./tut/exp/slmail/contact :: First Contact
« prev :: next »
Installing SLMail
With our lab environment set up, it’s time to install the vulnerable software on the Victim VM, then establish First Contact with the vulnerability.
In this tutorial, we’re targeting SLMail
, which can be downloaded from the Exploit Database. Simply click the download box next to the words “Vulnerable App”:

Be sure to save the file in the folder you shared between your VMs, and name it something memorable, such as Vulnerable-SLMail.exe
. Once downloaded, it should appear in the share drive on the Victim VM. Let’s go ahead and boot the VM up and take a look:

Good. Now I double-click the Vulnerable-SLMail.exe
application to install SLMail
to the system. I click “Next” on every prompt, accepting all default values and dismissing any warnings I see. At the end, the computer reboots, and when it starts back up again, I discover SLMail
in the Start menu:

Excellent! We’re almost ready to begin developing our Buffer Overflow exploit! But there’s one last bit of information we’ll need: The Victim VM’s IP address. I start cmd.exe
and use the ipconfig
command to determine the Victim’s IP:

The Victim’s IP is 10.10.10.101
. With that, we’re ready to get to work!
Are You Being Served?
The next step is to connect to SLMail
and see how it operates normally. According to the CVE, one of the vulnerable vectors involves sending a long password to the server. After doing a little research on how the POP3
protocol works, I spin up the Kali VM. I want to communicate with the SLMail
server, so I ensure that the host-only network on eth1
is active:

Next, I check my IP address to ensure I’m on the same subnet:

Nice. The Attacker VM has IP 10.10.10.100
.
Returning to the Victim VM, I click Start > All Programs > SL Products > SLMail > SLMail Configuration to bring up the SLMail Configuration
utility. I click the Control
tab and ensure that the system is running:

Good. Next, I run Immunity Debugger
, then click File > Attach (or hit Ctrl+F1
) to bring up the attachment window. I type slmail
and attach to the process:

After a moment, Immunity successfully attaches to the process, though execution is paused:

To start the application, I click Debug > Run (or hit F9
). Now that the SLMail
server is running on our Victim VM, let’s connect and see how it works! On the Attacker VM, I open a command terminal and use nmap
to ensure that the SLMail
server is visible over the host-only network:
root@haxys:~# nmap -p 110 10.10.10.101
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-25 12:45 EDT
Nmap scan report for 10.10.10.101
Host is up (0.00038s latency).
PORT STATE SERVICE
110/tcp filtered pop3
MAC Address: 08:00:27:F2:C4:86 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.45 seconds
The service is filtered
, which means I probably forgot to turn off Windows Firewall. I return to the Victim VM, click Start > Control Panel, search for “Firewall”, click Windows Firewall, then click the Turn Windows Firewall on or off link on the left. I disable the firewall:

