Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
##
7
# A Very simple Module to fuzzer some SMTP commands.
8
# It allows to respect the order or just throw everything at it....
9
##
10

11
class MetasploitModule < Msf::Auxiliary
12
  include Msf::Exploit::Remote::Smtp
13
  include Msf::Auxiliary::Fuzzer
14
  include Msf::Auxiliary::Scanner
15

16
  def initialize
17
    super(
18
      'Name'        => 'SMTP Simple Fuzzer',
19
      'Description' => 'SMTP Simple Fuzzer',
20
      'References'  =>
21
        [
22
          ['URL', 'http://www.ietf.org/rfc/rfc2821.txt'],
23
        ],
24
      'Author'      => 'justme',
25
      'License'     => MSF_LICENSE
26
    )
27

28
    register_options([
29
      Opt::RPORT(25),
30
      OptInt.new("STARTLEN", [true, "Length of the string - start number", 100] ),
31
      OptInt.new("INTERACTIONS", [false, "Number of interactions to run", 100] ),
32
      OptBool.new("RESPECTORDER", [false, "Respect order of commands", true] ),
33
      OptEnum.new("CMD", [true,"Command to fuzzer",'EHLO',
34
        [
35
          'EHLO',
36
          'HELO',
37
          'MAILFROM',
38
          'RCPTTO',
39
          'DATA',
40
          'VRFY',
41
          'EXPN'
42
        ], 'EHLO'])
43
    ])
44
  end
45

46
  def smtp_send(data='', con=true)
47
    begin
48
      @result=''
49
      @coderesult=''
50
      if (con)
51
        @connected=false
52
        connect
53
      end
54
      @connected=true
55
      sock.put(data)
56
      @result=sock.get_once
57
      @codresult=@result[0..2]
58
    rescue ::Exception => e
59
      print_error(e.to_s)
60
    end
61
  end
62

63
  def run_host(ip)
64
    begin
65
    last_str = nil
66
    last_inp = nil
67
    last_err = nil
68

69
    cnt = datastore['STARTLEN'] - 1
70

71
    1.upto(datastore['INTERACTIONS']) do |interaction|
72
      cnt += 1
73

74
      str = fuzzer_gen_string(cnt)
75
      cmd=datastore['CMD']
76

77
      begin
78
        if (datastore['RESPECTORDER'])
79
          case cmd
80
          when "HELO", "EHLO", "VRFY", "EXPN"
81
            c = datastore['CMD'] + " " + str  + "\r\n"
82
            smtp_send(c,true)
83
            #print_status(c)
84
            disconnect
85

86
          when "MAILFROM"
87
            c ="EHLO localhost\r\n"
88
            smtp_send(c,true)
89
            #print_status(c)
90
            c="MAIL FROM:<" + str + ">\r\n"
91
            smtp_send(c,false)
92
            disconnect
93
            #print_status(c)
94
          when "RCPTTO"
95
            c ="EHLO localhost\r\n"
96
            smtp_send(c,true)
97
            #print_status(c)
98
            c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
99
            smtp_send(c,false)
100
            #print_status(c)
101
            c="RCPT TO:<" + str + ">\r\n"
102
            smtp_send(c,false)
103
            #print_status(c)
104
            disconnect
105
          when "DATA"
106
            c ="EHLO localhost\r\n"
107
            smtp_send(c,true)
108
            #print_status(c)
109
            c="MAIL FROM:<" + datastore['MAILFROM'] + ">\r\n"
110
            smtp_send(c,false)
111
            #print_status(c)
112
            c="RCPT TO:<" + datastore['MAILTO'] + ">\r\n"
113
            smtp_send(c,false)
114
            #print_status(c)
115
            c="DATA \r\n"
116
            smtp_send(c,false)
117
            c= str + "\r\n.\r\n"
118
            smtp_send(c,false)
119
            #print_status(c)
120
            disconnect
121
          end
122
        else
123
          c = datastore['CMD'] + " " + str  + "\r\n"
124
          smtp_send(c,true)
125
          #print_status(c)
126
          disconnect
127
        end
128

129
        print_status("Fuzzing with iteration #{interaction}\n #{@result}")
130

131
      rescue ::Interrupt
132
        print_status("Exiting on interrupt: iteration #{interaction} using string  #{str}")
133
        raise $!
134
      rescue ::Exception => e
135
        last_err = e
136
      #ensure
137
      #disconnect
138
      end
139

140

141
      if(not @connected)
142
        if(last_str)
143
          print_status("The service may have crashed: iteration:#{interection-1} String=''#{last_str}'' error=#{last_err}")
144
        else
145
          print_status("Could not connect to the service: #{last_err}")
146
        end
147
        return
148
      end
149

150
      last_str = str
151
      last_inp = @last_fuzzer_input
152
    end
153
  end
154
  end
155
end
156

157