Sendmail + ClamAV-Milter Exploit (CVE-2007-4560)

Python RCE exploit for Sendmail with ClamAV-Milter <0.91.2 (CVE-2007-4560). Remote root command injection via SMTP RCPT TO headers.

About

Python port of the classic Sendmail/ClamAV-Milter remote root exploit originally written in Perl by Eliteboy.

Original exploit: exploit-db.com/exploits/4761

Vulnerability

The exploit leverages improper input sanitization in clamav-milter <0.91.2, allowing command injection through specially crafted SMTP RCPT TO headers. Commands execute with root privileges, enabling:

1. Modification of /etc/inetd.conf to add a bind shell
2. Restart of the inetd service to activate the backdoor

Why Python?

The original Perl exploit works, but this Python port offers significant improvements for modern pentesting workflows:

This Python Port:

• Zero dependencies - Python3 standard library only, no CPAN modules