#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Detect exposure to CVE-2025-10230 on Samba Active Directory Domain Controllers. # # DESCRIPTION # This script inspects the local Samba installation and configuration to assess # whether the host is exposed to CVE-2025-10230. # # It performs the following checks: # - Detects Samba version and classifies it as vulnerable or not vulnerable # based on upstream fixed releases (4.21.9, 4.22.5, 4.23.2 and newer). # - Reads "server role" to verify if the host is an AD Domain Controller. # - Reads "wins support" and "wins hook" from smb.conf via testparm. # # VARIABLES TO DEFINE: # # Optional: override tool paths via environment variables # # SAMBA_TOOL="..." # optional — default is "samba-tool" # # TESTPARM="..." # optional — default is "testparm" # # WARNINGS: # # - This script is read-only: it does NOT modify smb.conf or restart services. # # - It should be executed with enough privileges to run samba-tool/testparm and # # read the effective Samba configuration (usually root on production systems). # # - It focuses on the AD DC + WINS + wins hook scenario; other Samba roles are # # reported as "not affected" for this specific CVE. # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== info(){ echo "[i] $*"; } good(){ echo "[+] $*"; } warn(){ echo "[!] $*"; } bad(){ echo "[-] $*"; } SAMBA_TOOL="${SAMBA_TOOL:-samba-tool}" TESTPARM="${TESTPARM:-testparm}" parse_semver() { local v="$1" v=${v%%-*} local major minor patch IFS='.' read -r major minor patch _ <<< "$v" : "${major:=0}" "${minor:=0}" "${patch:=0}" echo "$major" "$minor" "$patch" } version_ge() { local v1 v2 M1 m1 p1 M2 m2 p2 v1="$1"; v2="$2" read -r M1 m1 p1 <<< "$(parse_semver "$v1")" read -r M2 m2 p2 <<< "$(parse_semver "$v2")" if (( M1 > M2 )); then return 0; fi if (( M1 < M2 )); then return 1; fi if (( m1 > m2 )); then return 0; fi if (( m1 < m2 )); then return 1; fi if (( p1 >= p2 )); then return 0; fi return 1 } SAMBAVERSION="" if command -v "$SAMBA_TOOL" >/dev/null 2>&1; then SAMBAVERSION=$("$SAMBA_TOOL" --version 2>/dev/null | head -n1 | awk '{print $NF}') elif command -v smbd >/dev/null 2>&1; then SAMBAVERSION=$(smbd --version 2>/dev/null | awk '{print $NF}') fi if [ -z "$SAMBAVERSION" ]; then info "Version: (Samba not detected)" good "This system is NOT affected by CVE-2025-10230 (Samba not found)." return 0 2>/dev/null || true fi info "Version: $SAMBAVERSION" read -r MAJ MIN PATCH <<< "$(parse_semver "$SAMBAVERSION")" IS_VULN_VERSION=false if (( MAJ < 4 )); then IS_VULN_VERSION=false elif (( MAJ > 4 )); then IS_VULN_VERSION=false else if version_ge "$SAMBAVERSION" "4.23.2" || \ version_ge "$SAMBAVERSION" "4.24.0"; then IS_VULN_VERSION=false elif version_ge "$SAMBAVERSION" "4.22.5" && ! version_ge "$SAMBAVERSION" "4.23.0"; then IS_VULN_VERSION=false elif version_ge "$SAMBAVERSION" "4.21.9" && ! version_ge "$SAMBAVERSION" "4.22.0"; then IS_VULN_VERSION=false else IS_VULN_VERSION=true fi fi if $IS_VULN_VERSION; then warn "This version is in a vulnerable range for CVE-2025-10230." else good "This version is NOT in the vulnerable range for CVE-2025-10230." fi if ! command -v "$TESTPARM" >/dev/null 2>&1; then warn "Configuration could not be inspected (testparm not found)." if $IS_VULN_VERSION; then warn "Manual review required: check server role, wins support and wins hook in smb.conf." fi return 0 2>/dev/null || true fi SERVER_ROLE=$("$TESTPARM" -s --parameter-name='server role' 2>/dev/null | tr -d '\r') if [ -z "$SERVER_ROLE" ]; then SERVER_ROLE=$("$TESTPARM" -s 2>/dev/null | awk -F'=' ' tolower($1) ~ /server role/ { gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit }') fi SERVER_ROLE=${SERVER_ROLE:="(not set)"} role_lc=$(printf '%s' "$SERVER_ROLE" | tr 'A-Z' 'a-z') IS_DC=false if echo "$role_lc" | grep -qi "domain controller"; then IS_DC=true elif echo "$role_lc" | grep -qi "active directory"; then IS_DC=true elif echo "$role_lc" | grep -qi "dc"; then IS_DC=true fi if $IS_DC; then bad "Server role: Active Directory Domain Controller" else good "Server role: Not an AD Domain Controller" fi WINS_SUPPORT=$("$TESTPARM" -s --parameter-name='wins support' 2>/dev/null | tr -d '\r') if [ -z "$WINS_SUPPORT" ]; then WINS_SUPPORT=$("$TESTPARM" -s 2>/dev/null | awk -F'=' ' tolower($1) ~ /wins support/ { gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit }') fi WINS_SUPPORT=${WINS_SUPPORT:-"No (default)"} wins_support_lc=$(printf '%s' "$WINS_SUPPORT" | tr 'A-Z' 'a-z') WINS_ENABLED=false if echo "$wins_support_lc" | grep -Eq "yes|true|1"; then WINS_ENABLED=true fi if $WINS_ENABLED; then bad "WINS support: enabled" else good "WINS support: disabled or not set" fi WINS_HOOK=$("$TESTPARM" -s --parameter-name='wins hook' 2>/dev/null | tr -d '\r') if [ -z "$WINS_HOOK" ]; then WINS_HOOK=$("$TESTPARM" -s 2>/dev/null | awk -F'=' ' tolower($1) ~ /wins hook/ { gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit }') fi WINS_HOOK_TRIM=$(printf '%s' "$WINS_HOOK" | sed 's/^[ \t]*//;s/[ \t]*$//') WINS_HOOK_SET=false if [ -z "$WINS_HOOK_TRIM" ]; then good "wins hook: empty or not set" else WINS_HOOK_SET=true bad "wins hook: configured ($WINS_HOOK_TRIM)" fi if ! $IS_DC; then good "This system is NOT affected by CVE-2025-10230 (host is not a Samba AD Domain Controller)." return 0 2>/dev/null || true fi if ! $IS_VULN_VERSION; then good "This system is NOT affected by CVE-2025-10230 (Samba version is not in the vulnerable range)." return 0 2>/dev/null || true fi if $WINS_ENABLED && $WINS_HOOK_SET; then bad "Vulnerable configuration detected (AD DC + WINS enabled + non-empty wins hook)." warn "Apply the temporary mitigation or upgrade to a non-vulnerable Samba version." elif $WINS_ENABLED && ! $WINS_HOOK_SET; then good "Temporary mitigation IS applied at configuration level (WINS enabled but wins hook is empty)." warn "Upgrade to a non-vulnerable Samba version as soon as possible." elif ! $WINS_ENABLED && $WINS_HOOK_SET; then good "Temporary mitigation IS applied at configuration level (WINS disabled on the DC; wins hook value is not used)." warn "Upgrade to a non-vulnerable Samba version as soon as possible." else good "Temporary mitigation IS applied at configuration level (WINS disabled and wins hook empty)." warn "Upgrade to a non-vulnerable Samba version as soon as possible." fi return 0 2>/dev/null || true

PoC video

Description