CVE-2018-6789
CRITICAL KEV RANSOMWAREExim < 4.90.1 - Remote Code Execution via base64d Buffer Overflow
Title source: llmExploitation Summary
CVE-2018-6789 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 7 public exploits from researchers including hackk.gr, straight_blast, martinclauss.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Exim versions prior to 4.90, allowing remote code execution via crafted AUTH PLAIN commands. The PoC manipulates memory to achieve arbitrary code execution by overwriting specific bytes.
Description
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
Exploits (7)
This exploit targets a buffer overflow vulnerability in Exim versions prior to 4.90, allowing remote code execution via crafted AUTH PLAIN commands. The PoC manipulates memory to achieve arbitrary code execution by overwriting specific bytes.
This exploit targets CVE-2018-6789, a heap-based buffer overflow in Exim. It leverages memory corruption to overwrite critical structures and achieve remote code execution via a reverse shell.
This repository provides a comprehensive learning environment for CVE-2018-6789, an Exim RCE vulnerability, including debugging tools, exploit scripts, and a Docker-based setup for analysis.
This is a functional exploit for CVE-2018-6789, a heap-based buffer overflow in Exim. The PoC leverages an off-by-one vulnerability to achieve remote code execution by manipulating memory chunks and executing a shellcode payload via a reverse shell.
This repository contains a proof-of-concept exploit for CVE-2018-6789, a base64 decoding off-by-one vulnerability in Exim 4.89. The exploit leverages heap manipulation techniques to achieve remote code execution by corrupting heap metadata and overlapping chunks.
This is a Python3-based exploit for CVE-2018-6789, targeting Exim versions prior to 4.90.1. It leverages a heap-based buffer overflow to achieve remote code execution via a reverse shell.
This PoC exploits a heap-based buffer overflow in Exim (CVE-2018-6789) by sending maliciously crafted SMTP commands to trigger a collision in the heap allocator, potentially leading to remote code execution. The exploit uses the `pwntools` library to interact with the SMTP service and manipulate memory.
References (14)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H