RADIUS与网络认证安全高危攻击链专题：FreeRADIUS / Samba / RADIUS 协议漏洞全解析

Response Authenticator = MD5(Code + Identifier + Length + Attributes + Shared Secret)

正常流程:
  NAS ──Access-Request──> RADIUS Server
  NAS <──Access-Reject─── RADIUS Server
  (用户被拒绝访问)

Blast-RADIUS 攻击流程:
  NAS ──Access-Request──> [Attacker] ──Access-Request──> RADIUS Server
  NAS <──?── [Attacker] <──Access-Reject─── RADIUS Server
                              │
                              ├─ 截获合法 Access-Reject
                              ├─ 注入恶意属性（MD5 collision padding）
                              ├─ 篡改 Response Authenticator
                              │
  NAS <──Access-Accept──── [Attacker 篡改的响应]
  (攻击者获得网络访问权限)

#!/bin/bash
# Blast-RADIUS 可达性检测脚本
# 检测目标 RADIUS 服务器是否监听以及是否支持 EAP

TARGET_HOST="${1:-127.0.0.1}"
TARGET_PORT="${2:-1812}"

echo "[*] 检测 RADIUS 服务器: ${TARGET_HOST}:${TARGET_PORT}"

# 使用 netcat 测试端口连通性
if nc -z -w 3 "${TARGET_HOST}" "${TARGET_PORT}" 2>/dev/null; then
    echo "[+] RADIUS 服务器端口开放"
else
    echo "[-] RADIUS 服务器端口不可达"
    exit 1
fi

# 使用 radclient 发送 Status-Server 探测包（需要安装 freeradius-utils）
if command -v radclient &>/dev/null; then
    echo "[*] 发送 Status-Server 探测..."
    echo "Message-Authenticator = 0x00" | radclient -t 5 -r 1 \
        "${TARGET_HOST}:${TARGET_PORT}" status "${SECRET:-testing123}" 2>&1
else
    echo "[-] radclient 未安装，跳过探测"
    echo "[*] 提示: apt install freeradius-utils"
fi

#!/usr/bin/env python3
"""
Blast-RADIUS (CVE-2024-3596) PoC Demo
仅用于安全研究和授权测试环境

依赖: pip install pycryptodome
"""

import socket
import struct
import hashlib
import os
import sys
import time

RADIUS_ACCESS_REQUEST = 1
RADIUS_ACCESS_ACCEPT = 2
RADIUS_ACCESS_REJECT = 3
RADIUS_ACCESS_CHALLENGE = 11

ATTR_MESSAGE_AUTHENTICATOR = 80
ATTR_STATE = 24


def build_radius_packet(code, identifier, attributes, shared_secret):
    """构建 RADIUS 包"""
    attr_data = b""
    for attr_type, attr_value in attributes:
        attr_len = len(attr_value) + 2
        attr_data += struct.pack("BB", attr_type, attr_len) + attr_value

    header = struct.pack("BBH", code, identifier, 0)
    authenticator = os.urandom(16)

    if code == RADIUS_ACCESS_REQUEST:
        auth_input = header[:4] + authenticator + attr_data + shared_secret
        authenticator = hashlib.md5(auth_input).digest()

    packet = header[:4] + authenticator + attr_data
    length = len(packet)
    packet = struct.pack("BBH", code, identifier, length) + packet[4:]
    return packet


def send_radius_request(server_host, server_port, packet, timeout=5):
    """发送 RADIUS 请求并接收响应"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(timeout)
    try:
        sock.sendto(packet, (server_host, server_port))
        response, _ = sock.recvfrom(4096)
        return response
    except socket.timeout:
        return None
    finally:
        sock.close()


