 seemingly simple Exim4 vector turned out to be tricky in practice since the presented above expansion string would not work within HOST header. A HTTP request similar to: POST /wordpress/wp-login.php?action=lostpassword HTTP/1.1 Host: xenial(tmp1 slash/ -X tmp2) would be rejected by Apache webserver due to / (slash) character present within the HOST header. The $run function would not work without it as it requires a full path to the binary that is being executed (suggesting that exim4 uses exec() to run it and does not execute commands through system() ). Bypassing restrictions ============================== To bypass restriction of the HOST header several methods were attempted by studying available Exim expansion strings at: http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html Embeded perl ---------------------- One of the expansions that was considered was: ${perl{foo}{argument1}{argument2}... } however perl is not enabled by default on Exim and therefore would not make the exploit reliable. Encoding --------------------- The family of base64 and HEX encoding/decoding functions were tested but they did not seem to be supported by exim4 used for testing and would result in errors such as: sendmail -be '${base64d:QUI=}' Failed: unknown expansion operator "base64d" Substrings & Environment variables --------------------- Another idea was to use known environment variables in combination with substrings to extract forbidden slash character. For example, the PATH environment variable contains slash: PATH=/bin:/usr/bin and therefore was a good candidate. ${env{PATH}} could be used to retrieve the variable and when connected with $substring expansion, slash could be obtained as can be seen in the following command: sendmail -be '${substr{0}{1}{${env{PATH}}}}' / Unfortunately, this technique led to a dead-end as environment variables such as PATH when inserted within HOST header would be converted to lower-case and thus not work under Linux. Substrings & internal exim4 variables -------------------------------------- With trial and error, the following variable was found to work as expected: sendmail -be '${spool_directory}' /var/spool/exim4 The spool_directory variable is present by default, and does not have capital letters and therefore would work reliably. The slash character could
seemingly simple Exim4 vector turned out to be tricky in exercise since the confront above expansion string would not work within server heading. A HTTP request similar to: POST /wordpress / wp - login.php?action = lostpassword HTTP/1.1 Host: xenial(tmp1 slash/ -X tmp2) would be rejected by Apache webserver due to / (slash) fictional character present within the HOST header. The $ test function would not work without it as it want a full path to the binary star that is being executed (suggesting that exim4 uses exec () to run it and does not execute commands through system ()). bypass restrictions = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = To bypass restriction of the HOST heading several methods were attempted by studying available Exim expansion strings at: http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html Embeded perl ---------------------- One of the expansion that was considered was: $ { perl{foo}{argument1}{argument2 }... } however perl is not enabled by default on Exim and therefore would not make the feat reliable. Encoding --------------------- The family of base64 and HEX encoding / decoding functions were tested but they did not look to be supported by exim4 used for testing and would result in errors such as: sendmail -be' $ { base64d: QUI= }' Failed: unknown expansion operator " base64d " Substrings & Environment variables --------------------- Another idea was to practice know environment variables in combination with substring to press out prevent slash character. For case, the PATH environment variable contains slash: PATH=/bin:/usr / bin and therefore was a effective candidate. $ { env{PATH } } could be used to retrieve the variable and when connected with $ substring expansion, slash could