158 lines
3.4 KiB
Ruby
158 lines
3.4 KiB
Ruby
|
##
|
||
|
|
# $Id$
|
||
|
|
##
|
||
|
|
|
||
|
|
##
|
||
|
|
# A Very simple Module to fuzzer some SMTP commands.
|
||
|
|
# It allows to respect the order or just throw everything at it....
|
||
|
|
##
|
||
|
|
|
||
|
|
require 'msf/core'
|
||
|
|
|
||
|
|
class Metasploit3 < Msf::Auxiliary
|
||
|
|
|
||
|
|
include Msf::Exploit::Remote::Smtp
|
||
|
|
include Msf::Auxiliary::Fuzzer
|
||
|
|
include Msf::Auxiliary::Scanner
|
||
|
|
|
||
|
|
def initialize
|
||
|
|
super(
|
||
|
|
'Name' => 'SMTP Simple Fuzzer',
|
||
|
|
'Version' => '$Revision$',
|
||
|
|
'Description' => 'SMTP Simple Fuzzer',
|
||
|
|
'References' =>
|
||
|
|
[
|
||
|
|
['URL', 'http://www.ietf.org/rfc/rfc2821.txt'],
|
||
|
|
],
|
||
|
|
'Author' => 'justme',
|
||
|
|
'License' => MSF_LICENSE
|
||
|
|
)
|
||
|
|
|
||
|
|
register_options([
|
||
|
|
Opt::RPORT(25),
|
||
|
|
OptInt.new("STARTLEN", [true, "Lenght of the string - start number", 100] ),
|
||
|
|
OptInt.new("INTERACTIONS", [false, "Number of interactions to run", 100] ),
|
||
|
|
OptBool.new("RESPECTORDER", [false, "Respect order of commands", true] ),
|
||
|
|
OptEnum.new("CMD", [true,"Command to fuzzer",'EHLO',
|
||
|
|
['EHLO',
|
||
|
|
'HELO',
|
||
|
|
'MAILFROM',
|
||
|
|
'RCPTTO',
|
||
|
|
'DATA',
|
||
|
|
'VRFY',
|
||
|
|
'EXPN'
|
||
|
|
], 'EHLO'])
|
||
|
|
], self.class)
|
||
|
|
end
|
||
|
|
|
||
|
|
def smtp_send(data='', con=true)
|
||
|
|
begin
|
||
|
|
@result=''
|
||
|
|
@coderesult=''
|
||
|
|
if (con)
|
||
|
|
@connected=false
|
||
|
|
connect
|
||
|
|
end
|
||
|
|
@connected=true
|
||
|
|
sock.put("#{data}")
|
||
|
|
@result=sock.get_once
|
||
|
|
@codresult=@result[0..2]
|
||
|
|
|
||
|
|
rescue ::Exception => e
|
||
|
|
print_status("Error #{e}")
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
def run_host(ip)
|
||
|
|
begin
|
||
|
|
last_str = nil
|
||
|
|
last_inp = nil
|
||
|
|
last_err = nil
|
||
|
|
|
||
|
|
cnt = datastore['STARTLEN'] - 1
|
||
|
|
|
||
|
|
1.upto(datastore['INTERACTIONS']) do |interection|
|
||
|
|
cnt += 1
|
||
|
|
|
||
|
|
str = fuzzer_gen_string(cnt)
|
||
|
|
cmd=datastore['CMD']
|
||
|
|
|
||
|
|
begin
|
||
|
|
if (datastore['RESPECTORDER'])
|
||
|
|
case cmd
|
||
|
|
when "HELO", "EHLO", "VRFY", "EXPN"
|
||
|
|
c = datastore['CMD'] + " " + str + "\r\n"
|
||
|
|
smtp_send(c,true)
|
||
|
|
#print_status(c)
|
||
|
|
disconnect
|
||
|
|
|
||
|
|
when "MAILFROM"
|
||
|
|
c ="EHLO localhost\r\n"
|
||
|
|
smtp_send(c,true)
|
||
|
|
#print_status(c)
|
||
|
|
c="MAIL FROM:<" + str + ">\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
disconnect
|
||
|
|
#print_status(c)
|
||
|
|
when "RCPTTO"
|
||
|
|
c ="EHLO localhost\r\n"
|
||
|
|
smtp_send(c,true)
|
||
|
|
#print_status(c)
|
||
|
|
c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
#print_status(c)
|
||
|
|
c="RCPT TO:<" + str + ">\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
#print_status(c)
|
||
|
|
disconnect
|
||
|
|
when "DATA"
|
||
|
|
c ="EHLO localhost\r\n"
|
||
|
|
smtp_send(c,true)
|
||
|
|
#print_status(c)
|
||
|
|
c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
#print_status(c)
|
||
|
|
c="RCPT TO:<" + datastore['MAILTO'] + ">\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
#print_status(c)
|
||
|
|
c="DATA \r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
c= str + "\r\n.\r\n"
|
||
|
|
smtp_send(c,false)
|
||
|
|
#print_status(c)
|
||
|
|
disconnect
|
||
|
|
end
|
||
|
|
else
|
||
|
|
c = datastore['CMD'] + " " + str + "\r\n"
|
||
|
|
smtp_send(c,true)
|
||
|
|
#print_status(c)
|
||
|
|
disconnect
|
||
|
|
end
|
||
|
|
|
||
|
|
print_status("Fuzzing with iteration #{interection}\n #{@result}")
|
||
|
|
rescue ::Interrupt
|
||
|
|
print_status("Exiting on interrupt: iteration #{interection} using string #{str}")
|
||
|
|
raise $!
|
||
|
|
rescue ::Exception => e
|
||
|
|
last_err = e
|
||
|
|
#ensure
|
||
|
|
# disconnect
|
||
|
|
end
|
||
|
|
|
||
|
|
if(not @connected)
|
||
|
|
if(last_str)
|
||
|
|
print_status("The service may have crashed: iteration:#{interection-1} String=''#{last_str}'' error=#{last_err}")
|
||
|
|
else
|
||
|
|
print_status("Could not connect to the service: #{last_err}")
|
||
|
|
end
|
||
|
|
return
|
||
|
|
end
|
||
|
|
|
||
|
|
last_str = str
|
||
|
|
last_inp = @last_fuzzer_input
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
end
|