def parse_radius_response(data):
    """解析 RADIUS 响应包"""
    if len(data) < 20:
        return None
    code = data[0]
    identifier = data[1]
    length = struct.unpack("!H", data[2:4])[0]
    authenticator = data[4:20]
    attributes = {}
    offset = 20
    while offset < length:
        attr_type = data[offset]
        attr_len = data[offset + 1]
        if attr_len < 2:
            break
        attr_value = data[offset + 2:offset + attr_len]
        attributes[attr_type] = attr_value
        offset += attr_len
    return {
        "code": code,
        "identifier": identifier,
        "authenticator": authenticator,
        "attributes": attributes
    }


def check_message_authenticator_required(server_host, server_port,
                                        shared_secret, username="test",
                                        password="test"):
    """
    检测 RADIUS 服务器是否要求 Message-Authenticator
    不包含 Message-Authenticator 发送请求，如果服务器仍然响应说明不强制要求
    """
    print(f"[*] 检测目标: {server_host}:{server_port}")
    print(f"[*] 测试用户: {username}")

    attrs = [
        (1, username.encode()),       # User-Name
        (2, password.encode()),       # User-Password
        (4, b"\xc0\xa8\x01\x01"),    # NAS-IP-Address
        (61, struct.pack("H", 6)),    # NAS-Port-Type (Ethernet)
    ]

    identifier = 0x01
    packet = build_radius_packet(
        RADIUS_ACCESS_REQUEST, identifier, attrs, shared_secret.encode()
    )

    response = send_radius_request(server_host, server_port, packet)
    if response is None:
        print("[-] 无响应（可能要求 Message-Authenticator 或服务器不可达）")
        return False

    parsed = parse_radius_response(response)
    if parsed:
        code_names = {2: "Access-Accept", 3: "Access-Reject", 11: "Access-Challenge"}
        code_name = code_names.get(parsed["code"], f"Unknown({parsed['code']})")
        print(f"[+] 收到响应: {code_name}")
        has_msg_auth = ATTR_MESSAGE_AUTHENTICATOR in parsed["attributes"]
        print(f"[*] 响应中是否包含 Message-Authenticator: {has_msg_auth}")
        print(f"[!] 服务器可能未强制要求 Message-Authenticator — 存在 Blast-RADIUS 风险")
        return True

    return False


def demonstrate_collision_concept():
    """演示 MD5 chosen-prefix collision 概念"""
    print("\n[*] === Blast-RADIUS 攻击原理演示 ===")
    print("[*] MD5 chosen-prefix collision 概念验证:")
    print("[*] 攻击者需要在 RADIUS 响应中注入 padding 属性，使得:")
    print("    MD5(original_response) == MD5(forged_response)")
    print("[*] 实际攻击中使用的 collision 计算需要大量 GPU 算力")
    print("[*] 根据研究团队报告，生成碰撞的时间约为 5-20 分钟")
    print("[*] 论文: https://www.blastradius.fail/pdf/radius.pdf")


if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"用法: {sys.argv[0]} <host> <port> <shared_secret>")
        print(f"示例: {sys.argv[0]} 192.168.1.1 1812 testing123")
        sys.exit(1)

    host = sys.argv[1]
    port = int(sys.argv[2])
    secret = sys.argv[3]

    check_message_authenticator_required(host, port, secret)
    demonstrate_collision_concept()

id: blast-radius-cve-2024-3596
info:
  name: Blast-RADIUS CVE-2024-3596 Detection
  author: security-researcher
  severity: critical
  description: Detects RADIUS servers vulnerable to Blast-RADIUS MD5 collision attack
  reference:
    - https://www.blastradius.fail/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3596
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cwe-id: CWE-354
  tags: radius,blast-radius,cve2024,cve,auth-bypass

variables:
  radius_secret: "testing123"

network:
  - inputs:
      - data: "{{hex_decode('01')}}{{hex_decode('01')}}{{hex_decode('00')}}{{hex_decode('26')}}{{rand_base(16)}}0106010601{{hex_decode('0a000101')}}{{generate_md5({{radius_secret}})}}"
        read: 1024
        host: "{{Hostname}}"
        port: "{{Port}}"
        type: udp

    host-redirects: true
    data:
      - "RADIUS server responded to Access-Request without Message-Authenticator"

    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - "02"

    extractors:
      - type: regex
        group: 1
        regex:
          - "(\\x02)"
        internal: true

#!/bin/bash
TARGET="${1:-127.0.0.1}"
PORT="${2:-1812}"

echo "[*] 检测 FreeRADIUS 版本和配置..."