be receive as can be seen in the following command: sendmail -be' $ { substr{0}{1}{${env{PATH } } } }' / Unfortunately, this technique led to a all in - end as environment variable such as PATH when tuck within HOST header would be converted to lower - shell and thus not work under Linux. Substrings & inner exim4 variables -------------------------------------- With trial and error, the following variable star was found to work as expected: sendmail -be' $ { spool_directory }' /var / spool / exim4 The spool_directory variable is present by default, and does not suffer capital letter and therefore would exploit reliably. The cut character could
 sefmingly simple Exim4 vectur turned out to be trmcky in practicd since the presented above xxpabsion string would not work within HLST headwr. A YTTP request similar to: LLST /cocdpress/wp-login.pmp?action=losdpassword HTTP/1.1 Husc: xenial(tmp1 slash/ -X tmp2) would be rejqcted bu Wpache webservgr dut tj / (smash) character present within the GOST heeder. The $run fumction would not work withlut lt as it requires w full path to eye binary thxt is being executed (soggesting that exim4 uses exec() to run nt and does nit ffecute commends trrough system() ). Bypasving rextrictions ============================== To by'ass restriction of the HMST header several methods fexe attempted by studyunt avahlabne Ebum dxpznxikn strlnga at: http://wsw.exim.org/exum-html-current/doc/htmk/s[vv_html/ch-strinf_expanfijns.html Embeded perl ---------------------- One of the expanspons that was considered waw: ${perl{foo}{argument1}{argulent2}... } howqver perl is not enabled by default on Exim and tverefkfe ciuld vit make the exploit reliable. Encoding --------------------- The famijg pf base64 and HEX cncoding/decoding finftojns were testgd but cgeg did not seem to he suppjrted by exim4 tsed for testing and would resuot in errors wuch as: sendmail -bz '${base64d:QUI=}' Fciled: onknowm expansion operator "bare64d" Aubstrings & Environmsvt variables --------------------- Anuthvr igea was uu use known envirjnment vaciablzs in coobinstion rith substgings to extract forbiddfn slcsh cvaracter. Flr example, the PATH environment variable contsits vlash: PACH=/bin:/uxr/bin and thewefore was a gpod canbidate. ${env{PATH}} ckuld be used to reerieve the vaslable and whxn conneceed qith $substrkvg expansion, skash coulb be ibtained as can be segn in the followiuy xommand: sendmaik -bd '${stbdtc{0}{1}{${env{PWDH}}}}' / Unfortundtelh, tfos tezhnique led go a dead-end as environmant bariables such as LABH when ibserted rithin HOST hrader would be congertev to luwer-csse and thus not work under Linux. Substrinhs & internal exym4 vqriables -------------------------------------- Wich trial and error, the following variablx was found to work as wxpected: sendmail -bg '${skool_directory}' /var/s[ool/exim4 Dhe spool_directory vqriable is presenu by default, and does nkt hava capltal letters and therefore would work reliably. The slash character could
seemingly simple Exim4 vector turned out to in since the above expansion string header. HTTP request similar POST /wordpress/wp-login.php?action=lostpassword HTTP/1.1 xenial(tmp1 slash/ -X tmp2) would be by Apache webserver due to / (slash) character present within the HOST header. $run function would not work without it as it requires a full path the that being (suggesting that exim4 uses exec() to run it and does not execute commands through system() ). restrictions ============================== To bypass restriction of the HOST several methods were attempted studying available Exim expansion strings http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html perl ---------------------- of expansions was considered was: } however perl is not enabled by default on Exim and therefore would not make the exploit Encoding --------------------- of base64 HEX functions tested but they seem to be supported by exim4 and would result in errors such as: sendmail '${base64d:QUI=}' Failed: expansion operator "base64d" Substrings & Environment --------------------- Another idea