Samba Print Command Injection Remote Code Execution Exploit

This module exploits CVE-2026-4480, an unauthenticated remote command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled print-job description to the configured "print command" through the %J substitution without escaping shell metacharacters, allowing commands to be executed remotely. The vulnerable application is a Samba print server. Affected versions are Samba 4.22.9 and earlier, 4.23.0 through 4.23.7, and 4.24.0 through 4.24.2. Exploitation requires an accessible printer share whose "print command" contains %J. This module performs the following steps: Connects to the target SMB service and binds to the spoolss named pipe using MS-RPRN. Enumerates advertised printer shares and automatically selects the first print queue, or uses the printer name supplied in Manual mode. Generates the commands required to transfer and launch a Linux x86-64 Core Impact agent. Encodes each command in Base64 and places the decoding pipeline in the client-controlled print-job description that Samba expands as %J. Submits a non-empty RAW print job and completes it to trigger the vulnerable server-side "print command". Executes the generated commands in the Samba print-processing security context and deploys the Core Impact agent.