# 使用 radclient 发送 Status-Server 获取服务器信息
if command -v radclient &>/dev/null; then
    echo "Message-Authenticator = 0x00" | radclient -t 3 -r 1 \
        "${TARGET}:${PORT}" status "testing123" 2>&1 | head -20
else
    echo "[-] radclient 未安装"
    echo "[*] 可通过 nmap 脚本检测:"
    echo "    nmap -sU -p 1812 --script radius-info ${TARGET}"
fi

#!/usr/bin/env python3
"""
FreeRADIUS Race Condition Detection (CVE-2022-33453)
检测 FreeRADIUS 在并发认证场景下的竞争条件

依赖: pip install pycryptodome
"""

import socket
import struct
import hashlib
import os
import threading
import time
import sys
import concurrent.futures

RADIUS_ACCESS_REQUEST = 1
RADIUS_ACCESS_ACCEPT = 2
RADIUS_ACCESS_REJECT = 3


def build_access_request(identifier, username, password, shared_secret):
    """构建 Access-Request 包"""
    attrs = b""
    # User-Name
    username_bytes = username.encode()
    attrs += struct.pack("BB", 1, len(username_bytes) + 2) + username_bytes
    # User-Password (简单编码，实际应使用 RFC 2865 加密)
    password_padded = password.encode().ljust(16, b'\x00')[:16]
    auth_bytes = os.urandom(16)
    encrypted_pw = bytes(a ^ b for a, b in zip(
        password_padded,
        hashlib.md5(auth_bytes + password.encode() + shared_secret.encode()).digest()[:len(password_padded)]
    ))
    attrs += struct.pack("BB", 2, len(encrypted_pw) + 2) + encrypted_pw
    # NAS-IP-Address
    attrs += struct.pack("BBBI", 4, 6, 1, 0xc0a80101)
    # NAS-Port-Type
    attrs += struct.pack("BBBH", 61, 3, 6, 15)

    authenticator = auth_bytes
    header = struct.pack("BBH", RADIUS_ACCESS_REQUEST, identifier, len(attrs) + 20)
    return header[:4] + authenticator + attrs


def send_and_receive(host, port, packet, secret, timeout=3):
    """发送并接收 RADIUS 响应"""
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(timeout)
    try:
        sock.sendto(packet, (host, port))
        resp, _ = sock.recvfrom(4096)
        return resp[0]
    except socket.timeout:
        return None
    except Exception:
        return None
    finally:
        sock.close()


def race_condition_test(host, port, secret, num_threads=50, requests_per_thread=100):
    """并发发送认证请求，检测竞争条件"""
    results = {"accept": 0, "reject": 0, "timeout": 0, "other": 0}
    lock = threading.Lock()

    def worker(thread_id):
        for i in range(requests_per_thread):
            identifier = (thread_id * 100 + i) % 256
            packet = build_access_request(
                identifier, f"user{thread_id}", "wrongpassword", secret
            )
            resp_code = send_and_receive(host, port, packet, secret)
            with lock:
                if resp_code == RADIUS_ACCESS_ACCEPT:
                    results["accept"] += 1
                elif resp_code == RADIUS_ACCESS_REJECT:
                    results["reject"] += 1
                elif resp_code is None:
                    results["timeout"] += 1
                else:
                    results["other"] += 1

    print(f"[*] 启动 {num_threads} 个并发线程，每线程 {requests_per_thread} 个请求...")
    start_time = time.time()

    with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:
        futures = [executor.submit(worker, t) for t in range(num_threads)]
        concurrent.futures.wait(futures)

