Updates to smtp-commands.nse from Jason DePriest.

o [NSE] Improved smtp-commands.nse to work against more mail servers,
  made it take an smtp-commands.domain script argument, and rewrote it
  in the style of other smtp scripts. [Jason DePriest]

CHANGELOG

@@ -1,5 +1,9 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE] Improved smtp-commands.nse to work against more mail servers,
+  made it take an smtp-commands.domain script argument, and rewrote it
+  in the style of other smtp scripts. [Jason DePriest]
+
 o [NSE] Improved error handling and reporting and re-designed communication
   class in RPC library with patch from Djalal Harouni. [Patrik]
 

scripts/smtp-commands.nse

@@ -4,20 +4,24 @@ SMTP server.
 ]]
 
 ---
+-- @usage
+-- nmap --script smtp-commands.nse [--script-args smtp-open-relay.domain=<domain>] -pT:25,465,587 <host>
+--
 -- @output
--- 25/tcp	open	smtp
+-- PORT   STATE SERVICE REASON  VERSION
--- |  smtp-commands: EHLO uninvited.example.net Hello root at localhost [127.0.0.1], SIZE 52428800, PIPELINING, HELP
+-- 25/tcp open  smtp    syn-ack Microsoft ESMTP 6.0.3790.3959
--- |_ HELP Commands supported: AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+-- | smtp-commands: SMTP.domain.com Hello [172.x.x.x], TURN, SIZE, ETRN, PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, X-EXPS GSSAPI NTLM LOGIN, X-EXPS=LOGIN, AUTH GSSAPI NTLM LOGIN, AUTH=LOGIN, X-LINK2STATE, XEXCH50, OK
-
+-- |_ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY
--- Version History
+--
+-- @args smtp-commands.domain Define the domain to be used in the SMTP commands
+--
+-- @changelog
 -- 1.1.0.0 - 2007-10-12
 -- + added HELP command in addition to EHLO
-
 -- 1.2.0.0 - 2008-05-19
 -- + made output single line, comma-delimited, instead of
 --   CR LF delimited on multi-lines
 -- + was able to use regular text and not hex codes
-
 -- 1.3.0.0 - 2008-05-21
 -- + more robust handling of problems
 -- + uses verbosity and debugging to decide if you need to
@@ -26,25 +30,29 @@ SMTP server.
 -- + I am not able to do much testing because my new ISP blocks
 --   traffic going to port 25 other than to their mail servers as
 --   a "security" measure.
-
 -- 1.3.1.0 - 2008-05-22
 -- + minor tweaks to get it working when one of the requests fails
 --   but not both of them.
-
 -- 1.5.0.0 - 2008-08-15
 -- + updated to use the nsedoc documentation system
-
 -- 1.6.0.0 - 2008-10-06
 -- + Updated gsubs to handle different formats, pulls out extra spaces
 --   and normalizes line endings
-
 -- 1.7.0.0 - 2008-11-10
 -- + Better normalization of output, remove "250 " from EHLO output,
 --   don't comma-separate HELP output.
-
+-- 2.0.0.0 - 2010-04-19
--- Cribbed heavily from Thomas Buchanan's SQL version detection
+-- + Complete rewrite based off of Arturo 'Buanzo' Busleiman's SMTP open
--- script and from Arturo 'Buanzo' Busleiman's SMTP open relay
+--   relay detector script.
--- detector script.
+-- 2.0.1.0 - 2010-04-27
+-- + Incorporated advice from Duarte Silva (http://seclists.org/nmap-dev/2010/q2/277)
+--   - 'domain' can be specified via a script-arg
+--   - removed extra EHLO command that was redundant and not needed
+--   - fixed two quit()s to include a return value
+-- + To reiterate, this is a blatant cut and paste job of Arturo 'Buanzo' 
+--   Busleiman's SMTP open relay detector script and Duarte Silva's SMTP 
+--   user enumeration script.
+--   Props to them for doing what they do and letting me ride on their coattails.
 
