SmarterMail Unauthenticated Arbitrary File Upload Exploit

This module exploits an unauthenticated arbitrary file upload in SmarterMail. The vulnerability consists of the arbitrary uploading of a non-binary file (asp, html, txt, etc.) to any location on the target machine without user authentication. However, the SmarterMail server listening on port 9998 (SYSTEM) simply uploads the file but cannot execute ASPX files. Furthermore, if the IIS server on port 80 is active, the file can be written to the root directory of that server and executed through it, with the permissions of the IIS user (a High Integrity Level user). The exploit first verifies that the target SmarterMail service is active and listening on its default administrative port, TCP/9998. It crafts a specially formed multipart/form-data POST request containing a malicious ASPX web shell. The request exploits an improper input validation vulnerability to perform directory path traversal (e.g., using sequences like ../../../). This bypasses the intended upload directory restrictions, allowing the file to be written to critical locations such as: 1)The SmarterMail web root (e.g., /interface/app/authentication/) 2)The root directory of the IIS web server hosting the application. After a successful upload, the script verifies the shell's deployment by sending an HTTP GET request to access the uploaded .aspx file. Primary access is attempted via the SmarterMail service on port 9998. A second check is performed via the standard IIS web service on port 80 (if listening). The web shell is designed to execute operating system commands passed via HTTP query parameters and return the command output within the HTTP response. As a demonstration of post-exploitation capabilities, If port 80 is listening can optionally deploy a Core Impact agent fileless HTA.