    elapsed = time.time() - start_time
    total = num_threads * requests_per_thread

    print(f"\n[*] 测试完成 ({elapsed:.2f}秒)")
    print(f"[*] 总请求数: {total}")
    print(f"    Access-Accept: {results['accept']}")
    print(f"    Access-Reject: {results['reject']}")
    print(f"    Timeout: {results['timeout']}")
    print(f"    Other: {results['other']}")

    if results["accept"] > 0:
        print(f"\n[!] 警告: 收到 {results['accept']} 个 Access-Accept!")
        print("[!] 使用错误密码却收到 Accept — 可能存在竞争条件漏洞")
    else:
        print(f"\n[+] 未检测到异常 Accept 响应")


if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"用法: {sys.argv[0]} <host> <port> <shared_secret>")
        sys.exit(1)

    race_condition_test(sys.argv[1], int(sys.argv[2]), sys.argv[3])

id: freeradius-race-condition-cve-2022-33453
info:
  name: FreeRADIUS Race Condition Detection
  author: security-researcher
  severity: high
  description: Detects FreeRADIUS race condition vulnerability
  classification:
    cvss-score: 7.5
    cwe-id: CWE-362
  tags: freeradius,race-condition,cve2022

network:
  - inputs:
      - data: "010100260000000000000000000000000106010106"
        host: "{{Hostname}}"
        port: "{{Port}}"
        type: udp
        read: 512

    matchers:
      - type: word
        part: body
        words:
          - "FreeRADIUS"

    extractors:
      - type: regex
        regex:
          - "(FreeRADIUS [\\d\\.]+)"

#!/bin/bash
# 检测 Windows 域控制器的 Netlogon RC4 状态
# 需要域内认证信息

DOMAIN_CONTROLLER="${1:-dc01.local}"
DOMAIN="${2:-EXAMPLE}"
USERNAME="${3:-administrator}"

echo "[*] 检测 Netlogon 加密配置..."

# 检查 RequireSeal 注册表值 (Windows)
echo "[*] 在域控制器上检查以下注册表值:"
echo "    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireSeal"
echo "    值: 0=禁用, 1=兼容模式, 2=强制模式"

# 检查 RejectMd5Clients
echo "[*] 检查 RejectMd5Clients 策略:"
echo "    HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Netlogon\\Parameters\\RejectMd5Clients"
echo "    值: 0=允许, 1=拒绝RC4客户端"

# 使用 nmap 检测
if command -v nmap &>/dev/null; then
    echo "[*] 使用 Nmap 脚本检测..."
    nmap -p 389,636,88,445 --script smb2-security-mode,netlogon "${DOMAIN_CONTROLLER}" 2>/dev/null
fi

#!/usr/bin/env python3
"""
CVE-2022-38023 Netlogon RC4 Detection
检测域环境中 Netlogon Secure Channel 是否仍使用 RC4 加密
"""

import subprocess
import sys
import re


def check_netlogon_events(dc_ip):
    """
    检测域控制器上的 Netlogon Event ID 5840
    当 RC4 连接被建立时会记录此事件
    """
    print(f"[*] 检测 {dc_ip} 的 Netlogon 加密状态...")
    print("[*] 请在域控制器上检查 Windows 事件日志:")
    print("    日志来源: Netlogon")
    print("    事件 ID: 5840")
    print("    事件描述: The Netlogon service created a secure channel")
    print("             with a client with RC4.")
    print()

    print("[*] PowerShell 检查命令:")
    print(f'    Get-WinEvent -FilterHashtable @{{LogName="System"; ProviderName="Netlogon"; Id=5840}} | Select-Object -First 10')
    print()


def check_samba_config(smb_conf_path="/etc/samba/smb.conf"):
    """检查 Samba 的 Netlogon 加密配置"""
    print(f"[*] 检查 Samba 配置: {smb_conf_path}")
    try:
        with open(smb_conf_path, 'r') as f:
            content = f.read()

