CVE-2020-7247 PoC — Openbsd Opensmtpd代码问题漏洞

Source

https://github.com/QTranspose/CVE-2020-7247-exploit

Associated Vulnerability

Title: Openbsd Opensmtpd代码问题漏洞 (CVE-2020-7247)
Description:smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Description

OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit

Readme

## CVE-2020-7247-exploit
OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit<br>
Reference: <https://www.openwall.com/lists/oss-security/2020/01/28/3>

## Usage
```
python3 exploit.py <target_host> <target_port> <reverse_host> <reverse_port> <recipient_email>
```
![example](img/example.svg)

## Dependencies
```
pip3 install --user pwntools
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →