-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added Extended SMTP Open Relay aux module #2928
Conversation
On my side, this module looks very similar to the auxiliary/scanner/smtp/smtp_relay, but it's just adding several probes to test the relay (combinations of MAIL FROM, MAIL TO), if I'm not forgetting nothing. So, I think the original auxiliary/scanner/smtp/smtp_relay should be modified, since it just looks like an improved version. Thoughts? @xistence you probably would like to wait until other's opinions before switching to modify the existent module vs adding a new one. Your feedback is also welcome, of course. |
Reviewing today... Thanks, @jvazquez-r7. |
@jvazquez-r7 I think it should be a separate module. There could be situations in a pentest that you would only want to do a simple relay check with a MAIL FROM -> MAIL TO and not bombard the mail servers with 16 checks :) |
I'm in favor of extending |
Sound good to me |
If considered useful, I've added a function to generate a random email address: #2969 |
@jvazquez-r7 / @wvu-r7 Modified it now so that an EXTENDED option is availablle, which is set to false by default. This way the module will work the same as before, unless EXTENDED is set to true. |
Thanks! |
|
||
register_options( | ||
[ | ||
Opt::RPORT(25), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Already registered by Msf::Exploit::Remote::Smtp
.
Removed the rport definition as stated by @wvu-r7 |
], | ||
'Author' => 'Campbell Murray', |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unless you're Campbell Murray, I don't think it's fair to remove them as an author, even if you've rewritten the module.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe the same guy, but Campbell Murray wrote:
so I don't think so? Hard to tell, since I've never been able to find a twitter / github profile for @xistence with a government-issued-sounding name.
Assuming you're not actually Campbell, then author credits are additive.
Made some changes, to also give credit where credit is due of course :) |
Thanks for getting back to this. :) |
This auxiliary module will do more extended tests for an open SMTP relay. This is done by using configuration or old mailserver design flaws.
The existing "smtp_relay" auxiliary module only tests for a simple MAIL FROM: / MAIL TO: relay. This module will test for 16 different types of relaying.
The idea for the module is based on the NMAP smtp-open-relay NSE script which can be found on https://svn.nmap.org/nmap/scripts/smtp-open-relay.nse
msf > use auxiliary/scanner/smtp/smtp_relay_ext
msf auxiliary(smtp_relay_ext) > set RHOSTS 192.168.0.123
RHOSTS => 192.168.0.123
msf auxiliary(smtp_relay_ext) > run
[] 192.168.0.123:25 - SMTP 220 mail.mymailserver.com ESMTP\x0d\x0a
[] 192.168.0.123:25 - Test #1 - No relay detected
[] 192.168.0.123:25 - Test #2 - No relay detected
[] 192.168.0.123:25 - Test #3 - No relay detected
[+] 192.168.0.123:25 - Test #4 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<human@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #5 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<human%ahhhzombies111.net@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #6 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:human%ahhhzombies111.net@mail.mymailserver.com
[] 192.168.0.123:25 - Test #7 - No relay detected
[+] 192.168.0.123:25 - Test #8 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<"human%ahhhzombies111.net">
[+] 192.168.0.123:25 - Test #9 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<human@ahhhzombies111.net@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #10 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<"human@ahhhzombies111.net"@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #11 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<human@ahhhzombies111.net@mail.mymailserver.com>
[] 192.168.0.123:25 - Test #12 - No relay detected
[] 192.168.0.123:25 - Test #13 - No relay detected
[+] 192.168.0.123:25 - Test #14 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<ahhhzombies111.net!human>
[+] 192.168.0.123:25 - Test #15 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:<ahhhzombies111.net!human@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #16 - Potential open SMTP relay detected: - MAIL FROM:<zombie@[192.168.0.123]> -> RCPT TO:ahhhzombies111.net!human@mail.mymailserver.com
[] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed