In January the researchers at Qualys reported a serious vulnerability in Linux systems worldwide dubbed as GHOST Vulnerability. Again the researchers at Qualys have presented an Exploit available for Successful exploitation of GHOST Vulnerability. Researchers released a standalone Metasploit module exploiting the GHOST Vulnerability remotely.

According to the researchers, the module provided for the demonstration purpose, enables Metasploit to get the terminal access, i.e. remote code execution, against an Exim mail server. If this module's "check" or "exploit" method determines that a remote system is vulnerable, it is also exploitable.

Requirements for the Exploit to work

Server-Side Requirements

• server must be installed with a vulnerable version of the GNU C Library i.e. between version glibc-2.6 to glibc-2.7
• remote system must be running with a Exim mail server installed with a vulnerable version exim-4.77
• The remote Exim mail server must be configured to perform extra security checks against its SMTP clients

Client-Side Requirements

• the host's SENDER_HOST_ADDRESS option should be set to the IPv4 address of the SMTP Client (Metasploit), also this IPv4 must have both forward and reverse DNS lookup entries matching each other
• The remote Exim server might be exploitable even if the Metasploit client has no FCrDNS, but this module depends on Exim's sender_host_name variable to be set in order to reliably control the state of the remote heap.

Exploit Download

The download link of the Exploit as given by the Qualys can be obtained here.

https://www.qualys.com/research/security-advisories/exim_ghost_bof.rb?_ga=1.126929229.1925984702.1422456661

About GHOST Vulnerability

The Vulnerability occurred due to a weakness in glibc Library that allows remote attackers to take control of a targeted system without having any of the system credentials, i.e. without any username or password even. The firm wrote in the blog post that they discovered this bug when they were internally auditing some code. They said this Vulnerability is caused by a buffer buffer overflow in the __nss_hostname_digits_dots() function of the GNU C Library i.e. glibc. The bug can be leveraged/exploited both remotely and locally via the gethostbyname*() functions, hence bubbed as "GHOST". According to the report, the first vulnerable version of GNU C Library is glibc-2.2, released on November 10, 2000.