2013-03-07 23:53:19 +00:00
|
|
|
##
|
2017-07-24 13:26:21 +00:00
|
|
|
# This module requires Metasploit: https://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2013-03-07 23:53:19 +00:00
|
|
|
##
|
|
|
|
|
2010-06-03 18:13:12 +00:00
|
|
|
##
|
|
|
|
# A Very simple Module to fuzzer some SMTP commands.
|
|
|
|
# It allows to respect the order or just throw everything at it....
|
|
|
|
##
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Auxiliary
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Exploit::Remote::Smtp
|
|
|
|
include Msf::Auxiliary::Fuzzer
|
|
|
|
include Msf::Auxiliary::Scanner
|
|
|
|
|
|
|
|
def initialize
|
|
|
|
super(
|
|
|
|
'Name' => 'SMTP Simple Fuzzer',
|
|
|
|
'Description' => 'SMTP Simple Fuzzer',
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
['URL', 'http://www.ietf.org/rfc/rfc2821.txt'],
|
|
|
|
],
|
|
|
|
'Author' => 'justme',
|
|
|
|
'License' => MSF_LICENSE
|
|
|
|
)
|
|
|
|
|
|
|
|
register_options([
|
|
|
|
Opt::RPORT(25),
|
2017-02-20 20:47:59 +00:00
|
|
|
OptInt.new("STARTLEN", [true, "Length of the string - start number", 100] ),
|
2013-08-30 21:28:54 +00:00
|
|
|
OptInt.new("INTERACTIONS", [false, "Number of interactions to run", 100] ),
|
|
|
|
OptBool.new("RESPECTORDER", [false, "Respect order of commands", true] ),
|
|
|
|
OptEnum.new("CMD", [true,"Command to fuzzer",'EHLO',
|
|
|
|
[
|
|
|
|
'EHLO',
|
|
|
|
'HELO',
|
|
|
|
'MAILFROM',
|
|
|
|
'RCPTTO',
|
|
|
|
'DATA',
|
|
|
|
'VRFY',
|
|
|
|
'EXPN'
|
|
|
|
], 'EHLO'])
|
2017-05-03 20:42:21 +00:00
|
|
|
])
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def smtp_send(data='', con=true)
|
|
|
|
begin
|
|
|
|
@result=''
|
|
|
|
@coderesult=''
|
|
|
|
if (con)
|
|
|
|
@connected=false
|
|
|
|
connect
|
|
|
|
end
|
|
|
|
@connected=true
|
|
|
|
sock.put(data)
|
|
|
|
@result=sock.get_once
|
|
|
|
@codresult=@result[0..2]
|
|
|
|
rescue ::Exception => e
|
|
|
|
print_error(e.to_s)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def run_host(ip)
|
|
|
|
begin
|
|
|
|
last_str = nil
|
|
|
|
last_inp = nil
|
|
|
|
last_err = nil
|
|
|
|
|
|
|
|
cnt = datastore['STARTLEN'] - 1
|
|
|
|
|
|
|
|
1.upto(datastore['INTERACTIONS']) do |interection|
|
|
|
|
cnt += 1
|
|
|
|
|
|
|
|
str = fuzzer_gen_string(cnt)
|
|
|
|
cmd=datastore['CMD']
|
|
|
|
|
|
|
|
begin
|
|
|
|
if (datastore['RESPECTORDER'])
|
|
|
|
case cmd
|
|
|
|
when "HELO", "EHLO", "VRFY", "EXPN"
|
|
|
|
c = datastore['CMD'] + " " + str + "\r\n"
|
|
|
|
smtp_send(c,true)
|
|
|
|
#print_status(c)
|
|
|
|
disconnect
|
|
|
|
|
|
|
|
when "MAILFROM"
|
|
|
|
c ="EHLO localhost\r\n"
|
|
|
|
smtp_send(c,true)
|
|
|
|
#print_status(c)
|
|
|
|
c="MAIL FROM:<" + str + ">\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
disconnect
|
|
|
|
#print_status(c)
|
|
|
|
when "RCPTTO"
|
|
|
|
c ="EHLO localhost\r\n"
|
|
|
|
smtp_send(c,true)
|
|
|
|
#print_status(c)
|
|
|
|
c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
#print_status(c)
|
|
|
|
c="RCPT TO:<" + str + ">\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
#print_status(c)
|
|
|
|
disconnect
|
|
|
|
when "DATA"
|
|
|
|
c ="EHLO localhost\r\n"
|
|
|
|
smtp_send(c,true)
|
|
|
|
#print_status(c)
|
|
|
|
c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
#print_status(c)
|
|
|
|
c="RCPT TO:<" + datastore['MAILTO'] + ">\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
#print_status(c)
|
|
|
|
c="DATA \r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
c= str + "\r\n.\r\n"
|
|
|
|
smtp_send(c,false)
|
|
|
|
#print_status(c)
|
|
|
|
disconnect
|
|
|
|
end
|
|
|
|
else
|
|
|
|
c = datastore['CMD'] + " " + str + "\r\n"
|
|
|
|
smtp_send(c,true)
|
|
|
|
#print_status(c)
|
|
|
|
disconnect
|
|
|
|
end
|
|
|
|
|
|
|
|
print_status("Fuzzing with iteration #{interection}\n #{@result}")
|
|
|
|
|
|
|
|
rescue ::Interrupt
|
|
|
|
print_status("Exiting on interrupt: iteration #{interection} using string #{str}")
|
|
|
|
raise $!
|
|
|
|
rescue ::Exception => e
|
|
|
|
last_err = e
|
|
|
|
#ensure
|
2015-04-03 11:12:23 +00:00
|
|
|
#disconnect
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
if(not @connected)
|
|
|
|
if(last_str)
|
|
|
|
print_status("The service may have crashed: iteration:#{interection-1} String=''#{last_str}'' error=#{last_err}")
|
|
|
|
else
|
|
|
|
print_status("Could not connect to the service: #{last_err}")
|
|
|
|
end
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
last_str = str
|
|
|
|
last_inp = @last_fuzzer_input
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2010-06-03 18:13:12 +00:00
|
|
|
end
|