CVE-2020-7247 PoC — Openbsd Opensmtpd代码问题漏洞

Source

https://github.com/r0lh/CVE-2020-7247

Associated Vulnerability

Title:Openbsd Opensmtpd代码问题漏洞 (CVE-2020-7247)
Description:smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Description

Proof Of Concept Exploit for CVE-2020-7247 (Remote Execution on OpenSMTPD < 6.6.2

Readme

# CVE-2020-7247

Proof Of Concept Exploit for CVE-2020-7247 (Remote Execution on OpenSMTPD < 6.6.2)

OpenSMTPD < 6.6.2 
https://www.cvedetails.com/cve/CVE-2020-7247

tested on: OpenBSD 6.6

credits to Marco Ivaldi <raptor@0xdeadbeef.info> for payload

Usage
(remote) $ go run CVE-2020-7247.go -u 192.168.0.2 -p 25 -d example.org

[change nc listener in source code if you are not using linux]

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!