        if "server schannel = auto" in content or "server schannel = yes" in content:
            print("[!] Samba 配置允许 Netlogon Secure Channel")
            print("[!] 如果未更新到修复版本，可能使用 RC4 加密")
        else:
            print("[+] Samba 未配置 Netlogon Secure Channel 或已禁用")

        if "server min protocol = SMB2" in content:
            print("[+] SMB 最低协议版本设置为 SMB2+")
    except FileNotFoundError:
        print(f"[-] 未找到配置文件: {smb_conf_path}")
        print("[*] 请检查 samba-tool testparm 输出")


def check_ntlm_config():
    """检查 NTLM 相关安全配置"""
    print("[*] Windows 域环境中 NTLM 安全配置检查:")
    print("    1. 检查是否启用了 SMB 签名:")
    print('       Get-SmbServerConfiguration | Select RequireSecuritySignature')
    print("    2. 检查是否启用了 LDAP 签名:")
    print('       Get-ItemProperty "HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters" -Name "LDAPServerIntegrity"')
    print("    3. 检查 EPA (Extended Protection for Authentication):")
    print('       Get-ItemProperty "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters" -Name "RequireUTF8"')


if __name__ == "__main__":
    dc_ip = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    check_netlogon_events(dc_ip)
    check_samba_config()
    check_ntlm_config()

id: samba-netlogon-cve-2022-38023
info:
  name: Samba Netlogon RC4 Weakness Detection
  author: security-researcher
  severity: high
  description: Detects Samba installations vulnerable to Netlogon RC4 weakness
  reference:
    - https://www.samba.org/samba/security/CVE-2022-38023.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38023
  classification:
    cvss-score: 8.1
    cwe-id: CWE-327
  tags: samba,netlogon,ntlm,cve2022,cve

network:
  - inputs:
      - data: "{{hex_decode('00')}}{{rand_base(2)}}{{rand_base(2)}}00000000000000000000000000000000000000200002000000"
        host: "{{Hostname}}"
        port: 445
        type: tcp

    matchers:
      - type: word
        words:
          - "Samba"
          - "smb"
        condition: or

    extractors:
      - type: regex
        regex:
          - "(Samba [\\d\\.]+)"

#!/bin/bash
TARGET="${1:-127.0.0.1}"

echo "[*] 检测 Samba Spotlight 配置..."

# 使用 smbclient 检查共享配置
if command -v smbclient &>/dev/null; then
    echo "[*] 枚举 Samba 共享..."
    smbclient -L "${TARGET}" -N 2>/dev/null | grep -i "spotlight\|share"

    # 检查 smb.conf 是否启用 Spotlight
    echo "[*] 请检查 smb.conf 中的 spotlight 配置:"
    echo "    grep -i spotlight /etc/samba/smb.conf"
fi

# Nmap 检测
echo "[*] 使用 Nmap 检测..."
nmap -p 445 --script smb-enum-shares "${TARGET}" 2>/dev/null | grep -i spotlight

id: samba-spotlight-dos-cve-2023-34966
info:
  name: Samba Spotlight Infinite Loop DoS
  author: security-researcher
  severity: high
  description: Detects Samba servers with Spotlight enabled (vulnerable to CVE-2023-34966)
  reference:
    - https://www.samba.org/samba/security/CVE-2023-34966.html
  classification:
    cvss-score: 7.5
    cwe-id: CWE-835
  tags: samba,spotlight,dos,cve2023,cve

network:
  - inputs:
      - data: "{{hex_decode('05')}}{{rand_base(1)}}{{rand_base(1)}}0000000000000000000000000000000000000000"
        host: "{{Hostname}}"
        port: 445
        type: tcp
        read: 256

    matchers:
      - type: word
        words:
          - "SMB"

    extractors:
      - type: regex
        regex:
          - "(Samba [\\d\\.]+)"

#!/bin/bash
TARGET="${1:-127.0.0.1}"
echo "[*] 检测 Samba 版本: ${TARGET}"
nmap -p 445 --script smb-os-discovery "${TARGET}" 2>/dev/null | grep -E "OS:|Version:|Samba"

#!/bin/bash
echo "[*] 检测系统 Kerberos 版本..."