I click “OK”, then close the Settings menu. Returning to the Attacker VM, I run the portscan again:
root@haxys:~# nmap -p 110 -sV 10.10.10.101
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-25 12:51 EDT
Nmap scan report for 10.10.10.101
Host is up (0.00090s latency).
PORT STATE SERVICE VERSION
110/tcp open pop3 BVRP Software SLMAIL pop3d
MAC Address: 08:00:27:F2:C4:86 (Oracle VirtualBox virtual NIC)
Service Info: Host: IEWIN7
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds
Nice. I connect to the server with netcat
, and attempt to log in:
root@haxys:~# nc 10.10.10.101 110
+OK POP3 server IEWIN7 ready <00002.3426827@IEWIN7>
USER test
+OK test welcome here
PASS test
-ERR unable to lock mailbox
QUIT
+OK POP3 server IEWIN7 signing off.
Excellent! Using the username and password test
, I successfully failed to login.
Am I Getting Through?
Now I know how the service behaves, I can write a simple Python
script to connect to the service and communicate:
#!/usr/bin/env python3.7
"""SLMail BoF PoC: First Contact."""
import socket
# Target IP and Port.
TARGET_ADDR = "10.10.10.101"
TARGET_PORT = 110
# How many seconds should we wait for a reply before we raise an error?
SOCKET_TIMEOUT = 10
try:
print("[*] Connecting...")
SOCKET = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
SOCKET.settimeout(SOCKET_TIMEOUT)
SOCKET.connect((TARGET_ADDR, TARGET_PORT))
REPLY = SOCKET.recv(1024)
print(f"[>] Banner: {REPLY.decode().strip()}")
print("[<] Sending username...")
SOCKET.send(b"USER test\r\n")
REPLY = SOCKET.recv(1024)
print(f"[>] Response: {REPLY.decode().strip()}")
print("[<] Sending password...")
SOCKET.send(b"PASS test\r\n")
REPLY = SOCKET.recv(1024)
print(f"[>] Response: {REPLY.decode().strip()}")
SOCKET.send(b"QUIT\r\n")
print("[*] Disconnected.")
except (socket.timeout, ConnectionResetError):
print(f"[!] Connection timed out or reset. Did the server crash?")
except ConnectionRefusedError:
print("[!] Connection refused. Is the server running?")
finally:
SOCKET.close()
I save the script as slmail_bof_0.py
. Running the script, I get the following output:
root@haxys:~/ShareDrive/BoF-SLMail# chmod +x slmail_bof_0.py
root@haxys:~/ShareDrive/BoF-SLMail# ./slmail_bof_0.py
[*] Connecting...
[>] Banner: +OK POP3 server IEWIN7 ready <00003.4146662@IEWIN7>
[<] Sending username...
[>] Response: +OK test welcome here
[<] Sending password...
[>] Response: -ERR unable to lock mailbox
[*] Disconnected.
Great! As you can see, the script performed the same tasks I did when I connected using netcat
. Namely, it receives the banner, sends the username, receives a reply, sends the password, receives another reply, and finally sends the QUIT
command to disconnect.
We’ll use this script as the foundation for the proof-of-concept (PoC) code we develop throughout the rest of the tutorial.
« prev :: next »
Read other posts
« prev :: next »
Installing SLMail
With our lab environment set up, it’s time to install the vulnerable software on the Victim VM, then establish First Contact with the vulnerability.
In this tutorial, we’re targeting SLMail
, which can be downloaded from the Exploit Database. Simply click the download box next to the words “Vulnerable App”:
Be sure to save the file in the folder you shared between your VMs, and name it something memorable, such as Vulnerable-SLMail.exe
. Once downloaded, it should appear in the share drive on the Victim VM. Let’s go ahead and boot the VM up and take a look:
Good. Now I double-click the Vulnerable-SLMail.exe
application to install SLMail
to the system. I click “Next” on every prompt, accepting all default values and dismissing any warnings I see. At the end, the computer reboots, and when it starts back up again, I discover SLMail
in the Start menu:
Excellent! We’re almost ready to begin developing our Buffer Overflow exploit! But there’s one last bit of information we’ll need: The Victim VM’s IP address. I start cmd.exe
and use the ipconfig
command to determine the Victim’s IP:
The Victim’s IP is 10.10.10.101
. With that, we’re ready to get to work!
Are You Being Served?
The next step is to connect to SLMail
and see how it operates normally. According to the CVE, one of the vulnerable vectors involves sending a long password to the server. After doing a little research on how the POP3
protocol works, I spin up the Kali VM. I want to communicate with the SLMail
