o [NSE] Updated the SMTP scripts to use the new SMTP Lua library.

scripts/smtp-commands.nse

@@ -13,7 +13,7 @@ SMTP server.
 -- | smtp-commands: SMTP.domain.com Hello [172.x.x.x], TURN, SIZE, ETRN, PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, X-EXPS GSSAPI NTLM LOGIN, X-EXPS=LOGIN, AUTH GSSAPI NTLM LOGIN, AUTH=LOGIN, X-LINK2STATE, XEXCH50, OK
 -- |_ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY
 --
--- @args smtp-commands.domain Define the domain to be used in the SMTP commands.
+-- @args smtp.domain or smtp-commands.domain Define the domain to be used in the SMTP commands.
 
 -- changelog
 -- 1.1.0.0 - 2007-10-12
@@ -53,6 +53,8 @@ SMTP server.
 --   Busleiman's SMTP open relay detector script and Duarte Silva's SMTP 
 --   user enumeration script.
 --   Props to them for doing what they do and letting me ride on their coattails.
+-- 2.1.0.0 - 2011-06-01
+-- + Rewrite the script to use the smtp.lua library.
 
 author = "Jason DePriest"
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
@@ -60,166 +62,67 @@ categories = {"default", "discovery", "safe"}
 
 require "shortport"
 require "stdnse"
-require "comm"
+require "smtp"
 
-portrule = shortport.port_or_service({ 25, 465, 587 }, { "smtp", "smtps", "submission" })
-
-ERROR_MESSAGES = {
-	["EOF"] = "connection closed",
-	["TIMEOUT"] = "connection timeout",
-	["ERROR"] = "failed to receive data"
-}
-
-STATUS_CODES = {
-	ERROR = 1,
-	NOTPERMITED = 2,
-	VALID = 3,
-	INVALID = 4
-}
-
----Send a command and read the response (this function does exception handling, and if an
--- exception occurs, it will close the socket).
---
---@param socket Socket used to send the command
---@param request Command to be sent
---@return False in case of failure
---@return True and the response in case of success
-function do_request(socket, request)
-	-- Exception handler.
-	local catch = function()
-		socket:close()
-	end
-
-	local try = nmap.new_try(catch)
-
-	-- Lets send the command.
-	try(socket:send(request))
-
-	-- Receive server response.
-	local status, response = socket:receive_lines(1)
-
-	if not status then
-		-- Close the socket (the call to receive_lines doesn't use try).
-		socket:close()
-
-		return false, (ERROR_MESSAGES[response] or "unspecified error")
-	end
-
-	return true, response
-end
-
----Get a domain to be used in the SMTP commands that need it. If the user specified one
--- through a script argument this function will return it. Otherwise it will try to find
--- the domain from the typed hostname and from the rDNS name. If it still can't find one
--- it will use the nmap.scanme.org by default.
---
--- @param host Current scanned host
--- @return The hostname to be used
-function get_domain(host)
-	local result = "nmap.scanme.org"
-
-	-- Use the user provided options.
-	if (nmap.registry.args["smtp-commands.domain"] ~= nil) then
-		result = nmap.registry.args["smtp-commands.domain"]
-	elseif type(host) == "table" then
-		if host.targetname then
-			result = host.targetname
-		elseif (host.name ~= "" and host.name) then
-			result = host.name
-		end
-	end
-
-	return result
-end
+portrule = shortport.port_or_service({ 25, 465, 587 },
+                { "smtp", "smtps", "submission" })
 
 function go(host, port)
-	local socket = nmap.new_socket()
-	local options = {
-		timeout = 10000,
-		recv_before = true
-	}
+    local options = {
+        timeout = 10000,
+        recv_before = true,
+        ssl = true,
+    }
 
-	socket:set_timeout(5000)
+    local domain = stdnse.get_script_args('smtp-commands.domain') or
+                      smtp.get_domain(host)
 
-	-- Be polite and when everything works out send the QUIT message.
-	local quit = function()
-		do_request(socket, "QUIT\r\n")
-		socket:close()
-	end
-	
-	local domain = get_domain(host)
+    local result, status = {}
+    -- Try to connect to server.
+    local socket, response = smtp.connect(host, port, options)
+    if not socket then
+        return false, string.format("Couldn't establish connection on port %i",
+                          port.number)
+    end
 
-	-- Try to connect to server.
-	local response
+    status, response = smtp.ehlo(socket, domain)
+    if not status then
+        return status, response
+    end
 
-	socket, response = comm.tryssl(host, port, string.format("EHLO %s\r\n", domain), options)
+    response = string.gsub(response, "250[%-%s]+", "") -- 250 or 250-
+    response = string.gsub(response, "\r\n", "\n") -- normalize CR LF
+    response = string.gsub(response, "\n\r", "\n") -- normalize LF CR
+    response = string.gsub(response, "^\n+(.-)\n+$", "%1")
+    response = string.gsub(response, "\n", ", ") -- LF to comma
+    response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
+    table.insert(result,response)
 
-	if not socket then
-		return false, string.format("Couldn't establish connection on port %i", port.number)
-	end
-	
-	local result = {}
-	local index
-	local status
+    status, response = smtp.help(socket)
+    if status then
+        response = string.gsub(response, "214[%-%s]+", "") -- 214
+        response = string.gsub(response, "^%s+(.-)%s+$", "%1")
+        response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
+        table.insert(result,response)
+        smtp.quit(socket)
+    end
 
-	local failure = function(message)
-		if #result > 0 then
-			table.insert(result, message)
-
-			return true, result
-		else
-			return false, message
-		end
-	end
-	
-	if not string.match(response, "^250") then
-		quit()
-		return false
-	end
-	response = string.gsub(response, "250%-", "") -- 250-
-	response = string.gsub(response, "250 ", "") -- 250 
-	response = string.gsub(response, "\r\n", "\n") -- normalize CR LF
-	response = string.gsub(response, "\n\r", "\n") -- normalize LF CR
-	response = string.gsub(response, "^\n+", "") -- no initial LF
-	response = string.gsub(response, "\n+$", "") -- no final LF
-	response = string.gsub(response, "\n", ", ") -- LF to comma
-	response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
-	table.insert(result,response)
-
-	status, response = do_request(socket, "HELP\r\n")
-
-	if not status then
-		return failure(string.format("Failed to issue HELP command (%s)", response))
-	end
-
-	if not string.match(response, "^214") then
-		quit()
-		return false
-	end
-	response = string.gsub(response, "214%-", "") -- 214-
-	response = string.gsub(response, "214 ", "") -- 214
-	response = string.gsub(response, "^%s+", "") -- no initial space
-	response = string.gsub(response, "%s+$", "") -- no final space
-	response = string.gsub(response, "%s+", " ") -- get rid of extra spaces
-	table.insert(result,response)
-
-	quit()
-	return true, result
+    return true, result
 end
 
 action = function(host, port)
-	local status, result = go(host, port)
+    local status, result = go(host, port)
 
-	-- The go function returned false, this means that the result is a simple error message.
-	if not status then
-		return result
-	else
-		if #result > 0 then
-			final = {}
-			for index, test in ipairs(result) do
-				table.insert(final, test)
-			end
-			return stdnse.strjoin("\n ", final)
-		end
-	end
+    -- The go function returned false, this means that the result is a simple error message.
+    if not status then
+        return result
+    else
+        if #result > 0 then
+            final = {}
+            for index, test in ipairs(result) do
+                table.insert(final, test)
+            end
+            return stdnse.strjoin("\n ", final)
+        end
+    end
 end