deathshotxd/cve-2025-52691-apt-poc
An enhanced proof-of-concept exploit for CVE-2025-52691 (SmarterMail Arbitrary File Upload RCE) with APT-level features like stealth obfuscation, persistence, exfiltration, and interactive mode. For educational and authorized testing only. Credits to the original PoC by yt2w/CVE-2025-52691.
This is an enhanced proof-of-concept (PoC) exploit for CVE-2025-52691, a critical vulnerability in SmarterTools SmarterMail email server software allowing unauthenticated arbitrary file uploads, potentially leading to remote code execution (RCE). This version incorporates APT-level techniques for improved stealth, persistence, and operational capabilities, making it suitable for advanced penetration testing and red teaming scenarios.
WARNING: This tool is for educational and authorized testing purposes only. Unauthorized use against systems without explicit permission is illegal and unethical. The author assumes no liability for misuse.
requests, uuid, base64, random, time, logging, re
pip install requestsNo additional dependencies are needed beyond standard libraries.
Clone the repository and run the script with Python.
python exploit.py <target_url> [options]
<target_url>: The base URL of the SmarterMail server (e.g., https://mail.example.com).--targets-file <file>: Path to a file containing a list of target URLs (one per line).-c, --command <cmd>: Command to execute after shell upload (e.g., whoami).-t, --timeout <seconds>: Request timeout (default: 30).--proxy <url>: Proxy URL (e.g., http://127.0.0.1:8080).--no-verify: Disable SSL certificate verification.--check-only: Only check if the target is alive and appears to be SmarterMail.--persistence: Establish persistence via a scheduled task.--exfil <remote:local>: Exfiltrate a file (e.g., C:\\path\\to\\file.txt:local_copy.txt).--interactive: Enter interactive command execution mode.--cleanup: Remove the uploaded shell after use.--log-level <level>: Set logging level (DEBUG, INFO, WARNING, ERROR; default: INFO).Basic Exploit:
python exploit.py https://mail.vulnerable.com
Execute a Command:
python exploit.py https://mail.vulnerable.com -c "systeminfo"
With Proxy and Persistence:
python exploit.py https://mail.vulnerable.com --proxy http://127.0.0.1:8080 --persistence
Interactive Mode with Cleanup:
python exploit.py https://mail.vulnerable.com --interactive --cleanup
Batch Exploit from File:
python exploit.py --targets-file targets.txt
Successful exploitation will display the shell path, access URL (with auth password), and any command outputs. Logs are printed to console; for file logging, modify the script's setup_logging as needed.
This enhanced version is based on the original PoC by yt2w. Significant modifications include APT-level features, obfuscation, and usability improvements. Thanks to the original author for the foundational work.
This tool demonstrates a vulnerability for educational purposes. Use it responsibly and only on systems you own or have explicit permission to test. Ensure compliance with all applicable laws and ethical guidelines. The developers disclaim any responsibility for misuse.
If you encounter issues or have suggestions, open an issue on GitHub.
MIT License. See LICENSE for details.