# 检查 MIT Kerberos 版本
if command -v krb5-config &>/dev/null; then
    echo "[*] MIT Kerberos 版本:"
    krb5-config --version 2>/dev/null
fi

# 检查 Samba 内嵌 Kerberos
if command -v samba &>/dev/null; then
    echo "[*] Samba 版本:"
    samba --version 2>/dev/null
fi

# 检查 Heimdal
if command -v heimdal-versions &>/dev/null; then
    echo "[*] Heimdal 版本:"
    heimdal-versions 2>/dev/null
fi

# 使用 nmap 检测
echo "[*] 使用 Nmap 检测 KDC..."
nmap -p 88 --script krb5-enum-users --script-args userdb=/dev/null 127.0.0.1 2>/dev/null | head -20

#!/usr/bin/env python3
"""
CVE-2022-42898 Kerberos PAC Integer Overflow Detection
检测 KDC 是否使用存在漏洞的 Kerberos 版本

依赖: pip install impacket
"""

import sys

try:
    from impacket.krb5.kerberosv5 import KerberosV5
    from impacket.krb5.types import Principal, KerberosTime
    IMPACKET_AVAILABLE = True
except ImportError:
    IMPACTION_AVAILABLE = False
    print("[*] impacket 未安装，使用简化检测")
    print("[*] pip install impacket")


def detect_kerberos_version(kdc_host, kdc_port=88):
    """通过 Kerberos 协议交互检测版本信息"""
    print(f"[*] 目标 KDC: {kdc_host}:{kdc_port}")

    # 发送 AS-REQ 并检查响应中的版本信息
    # 注意: 这只是简单的连通性检测
    import socket
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((kdc_host, kdc_port))
        print(f"[+] KDC 端口开放: {kdc_host}:{kdc_port}")
        sock.close()
    except Exception as e:
        print(f"[-] KDC 不可达: {e}")
        return

    print("[*] 建议检查以下组件的版本:")
    print("    - krb5kdc (MIT Kerberos)")
    print("    - Samba AD DC (内嵌 Heimdal)")
    print("    - 升级到 krb5 >= 1.19.4 或 1.20.1+")
    print("    - 升级到 Samba >= 4.15.12 / 4.16.7 / 4.17.3")


if __name__ == "__main__":
    kdc = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_kerberos_version(kdc)

id: samba-kerberos-pac-cve-2022-42898
info:
  name: Samba Kerberos PAC Integer Overflow Detection
  author: security-researcher
  severity: high
  description: Detects Samba/Kerberos versions vulnerable to PAC integer overflow
  reference:
    - https://www.samba.org/samba/security/CVE-2022-42898.html
    - https://web.mit.edu/kerberos/advisories/
  classification:
    cvss-score: 8.8
    cwe-id: CWE-190
  tags: samba,kerberos,pac,cve2022,cve,overflow

tcp:
  - inputs:
      - data: "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"
        host: "{{Hostname}}"
        port: 88

    matchers:
      - type: word
        words:
          - "\x00\x05"

#!/bin/bash
TARGET="${1:-127.0.0.1}"

echo "[*] 检测 CVE-2026-4408 易受攻击配置..."

# 检查 samba-dcerpcd 是否作为系统服务运行
echo "[*] 检查 samba-dcerpcd 服务状态:"
systemctl status samba-dcerpcd 2>/dev/null || echo "    samba-dcerpcd 未作为 systemd 服务运行"

# 检查 smb.conf 中的 check password script
echo "[*] 检查 check password script 配置:"
testparm -v 2>/dev/null | grep -i "check password script" || echo "    未配置 check password script"

# 使用 Nmap 检测 SAMR 服务
echo "[*] 使用 Nmap 检测 SAMR 服务..."
nmap -p 445 --script smb-enum-shares,smb-os-discovery "${TARGET}" 2>/dev/null | head -30

id: samba-samr-rce-cve-2026-4408
info:
  name: Samba SAMR Command Injection RCE
  author: security-researcher
  severity: critical
  description: Detects Samba vulnerable to SAMR check password script command injection
  reference:
    - https://www.samba.org/samba/security/CVE-2026-4408.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4408
  classification:
    cvss-score: 9.8
    cwe-id: CWE-78
  tags: samba,samr,rce,cve2026,cve,injection

network:
  - inputs:
      - data: "{{hex_decode('00')}}{{rand_base(2)}}{{rand_base(2)}}00000000"
        host: "{{Hostname}}"
        port: 445
        type: tcp
        read: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Samba"

    extractors:
      - type: regex
        regex:
          - "(Samba [\\d\\.]+)"

#!/bin/bash
TARGET="${1:-127.0.0.1}"

echo "[*] 检测 CVE-2026-4480 打印共享配置..."

# 枚举共享
echo "[*] 枚举 Samba 共享..."
smbclient -L "${TARGET}" -N 2>/dev/null | grep -i "print"

# 检查 smb.conf 打印配置
echo "[*] 检查打印相关配置:"
testparm -v 2>/dev/null | grep -E "print command|printing|spoolss" || echo "    无法读取配置"

# Nmap 检测
echo "[*] 使用 Nmap 检测打印服务..."
nmap -p 445 --script smb-enum-shares "${TARGET}" 2>/dev/null | grep -i print

id: samba-print-rce-cve-2026-4480
info:
  name: Samba Print Command Injection RCE
  author: security-researcher
  severity: critical
  description: Detects Samba vulnerable to print command injection via %J macro
  reference:
    - https://www.hackthebox.com/blog/cve-2026-4480-samba-rce-vulnerability
  classification:
    cvss-score: 10.0
    cwe-id: CWE-78
  tags: samba,print,rce,cve2026,cve,injection

network:
  - inputs:
      - data: "{{hex_decode('00')}}{{rand_base(2)}}{{rand_base(2)}}00000000"
        host: "{{Hostname}}"
        port: 445
        type: tcp
        read: 1024

    matchers:
      - type: word
        words:
          - "Samba"

#!/bin/bash
TARGET="${1:-127.0.0.1}"
API_PORT="${2:-8000}"

echo "[*] 检测 Kea DHCP API 可达性: ${TARGET}:${API_PORT}"

# 检测 Kea Control Agent API
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST \
    -H "Content-Type: application/json" \
    -d '{"command":"version-get","service":["dhcp4"]}' \
    "http://${TARGET}:${API_PORT}/" 2>/dev/null)

if [ "${HTTP_CODE}" = "200" ]; then
    echo "[+] Kea API 端口开放且可访问"
    echo "[!] 可能存在 CVE-2026-3608 风险 — 请确认 Kea 版本"

    # 获取版本信息
    curl -s -X POST \
        -H "Content-Type: application/json" \
        -d '{"command":"version-get","service":["dhcp4"]}' \
        "http://${TARGET}:${API_PORT}/" 2>/dev/null | python3 -m json.tool 2>/dev/null
else
    echo "[-] Kea API 不可达 (HTTP ${HTTP_CODE})"
fi

#!/usr/bin/env python3
"""
CVE-2026-3608 Kea DHCP Stack Overflow Detection
检测 Kea DHCP API 是否存在栈溢出漏洞
"""

import json
import sys

try:
    import requests
    REQUESTS_AVAILABLE = True
except ImportError:
    REQUESTS_AVAILABLE = False
    print("[*] requests 未安装: pip install requests")


def check_kea_version(host, port=8000):
    """通过 API 检查 Kea 版本"""
    url = f"http://{host}:{port}/"

    payload = {
        "command": "version-get",
        "service": ["dhcp4"]
    }

    headers = {"Content-Type": "application/json"}

    try:
        resp = requests.post(url, json=payload, headers=headers, timeout=5)
        if resp.status_code == 200:
            data = resp.json()
            print(f"[+] Kea API 响应: {json.dumps(data, indent=2)}")

