, or Samba-TNG before 0.3.2).
exploits/multiple/remote/10.c:2-4 - Attacker must be able to connect to the target's SMB port (default 139).
exploits/multiple/remote/10.c:199
Observed behavior
- Sends a NetBIOS name packet to port 137 to identify Samba hosts by checking for a MAC address of 00-00-00-00-00-00 in the response.
exploits/multiple/remote/10.c:209-278 - Establishes an SMB session by sending session setup and tree connect requests.
exploits/multiple/remote/10.c:554-634 - Sends a crafted SMBtrans2 request (command 0x32) containing a buffer overflow payload with NOP sled, return address overwrites, and shellcode.
exploits/multiple/remote/10.c:636-689 - Connects back to the attacker on port 45295 to provide an interactive shell, or listens for a connection if using a bind shellcode.
exploits/multiple/remote/10.c:485-528exploits/multiple/remote/10.c:1017-1028 - Executes shell commands (uname -a, id) on the compromised host to demonstrate root access.
exploits/multiple/remote/10.c:488
Behaviors behind the backdoor verdict
Observables
- Shellcode
- Payload withheldThese shellcode arrays implement bind-shell and connect-back shells on Linux and BSD targets. They are the payload delivered by the exploit and are standard for this class of exploit.
exploits/multiple/remote/10.c:95-144 - Exploit Mechanism
- Payload withheldThe exploit_normal and exploit_openbsd32 functions construct a buffer that overflows the call_trans2open function in Samba, overwriting the return address to redirect execution to the supplied shellcode.
exploits/multiple/remote/10.c:636-741 - Post Exploitation
- Payload withheldAfter the exploit triggers, the attacker connects to a bind shell (port 45295) or receives a connect-back shell, and the shell() function relays stdin/stdout to the socket, executing commands on the target.
exploits/multiple/remote/10.c:485-528
What the analysis did not establish
- Only the supplied C source file was reviewed; no external libraries, build artifacts, or runtime behavior were inspected.
- The shellcode byte arrays were not disassembled to confirm they contain only the described bind/connect-back shell functionality.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.