# SMB User Authentication Bypass and Persistence

ownCloud's SMB external auth used `smbclient -L` which succeeds for any user under Samba's default 'map to guest = bad user', letting attackers log in as any user including admin.

- Payout: hidden
- Severity: critical
- Program: ownCloud
- Found by: rhinosecuritylabs
- Disclosed: 2016-11-26
- CVE: CVE-2016-9463
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/148151
- Library page: https://bugbountylibrary.com/r/h1%3A148151
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical tech:php technique:default-creds technique:source-review vuln:auth-bypass

**Target:** ownCloud external user authentication app (OC_User_SMB)
**Root cause:** The SMB backend validates credentials with `smbclient -L //host/dummy -Uuser%pass`, which only lists shares; Samba's default 'map to guest = bad user' makes this succeed for nonexistent users, so authentication is never actually verified.
**Steps:**
1. Set up a Samba SMB server with default config (map to guest = bad user).
2. Enable the external user authentication app in ownCloud.
3. Add `'user_backends' => array(0 => array('class' => 'OC_User_SMB','arguments' => array(0 => 'SMBHOST')))` to config.
4. Log in with any existing username and any password (e.g. admin) — succeeds; nonexistent users are auto-created.
**How found:** Code review of smb.php lines 46-47 noticed the `-L` (list shares) flag rather than an actual session/auth check, then tested against a default Samba server and observed success with invalid credentials.
**Exploitation:** Attacker supplies any username (including administrator) with an arbitrary password; the `smbclient -L` call returns success due to guest mapping, so ownCloud logs them in as that user or creates a new account.
**Escalation:** Logging in as the administrator account yields full administrative control of the ownCloud instance.
**Insight:** When an auth backend shells out to a client tool, verify the command actually performs authentication (a session/connect) rather than a listing operation; Samba's default 'map to guest = bad user' makes share listing succeed for any credentials.