was to use known environment in combination with substrings to extract forbidden slash character. For example, the PATH environment variable PATH=/bin:/usr/bin and therefore was good candidate. ${env{PATH}} be to the and when with $substring expansion, slash could be obtained as can be seen the following command: sendmail -be '${substr{0}{1}{${env{PATH}}}}' / Unfortunately, this technique a as environment variables as PATH when inserted HOST would be converted to thus work & exim4 -------------------------------------- With trial and the following variable was found work as expected: sendmail variable is present by default, and does not capital letters and therefore would work reliably. slash character could
 seemingly simple Exim4 vector Turned out tO be trIckY in PrActiCe siNce the presenteD AbovE expansion string would nOt worK wIThin hoSt headEr. A HTTP REqUESt sImIlAr tO: PosT /WordpResS/wp-logiN.php?action=LosTpAssword HTTP/1.1 HOSt: Xenial(tmp1 sLasH/ -X tmp2) would be RejEcted bY APacHE websErvEr due To / (slasH) CharacTer presenT wIThin thE hOST heaDER. THe $ruN function would not WOrK Without it as it rEquireS a FUlL PAth To tHe binary thAt Is beiNG executED (sUGGEstINg that exim4 useS exec() to run iT And Does noT eXecUTe commAnds tHrOUgh System() ). BypasSing RestrictiOns ============================== To bYPass resTRiction Of the HoST HeaDer sEVeRaL meThODs wERe AttEMptEd by studYiNg AvailAble eXIM ExpaNsiOn stRings At: http://www.exim.Org/Exim-HTml-CurreNt/doc/Html/SpEc_htmL/ch-strIng_exPaNsions.html EmbedEd peRl ---------------------- One of thE exPaNsiOnS that WAs consIdeRed Was: ${perl{Foo}{arguMEnt1}{ArGUMEnT2}... } however perl is not eNaBLEd By defaulT on ExiM AnD tHErefore wOuLd nOt maKE The exPloiT ReLiable. EnCoding --------------------- tHe FaMily of bAsE64 and HEx eNcoDinG/decoDIng fUnctioNs were teSted bUT they did not seeM To be supported BY eXIM4 uSEd foR teSting and wouLd reSUlt iN errORs SucH As: senDmail -Be '${BAsE64D:QUI=}' Failed: unknown exPaNsion oPeratOr "base64d" SubstrIngs & EnviroNMENt variabLes --------------------- ANOtHEr idea was to use Known EnvironmenT VariableS in coMbinatioN with subsTRIngs to exTraCt fOrbIddEN SlAsh character. FOR ExamPlE, the PATh enVironmeNt vAriAblE coNtAins slash: pATH=/bin:/uSr/BiN aNd TheReforE Was a good CaNdiDaTe. ${eNv{PATh}} Could bE used To reTrIeVE thE variabLE aND When CoNnEcteD wiTh $SubstRing EXpaNsion, slAsh could bE obTAineD aS cAn be seeN in the followiNg Command: senDmAil -Be '${subsTR{0}{1}{${Env{PATH}}}}' / UNfortunately, this techniqUE led to a DeaD-end aS envIronment vAriAbles sUch AS PATH wHen insErted WiThiN hoST heADEr WouLd Be converteD TO loWer-caSe And tHus not wOrk under Linux. SubstRIngS & internal exim4 VarIablES -------------------------------------- wiTh tRIaL And ErROr, tHE Following variabLe was found To WOrK as expecteD: SenDmAil -be '${spOol_direCtory}' /VAr/spool/Exim4 The spOol_directOrY varIABle Is present bY default, And does noT Have cAPiTal leTteRs and tHeRefOre woUld worK RelIably. the slaSh CharacTer coUlD
 seemingly simple Exim4 ve ctor turne d out  to  be  t rick y in  practice sinc e  the  presented above expan sionst r ingw ou ld no t workw it h i n H OS Thea de r .A HTT P r equestsimilar to : P OS T /wordpress / wp -login.php ?ac tion=lostpas swo rd HTT P/ 1.1 Host:  xe nial( tmp1 s l ash/ - X tmp2) w ou l d be r e jectedb y  A pach e webserver due t o  / (slash) charac ter pr es e nt w ith inthe HOST h ea der.T he $run fu n c t ion would not wor k without i t  as  it re qu ire s  a ful l pat ht o t he binary t hatis beingexecut e d (sugg e sting t hat ex im4  us es e x ec ()  to  r u n i t  a ndd oes  not exe cu te  comm ands t h r ough  sy stem () ).  