Exim 4.41 - 'dns_build_reverse' Local Read Emails

ExploitDBExploitDB exploitExploitEDB-1009

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Local exploit for Exim 4.41 that uses a buffer overflow in the dns_build_reverse function, triggered via the -bh command line option, to execute shellcode and gain shell access.

Backdoor review

No backdoor observed in reviewed code

The provided C source code is a straightforward local privilege escalation exploit for CVE-2005-0021 in Exim. It constructs a payload to trigger a buffer overflow in the `dns_build_reverse` function via the `-bh` command-line option, with the goal of executing shellcode that spawns `/bin/sh`. The code is clearly commented, uses well-known public shellcode, and contains no hidden or deceptive functionality beyond the stated exploit behavior. No backdoor, trojan, or suspicious behavior is observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareExim
Attack typesbuffer overflowlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code constructs a buffer overflow payload with shellcode and uses execve to launch the vulnerable Exim binary with the payload, which is the definition of an exploit.

exploits/linux/local/1009.c:19-56exploits/linux/local/1009.c:60-66

Requirements

  • Requires a local user account on the target server.exploits/linux/local/1009.c:6-7
  • Exim binary must be located at /usr/exim/bin/exim.exploits/linux/local/1009.c:61

Observed behavior

  • Constructs a 288-byte payload containing a malformed IPv6 address, NOP sled, and Aleph1 shellcode that executes /bin/sh.exploits/linux/local/1009.c:19-56
  • Executes Exim with the -bh option and the crafted payload as an argument.exploits/linux/local/1009.c:60-66
  • Prints a message indicating the exploit is being launched and expects a shell.exploits/linux/local/1009.c:65
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Buffer overflow via crafted IPv6-like string passed to Exim -bh optionThe exploit triggers CVE-2005-0021 to gain local code execution.exploits/linux/local/1009.c:22exploits/linux/local/1009.c:62-63
Shellcode
Aleph1's classic /bin/sh shellcode with NOP sledThe payload executes /bin/sh upon successful exploitation.exploits/linux/local/1009.c:46-49
Target Binary
/usr/exim/bin/eximThe exploit targets a specific Exim installation path.exploits/linux/local/1009.c:61
Review boundaries

What the analysis did not establish

  • The hardcoded return address (0xbffff2f4) is specific to a particular environment and may not work on all systems.
  • The exploit relies on the Exim binary being at a specific path (/usr/exim/bin/exim).
  • The shellcode is a standard execve /bin/sh payload and does not include any cleanup or privilege restoration.
  • Only the provided C source file was reviewed; the referenced external archive (exim-4.41.tar.gz) was not fetched or analyzed.
  • Binary files, if any, were not inspected per the evidence envelope policy.
  • The review does not assess whether the exploit is functional or safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1