server, so I ensure that the host-only network on eth1
is active:
Next, I check my IP address to ensure I’m on the same subnet:
Nice. The Attacker VM has IP 10.10.10.100
.
Returning to the Victim VM, I click Start > All Programs > SL Products > SLMail > SLMail Configuration to bring up the SLMail Configuration
utility. I click the Control
tab and ensure that the system is running:
Good. Next, I run Immunity Debugger
, then click File > Attach (or hit Ctrl+F1
) to bring up the attachment window. I type slmail
and attach to the process:
After a moment, Immunity successfully attaches to the process, though execution is paused:
To start the application, I click Debug > Run (or hit F9
). Now that the SLMail
server is running on our Victim VM, let’s connect and see how it works! On the Attacker VM, I open a command terminal and use nmap
to ensure that the SLMail
server is visible over the host-only network:
root@haxys:~# nmap -p 110 10.10.10.101
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-25 12:45 EDT
Nmap scan report for 10.10.10.101
Host is up (0.00038s latency).
PORT STATE SERVICE
110/tcp filtered pop3
MAC Address: 08:00:27:F2:C4:86 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.45 seconds
The service is filtered
, which means I probably forgot to turn off Windows Firewall. I return to the Victim VM, click Start > Control Panel, search for “Firewall”, click Windows Firewall, then click the Turn Windows Firewall on or off link on the left. I disable the firewall:
I click “OK”, then close the Settings menu. Returning to the Attacker VM, I run the portscan again:
root@haxys:~# nmap -p 110 -sV 10.10.10.101
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-25 12:51 EDT
Nmap scan report for 10.10.10.101
Host is up (0.00090s latency).
PORT STATE SERVICE VERSION
110/tcp open pop3 BVRP Software SLMAIL pop3d
MAC Address: 08:00:27:F2:C4:86 (Oracle VirtualBox virtual NIC)
Service Info: Host: IEWIN7
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds
Nice. I connect to the server with netcat
, and attempt to log in:
root@haxys:~# nc 10.10.10.101 110
+OK POP3 server IEWIN7 ready <00002.3426827@IEWIN7>
USER test
+OK test welcome here
PASS test
-ERR unable to lock mailbox
QUIT
+OK POP3 server IEWIN7 signing off.
Excellent! Using the username and password test
, I successfully failed to login.
Am I Getting Through?
Now I know how the service behaves, I can write a simple Python
script to connect to the service and communicate:
#!/usr/bin/env python3.7
"""SLMail BoF PoC: First Contact."""
import socket
# Target IP and Port.
TARGET_ADDR = "10.10.10.101"
TARGET_PORT = 110
# How many seconds should we wait for a reply before we raise an error?
SOCKET_TIMEOUT = 10
try:
print("[*] Connecting...")
SOCKET = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
SOCKET.settimeout(SOCKET_TIMEOUT)
SOCKET.connect((TARGET_ADDR, TARGET_PORT))
REPLY = SOCKET.recv(1024)
print(f"[>] Banner: {REPLY.decode().strip()}")
print("[<] Sending username...")
SOCKET.send(b"USER test\r\n")
REPLY = SOCKET.recv(1024)
print(f"[>] Response: {REPLY.decode().strip()}")
print("[<] Sending password...")
SOCKET.send(b"PASS test\r\n")
REPLY = SOCKET.recv(1024)
print(f"[>] Response: {REPLY.decode().strip()}")
SOCKET.send(b"QUIT\r\n")
print("[*] Disconnected.")
except (socket.timeout, ConnectionResetError):
print(f"[!] Connection timed out or reset. Did the server crash?")
except ConnectionRefusedError:
print("[!] Connection refused. Is the server running?")
finally:
SOCKET.close()
I save the script as slmail_bof_0.py
. Running the script, I get the following output:
root@haxys:~/ShareDrive/BoF-SLMail# chmod +x slmail_bof_0.py
root@haxys:~/ShareDrive/BoF-SLMail# ./slmail_bof_0.py
[*] Connecting...
[>] Banner: +OK POP3 server IEWIN7 ready <00003.4146662@IEWIN7>
[<] Sending username...
[>] Response: +OK test welcome here
[<] Sending password...
[>] Response: -ERR unable to lock mailbox
[*] Disconnected.
Great! As you can see, the script performed the same tasks I did when I connected using netcat
. Namely, it receives the banner, sends the username, receives a reply, sends the password, receives another reply, and finally sends the QUIT
command to disconnect.
We’ll use this script as the foundation for the proof-of-concept (PoC) code we develop throughout the rest of the tutorial.