cowbe0x004 / eximrce-cve-2019-10149

simple python socket connection to test if exim is vulnerable to CVE-2019-10149. The payload simply touch a file in /tmp/eximrce.

eximrce

Simple python socket connection to test if exim is vulnerable to CVE-2019-10149. The payload simply touch a file in /root/lweximtest. Output will be slow depending on server's reply and not knowing how to properly use python's socket module. Would love a lesson on how to speed it up. Only tested on cPanel boxes.

Run locally on suspected server. This checks for indication of compromise.

curl -s https://raw.githubusercontent.com/cowbe0x004/eximrce-CVE-2019-10149/master/eximioc.sh |bash

Run remotely. Testing for remote code execution.

git clone https://github.com/cowbe0x004/eximrce-CVE-2019-10149
cd eximrce-CVE-2019-10149
python eximrce.py <HOST> <PORT>

If /root/lweximtest exists on the server, remote code execution is possible.

If you are not able to update exim, at least put this ACL in exim.conf so ${run{ can't be run.

## change
	acl_smtp_rcpt = acl_smtp_rcpt
## to
	acl_smtp_rcpt = acl_check_rcpt

## after "begin acl"
acl_check_rcpt:
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|] : ^.*\N\${run{\N.*}}

deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./ : ^.*\N\${run{\N.*}}

accept

eximrce-cve-2019-10149's Issues

:)

by multi threads mass script ... but i've scanned like 100k ips and i got no success .. anyway, you have a jabber id or something where we can talk ?

the exploit not working

[root@ovh ~]# telnet 127.0.0.1 25Trying 127.0.0.1...Connected to 127.0.0.1.Escape character is '^]'.http://220-127.0.0.1 ESMTP Exim 4.92 #2 Wed, 12 Jun 2019 19:20:22 +0300220-We do not authorize the use of this system to transport unsolicited,220 and/or bulk e-mail.quit221 http://127.0.0.1 closing connectionConnection closed by foreign host.[root@ovh ~]# python http://eximrce.py 127.0.0.1 25Connecting to: 127.0.0.1Cannot connect to 127.0.0.1

still..

@cowbe0x004 can you tell me why the rce it doesn't work on mass mode ? cuz i've put exim 4.89 version on 2 servers.. and they're ok.. for more ips.. nothing.. what i'm doing wrong ?