merge soc07 r4896:4898 - added new scripts; made shortport.port_or_service work as intended, it now returns a function instead of a boolean

scripts/SMTPcommands.nse

@@ -0,0 +1,68 @@
+-- SMTP supported commands gathering script
+-- Version History
+-- 1.0.0.0 - 2007-06-12
+
+-- Cribbed heavily from Thomas Buchanan's SQL version detection
+-- script and from Arturo 'Buanzo' Busleiman's SMTP open relay
+-- detector script.
+
+id = "SMTP"
+description = "Attempts to use EHLO to gather the Extended commands an SMTP server supports."
+author = "Jason DePriest <jrdepriest@gmail.com>"
+license = "See nmaps COPYING for licence"
+categories = {"discovery", "intrusive"}
+
+portrule = function(host, port)
+	if (port.number == 25
+		or port.number == 587
+		or port.number == 465
+		or port.service == "smtp")
+		and port.state == "open"
+		and port.protocol == "tcp"
+	then
+		return true
+	else
+		return false
+	end
+end
+
+action = function(host, port)
+
+	local socket = nmap.new_socket()
+	socket:set_timeout(5000)
+
+	local result
+	local commands
+	local mailservername
+	local status = true
+
+	local catch = function()
+		socket:close()
+	end
+
+	local try = nmap.new_try(catch)
+
+	try(socket:connect(host.ip, port.number, port.protocol))
+	result = try(socket:receive_lines(1))
+
+	-- ASCII for "EHLO example.org\n"
+	-- for some reason it wouldn't reply unless I did it like this
+	local query = "\069\072\076\079\032\101\120\097"
+	query = query .. "\109\112\108\101\046\111\114\103"
+	query = query .. "\013\010"
+	try(socket:send(query))
+	result = try(socket:receive_lines(1))
+
+	if not string.match(result, "^250") then
+		socket.close()
+-- TODO: use print_debug instead
+		return "EHLO with errors or timeout.  Enable --script-trace to see what is happening."
+	end
+
+	result = string.gsub(result, "\050\053\048\032\079\075\013\010", "") -- 250 OK (needed to have the \r\n in there)
+	result = string.gsub(result, "250%-", "") -- 250-
+	result = "Responded to EHLO command\n" .. result
+
+	return result
+
+end