Exim AUTH Out-of-Bounds Write Remote Code Execution

Small standalone C++ proof-of-concept exploit for CVE-2023-42115 targeting Exim over SMTP. The repository contains one code file (main.cpp) and a README with build and usage instructions. The program implements a minimal TCP client using POSIX sockets, connects to a user-supplied SMTP server, reads the banner, verifies that it contains 'Exim', sends 'EHLO anon', and then sends a crafted MAIL FROM command containing a shell payload. The payload invokes 'sh -i' and redirects the shell over /dev/udp to an attacker-specified IP and UDP port, effectively attempting unauthenticated remote code execution with a reverse shell. No advanced exploitation framework, target discovery, or payload customization beyond callback host/port is present.

This repository provides a practical exploit for CVE-2023-42115, targeting Exim SMTP servers. It contains two main Python scripts: 'exploit.py' and 'generate_payload.py'. 'exploit.py' is the primary exploit script. It allows the user to scan a target for vulnerability or exploit it by sending a crafted SMTP command (MAIL FROM) containing a payload. The script connects to the target's SMTP service (default port 25) and checks for an Exim banner to determine vulnerability. In exploit mode, it reads a user-supplied payload file and injects it into the SMTP conversation, aiming to trigger the vulnerability and execute the payload on the target. 'generate_payload.py' is a helper script that interactively generates reverse shell payloads for Linux (bash+nc) or Windows (PowerShell). The user specifies the local IP and port for the reverse connection, and the script outputs a payload file suitable for use with 'exploit.py'. The repository also includes a README.md with detailed usage instructions and a requirements.txt listing Python dependencies. The exploit is operational, providing a working reverse shell payload and clear instructions for both payload generation and exploitation. The attack vector is network-based, requiring access to the target's SMTP service. The main fingerprintable endpoints are the target's IP and port, and the temporary file '/tmp/f' used in the Linux payload. The exploit is not part of a framework and is intended for direct use by penetration testers or researchers.