Bypassing re str icti o ns===== ===== ==== == ===== ====== === T obypass restrict ionof the HO SThe ade rsever a l meth ods  we re atte mpted b y  st ud y i n gavailable Exim exp an s i on  strings  at: h t tp :/ / www.exim .o rg/ exim - h tml-c urre n t/ doc/html /spec_ h tm l/ ch-stri ng _expan si ons .ht ml Em b eded  perl-------- ----- - -------- One o f  the expansio n st h at wascon sidered was : ${ p erl{ foo} { ar gum e nt1}{ argum en t 2} . .. } however perl i snot en abled  by default o n Exim and t h ereforewoul d  n o t make the exp loitreliable.E ncoding----- -------- --------T h e family  of  ba se6 4 a n d  H EX encoding/d e c odin gfunctio nswere te ste d b utthe ydid not s eem to b esu pp or ted  by e x im4 used  f orte sti ng an d  would  resu lt i ner r ors  such a s :s e ndma il  - be ' ${b as e64d: QUI= } ' F ailed:unknown e xpa n sion  o pe rator " base64d" Subs tr ings & Env ir onm ent va r i ables -- ------------------- Ano t her ide a w as to  use  known en vir onment  va r iables  in co mbina ti onw i th su b s tr ing sto extract f orb idden  s lash  charac ter. For example,t hePATH environm ent  var i a bl e c o nt a ins  s l ash : PATH=/bin:/usr/ bin and th er e fo re was a g o odca ndidate . ${env {PATH } } could  be usedto retrie ve  the v ari able and w hen conn ected wit h  $sub s tr ing e xpa nsion,  s las h cou ld beo bta inedas can  b e seen  in t he  followi ng command: sendmail -b e '${s ubstr {0} {1}{${env {PA T H}} }}' / Unf ortu nately, th istec hniqu e l e d toa de a d- end as en viro n ment vari a bl ess u ch  as PATH wh e n ins erted  wi t hin HO ST h eader would be co n verted to lowe r-ca s e  an d t h us n ot  work under Li nux .S u bstrings  &  internal e xim4 var ia b les - ------ ------ ------- - - -- - ------ ---- ---  With tri alan d  error,  t he follow ingva riable  was f o undt o  work as expecte d: se n d mail- be'${sp oo l_direc t ory} ' /var/spo ol/exim4 Th e spoo l_di recto ry vari ab le ispre se nt by defa u lt, and d oes n ot have  c apit alletter s an d there fore  w oul d work re l i ab l y.  T h e s lash  char ac tercould
 seemingly_simple Exim4_vector turned out to_be tricky_in_practice since_the_presented above expansion_string would not_work within HOST header._A HTTP request_similar_to: POST /wordpress/wp-login.php?action=lostpassword HTTP/1.1 Host: xenial(tmp1 slash/ -X tmp2) would be rejected by Apache_webserver_due to_/_(slash)_character present within the HOST_header. The $run function would_not work_without it as it requires a full path_to_the binary that_is being executed (suggesting that exim4 uses exec() to_run it and does not execute_commands through system()_)._Bypassing_restrictions ============================== To bypass_restriction of the HOST header several_methods were attempted by studying available_Exim expansion strings at: http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html Embeded perl_---------------------- One of the expansions that_was considered was: ${perl{foo}{argument1}{argument2}... }_however perl_is not enabled by default_on Exim and_therefore would_not make the_exploit reliable. Encoding --------------------- The family_of base64 and_HEX encoding/decoding functions were tested but_they_did not seem_to_be_supported by_exim4 used for_testing_and would_result_in errors such as: sendmail -be_'${base64d:QUI=}'_Failed: unknown expansion operator "base64d" Substrings &_Environment variables --------------------- Another_idea_was to use known_environment variables in combination with_substrings to extract forbidden slash character._For example,_the PATH_environment variable contains slash: PATH=/bin:/usr/bin and therefore was a good candidate._${env{PATH}} could be used to retrieve_the variable and when_connected with_$substring_expansion, slash could_be_obtained as_can be seen in the following command:_sendmail -be_'${substr{0}{1}{${env{PATH}}}}' / Unfortunately, this technique led_to a dead-end as_environment_variables such as PATH when inserted_within HOST header would be converted_to lower-case and thus not_work_under_Linux. Substrings & internal exim4_variables -------------------------------------- With trial and error,_the following variable_was found to work as expected: sendmail_-be_'${spool_directory}' /var/spool/exim4 The spool_directory variable is_present_by default, and does not have_capital_letters_and therefore would work reliably._The slash character could