 author = "Jason DePriest"
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
@@ -56,78 +64,162 @@ require "comm"
 
 portrule = shortport.port_or_service({ 25, 465, 587 }, { "smtp", "smtps", "submission" })
 
-action = function(host, port)
+ERROR_MESSAGES = {
-	
+	["EOF"] = "connection closed",
-	local socket = nmap.new_socket()
+	["TIMEOUT"] = "connection timeout",
-	socket:set_timeout(5000)
+	["ERROR"] = "failed to receive data"
-	
+}
-	local result
+
-	local resultEHLO
+STATUS_CODES = {
-	local resultHELP
+	ERROR = 1,
-	
+	NOTPERMITED = 2,
+	VALID = 3,
+	INVALID = 4
+}
+
+---Send a command and read the response (this function does exception handling, and if an
+-- exception occurs, it will close the socket).
+--
+--@param socket Socket used to send the command
+--@param request Command to be sent
+--@return False in case of failure
+--@return True and the response in case of success
+function do_request(socket, request)
+	-- Exception handler.
 	local catch = function()
 		socket:close()
-		--return
 	end
-	
+
 	local try = nmap.new_try(catch)
 
-	opt = {timeout=4000, recv_before=true}
+	-- Lets send the command.
-	
+	try(socket:send(request))
-	socket = comm.tryssl(host, port, "\n", opt)
+
-	if not socket then
+	-- Receive server response.
-		stdnse.print_debug("Problem connecting to " .. host.ip .. " on port " .. port.number .. " using ssl and tcp protocols.")
+	local status, response = socket:receive_lines(1)
-		return
+
+	if not status then
+		-- Close the socket (the call to receive_lines doesn't use try).
+		socket:close()
+
+		return false, (ERROR_MESSAGES[response] or "unspecified error")
 	end
 
-	local query = "EHLO example.org\r\n"
+	return true, response
-	try(socket:send(query))
+end
-	resultEHLO = try(socket:receive_lines(1))
+
-
+---Get a domain to be used in the SMTP commands that need it. If the user specified one
-	if not (string.match(resultEHLO, "^250")) then
+-- through a script argument this function will return it. Otherwise it will try to find
---		stdnse.print_debug("1","%s",resultEHLO)
+-- the domain from the typed hostname and from the rDNS name. If it still can't find one
---		stdnse.print_debug("1","EHLO with errors or timeout.  Enable --script-trace to see what is happening.")
+-- it will use the nmap.scanme.org by default.
-		resultEHLO = ""
+--
-	end
+-- @param host Current scanned host
-
+-- @return The hostname to be used
-	if resultEHLO ~= "" then
+function get_domain(host)
-		
+	local result = "nmap.scanme.org"
-		resultEHLO = string.gsub(resultEHLO, "250 OK[\r\n]", "") -- 250 OK (needed to have the \r\n in there)
+
-		-- get rid of the 250- at the beginning of each line in the response
+	-- Use the user provided options.
-		resultEHLO = string.gsub(resultEHLO, "250%-", "") -- 250-
+	if (nmap.registry.args["smtp-commands.domain"] ~= nil) then
-		resultEHLO = string.gsub(resultEHLO, "250 ", "") -- 250 
+		result = nmap.registry.args["smtp-commands.domain"]
-		resultEHLO = string.gsub(resultEHLO, "\r\n", "\n") -- normalize CR LF
+	elseif type(host) == "table" then
-		resultEHLO = string.gsub(resultEHLO, "\n\r", "\n") -- normalize LF CR
+		if host.targetname then
-		resultEHLO = string.gsub(resultEHLO, "^\n+", "") -- no initial LF
+			result = host.targetname
-		resultEHLO = string.gsub(resultEHLO, "\n+$", "") -- no final LF
+		elseif (host.name ~= "" and host.name) then
-		resultEHLO = string.gsub(resultEHLO, "\n", ", ") -- LF to comma
+			result = host.name
-		resultEHLO = string.gsub(resultEHLO, "%s+", " ") -- get rid of extra spaces
+		end
-		resultEHLO = "\nEHLO " .. resultEHLO
+	end
-	end
+
-	
+	return result
-	local query = "HELP\r\n"
+end
-	try(socket:send(query))
+
-	resultHELP = try(socket:receive_lines(1))
+function go(host, port)
-
+	local socket = nmap.new_socket()
-	if not (string.match(resultHELP, "^214")) then
+	local options = {
---		stdnse.print_debug("1","%s",resultHELP)
+		timeout = 10000,
---		stdnse.print_debug("1","HELP with errors or timeout.  Enable --script-trace to see what is happening.")
+		recv_before = true
-		resultHELP = ""
+	}
-	end
+
-	if resultHELP ~= "" then
+	socket:set_timeout(5000)
-		resultHELP = string.gsub(resultHELP, "214%-", "") -- 214-
+
-		-- get rid of the 214 at the beginning of the lines in the response
+	-- Be polite and when everything works out send the QUIT message.
-		resultHELP = string.gsub(resultHELP, "214 ", "") -- 214
+	local quit = function()
-		resultHELP = string.gsub(resultHELP, "^%s+", "") -- no initial space
+		do_request(socket, "QUIT\r\n")
-		resultHELP = string.gsub(resultHELP, "%s+$", "") -- no final space
+		socket:close()
-		resultHELP = string.gsub(resultHELP, "%s+", " ") -- get rid of extra spaces
+	end
-		resultHELP = "\nHELP " .. resultHELP
+	
-	end
+	local domain = get_domain(host)
-
+
-	result = resultEHLO .. resultHELP
+	-- Try to connect to server.
-	
+	local response
-	socket:close()
+
-	
+	socket, response = comm.tryssl(host, port, string.format("EHLO %s\r\n", domain), options)
-	return result
+
-   
+	if not socket then
+		return false, string.format("Couldn't establish connection on port %i", port.number)
+	end
+	
+	local result = {}
+	local index
+	local status
+
+	local failure = function(message)
+		if #result > 0 then
+			table.insert(result, message)
+
+			return true, result
+		else
+			return false, message
+		end
+	end
+	
+	if not string.match(response, "^250") then
+		quit()
+		return false
+	end
+	response = string.gsub(response, "250%-", "") -- 250-
+	response = string.gsub(response, "250 ", "") -- 250 
+	response = string.gsub(response, "\r\n", "\n") -- normalize CR LF
+	response = string.gsub(response, "\n\r", "\n") -- normalize LF CR
+	response = string.gsub(response, "^\n+", "") -- no initial LF
+	response = string.gsub(response, "\n+$", "") -- no final LF
+	response = string.gsub(response, "\n", ", ") -- LF to comma
+	response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
+	table.insert(result,response)
+
+	status, response = do_request(socket, "HELP\r\n")
+
+	if not status then
+		return failure(string.format("Failed to issue HELP command (%s)", response))
+	end
+
+	if not string.match(response, "^214") then
+		quit()
+		return false
+	end
+	response = string.gsub(response, "214%-", "") -- 214-
+	response = string.gsub(response, "214 ", "") -- 214
+	response = string.gsub(response, "^%s+", "") -- no initial space
+	response = string.gsub(response, "%s+$", "") -- no final space
+	response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
+	table.insert(result,response)
+
+	quit()
+	return true, result
+end
+
+action = function(host, port)
+	local status, result = go(host, port)
+
+	-- The go function returned false, this means that the result is a simple error message.
+	if not status then
+		return result
+	else
+		if #result > 0 then
+			final = {}
+			for index, test in ipairs(result) do
+				table.insert(final, test)
+			end
+			return stdnse.strjoin("\n ", final)
+		end
+	end
 end