            # 检查版本
            result = data.get("arguments", {}).get("extended", "")
            if result:
                version = result.split("-")[0] if "-" in result else result
                print(f"[*] Kea 版本: {version}")

                # 检查是否在受影响范围内
                parts = version.split(".")
                if len(parts) >= 2:
                    major = int(parts[0])
                    minor = int(parts[1])

                    if major == 2 and minor == 6:
                        patch = int(parts[2]) if len(parts) > 2 else 0
                        if patch <= 4:
                            print("[!] 易受 CVE-2026-3608 影响! 请升级到 2.6.5+")
                    elif major == 3 and minor == 0:
                        patch = int(parts[2]) if len(parts) > 2 else 0
                        if patch <= 2:
                            print("[!] 易受 CVE-2026-3608 影响! 请升级到 3.0.3+")
                    else:
                        print("[+] 版本不在已知受影响范围内")
        else:
            print(f"[-] API 返回 HTTP {resp.status_code}")
    except requests.exceptions.ConnectionError:
        print(f"[-] 无法连接到 Kea API: {host}:{port}")
    except Exception as e:
        print(f"[-] 检测失败: {e}")


if __name__ == "__main__":
    if not REQUESTS_AVAILABLE:
        sys.exit(1)

    host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 8000

    check_kea_version(host, port)

id: kea-dhcp-stackoverflow-cve-2026-3608
info:
  name: ISC Kea DHCP Stack Overflow Detection
  author: security-researcher
  severity: high
  description: Detects ISC Kea DHCP vulnerable to stack overflow via API socket
  reference:
    - https://kb.isc.org/docs/cve-2026-3608
    - https://nvd.nist.gov/vuln/detail/CVE-2026-3608
  classification:
    cvss-score: 7.5
    cwe-id: CWE-121
  tags: kea,dhcp,stack-overflow,cve2026,cve

http:
  - method: POST
    path:
      - "{{BaseURL}}/"
    headers:
      Content-Type: application/json
    body: '{"command":"version-get","service":["dhcp4"]}'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "result"
          - "version"
        condition: and

    extractors:
      - type: json
        json:
          - ".arguments.version"

#!/bin/bash
echo "[*] 检测 ISC DHCP 版本..."

# 检查 dhclient 版本
if command -v dhclient &>/dev/null; then
    echo "[*] dhclient 版本:"
    dhclient --version 2>&1 | head -5
fi

# 检查 dhcpd 版本
if command -v dhcpd &>/dev/null; then
    echo "[*] dhcpd 版本:"
    dhcpd --version 2>&1 | head -5
fi

# 检查包管理器版本
echo "[*] 包管理器版本:"
dpkg -l | grep -i dhcp 2>/dev/null || rpm -qa | grep -i dhcp 2>/dev/null

echo "[*] 如版本在 4.1.0 - 4.4.0 之间，请升级到修复版本"

id: isc-dhcp-buffer-overflow-cve-2018-5732
info:
  name: ISC DHCP dhclient Buffer Overflow Detection
  author: security-researcher
  severity: high
  description: Detects ISC DHCP installations vulnerable to dhclient buffer overflow
  reference:
    - https://kb.isc.org/docs/aa-01562
    - https://nvd.nist.gov/vuln/detail/CVE-2018-5732
  classification:
    cvss-score: 7.5
    cwe-id: CWE-120
  tags: isc,dhcp,buffer-overflow,cve2018,cve

tcp:
  - inputs:
      - data: "\x01\x01\x06\x00"
        host: "{{Hostname}}"
        port: 67
        read: 512

    matchers:
      - type: word
        words:
          - "DHCP"