0

I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows:

Module options (exploit/linux/samba/sambacry)
Payload options (linux/x64/meterpreter/reverse_tcp)
2   Linux x86_64 -> target

the rhost, rport, lhost, and lport are also set.

I run the exploit on kali linux on an aws ec2 instance. Each VM is in a different subnetwork, but I can ping one another with their respective private ip addresses.

Both VMs have no firewalls (security groups desabled allowing all inbound and outbound traffic)

The samba version I am using is 4.3.11 for ubuntu 4.4.0-1066-aws

Does anyones know the reason for me still getting "Exploit completed, but no session was created." ?

1

Target might have some sort of antivirus. Also maybe you mistyped some of data like lport,lhost.

| improve this answer | |
  • And outbound firewall rules – Dog eat cat world Aug 28 '18 at 18:20
  • @Dogeatcatworld the OP said that there are no firewalls – schroeder Aug 28 '18 at 18:52
  • 1
    There is no antivirus on the machines. I think the problem might be the fact that I am using virutal machines on amazon web service environment. But I am not sure. – user8955046 Aug 28 '18 at 18:55
  • @schroeder true. I ran into something similar the other day, where both antivirus and firewall rules were in the way. Could be an idea to test a connection with the same RHOST/RPORT parameters between he VM's. – Dog eat cat world Aug 28 '18 at 20:58
  • I did test the RHOST/RPORT between VMs with telnet on RPORT 445. The port state is on LISTEN state with smbd process PID 1005. – user8955046 Aug 29 '18 at 18:05
0

If you are not sure if your exploit work in that version, the 4.5.9 version is vulnerable for sure.

If you are using the reverse_tcp payload, do a test, in your attacker machine open a port and listen (nc -l -p <the reverse port that you are using>), and in your target machine try to connect to your attacker machine by nc -v <attacker> <port>. It should be verbose enough to determine if you have connectivity or not.

If all that works, here a Docker container if you want to test this exploit against a target that is for sure vulnerable https://github.com/opsxcq/exploit-CVE-2017-7494

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.