@@ -24,6 +24,7 @@ def initialize(info = {})
24
24
[
25
25
'steelo <knownsteelo[at]gmail.com>' , # Vulnerability Discovery
26
26
'hdm' , # Metasploit Module
27
+ 'Brendan Coles <bcoles[at]gmail.com>' , # Check logic
27
28
] ,
28
29
'License' => MSF_LICENSE ,
29
30
'References' =>
@@ -270,6 +271,54 @@ def find_payload
270
271
end
271
272
end
272
273
274
+ def check
275
+ res = smb_fingerprint
276
+
277
+ unless res [ 'native_lm' ] =~ /Samba ([\d \. ]+)/
278
+ print_error ( "does not appear to be Samba: #{ res [ 'os' ] } / #{ res [ 'native_lm' ] } " )
279
+ return CheckCode ::Safe
280
+ end
281
+
282
+ samba_version = Gem ::Version . new ( $1. gsub ( /\. $/ , '' ) )
283
+
284
+ vprint_status ( "Samba version identified as #{ samba_version . to_s } " )
285
+
286
+ if samba_version < Gem ::Version . new ( '3.5.0' )
287
+ return CheckCode ::Safe
288
+ end
289
+
290
+ # Patched in 4.4.14
291
+ if samba_version < Gem ::Version . new ( '4.5.0' ) &&
292
+ samba_version >= Gem ::Version . new ( '4.4.14' )
293
+ return CheckCode ::Safe
294
+ end
295
+
296
+ # Patched in 4.5.10
297
+ if samba_version > Gem ::Version . new ( '4.5.0' ) &&
298
+ samba_version < Gem ::Version . new ( '4.6.0' ) &&
299
+ samba_version >= Gem ::Version . new ( '4.5.10' )
300
+ return CheckCode ::Safe
301
+ end
302
+
303
+ # Patched in 4.6.4
304
+ if samba_version >= Gem ::Version . new ( '4.6.4' )
305
+ return CheckCode ::Safe
306
+ end
307
+
308
+ connect
309
+ smb_login
310
+ find_writeable_share_path
311
+ disconnect
312
+
313
+ if @share . to_s . length == 0
314
+ print_status ( "Samba version #{ samba_version . to_s } found, but no writeable share has been identified" )
315
+ return CheckCode ::Detected
316
+ end
317
+
318
+ print_good ( "Samba version #{ samba_version . to_s } found with writeable share '#{ @share } '" )
319
+ return CheckCode ::Appears
320
+ end
321
+
273
322
def exploit
274
323
# Setup SMB
275
324
connect
0 commit comments