strikoder-premium/sendmail-clamav-exploit-cve-2007-4560Python RCE exploit for Sendmail with ClamAV-Milter <0.91.2 (CVE-2007-4560). Remote root command injection via SMTP RCPT TO headers.
Python RCE exploit for Sendmail with ClamAV-Milter <0.91.2 (CVE-2007-4560). Remote root command injection via SMTP RCPT TO headers.
Python port of the classic Sendmail/ClamAV-Milter remote root exploit originally written in Perl by Eliteboy.
Original exploit: exploit-db.com/exploits/4761
The exploit leverages improper input sanitization in clamav-milter <0.91.2, allowing command injection through specially crafted SMTP RCPT TO headers. Commands execute with root privileges, enabling:
/etc/inetd.conf to add a bind shellThe original Perl exploit works, but this Python port offers significant improvements for modern pentesting workflows:
This Python Port:
python sendmail_clamav_exploit.py <target_ip>
After successful exploitation:
nc <target_ip> 1001
bash -i