Description
This exploit takes advantage of a stack based overflow. Once the stack corruption has occurred it is possible to overwrite a pointer which is later used for a memcpy. This gives us a write anything anywhere condition similar to a format string vulnerability.
NOTE: The popsubfolders option is a non-default setting.
I chose to overwrite the GOT with my shellcode and return to it. This defeats the VA random patch and possibly other stack protection features.
Tested on gentoo-sources Linux 2.6.16. Although Fedora CORE 5 ships with a version containing the vulnerable code, it is not exploitable due to the use of the FORTIFY_SOURCE compiler enhancement.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/pop3/cyrus/pop3d_popsubfoldersmsf undefined(pop3d_popsubfolders) > show actions ...actions...msf undefined(pop3d_popsubfolders) > set ACTION < action-name >msf undefined(pop3d_popsubfolders) > show options ...show and set options...msf undefined(pop3d_popsubfolders) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub