CODEWITHSUNDEEP
pythonsockets
dude
dude

Reputation: 181

Python script to probe smtp servers

I have written this script to test a single ip address for probing specific user names on smtp servers for a pentest. I am trying now to port this script to run the same tests, but to a range of ip addresses instead of a single one. Can anyone shed some light as to how that can be achieved?

#!/usr/bin/python

import socket
import sys


users= []
for line in sys.stdin:
        line = line.strip()
        if line != '':
                users.append(line)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1], 25))
fp = s.makefile('rwb')

fp.readline()
fp.write('HELO test.example.com\r\n')
fp.flush()
fp.readline

for user in users:
        fp.write('VRFY %s\r\n\ ' % user)
        fp.flush()
        print '%s: %s' % (user, fp.readline().strip())

fp.write('QUIT\r\n')
fp.flush()
s.close()

Upvotes: 1

Views: 945

Answers (3)

dude
dude

Reputation: 181

Ok, so here is what I have done to get this going. The solution is not elegant at all but it does the trick, and also, I could not spend more time trying to find a solution on this purely in Python, so I have decided, after reading the answer from bmhkim above(thanks for the tips) to write a bash script to have it iterate over a range of ip addresses and for each one call my python script to do its magic.

#!/bin/bash

for ip in $(seq 1 254); do
python smtp-probe.py 192.168.1.$ip <users.txt 
done

I have had some problems with the output since that was giving me the servers responses to my probing attempts but not the actual ip addresses which were sending those responses, so I have adapted the original script to this:

#!/usr/bin/python

import socket
import sys


users= []
for line in sys.stdin:
        line = line.strip()
        if line != '':
                users.append(line)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1], 25))
print sys.argv[1] #Notice the printing of the script arguments/ip addresses for my output

fp = s.makefile('rwb')
fp.readline()
fp.write('HELO test.example.com\r\n')
fp.flush()
fp.readline
for user in users:
        fp.write('VRFY %s\r\n\ ' % user)
        fp.flush()
        print '%s: %s' % (user, fp.readline().strip())


fp.write('QUIT\r\n')
fp.flush()
s.close()

Like I said above, that is a tricky way out-I know, but I am not a programmer, so that is the way out I was able to find(if you have a way purely in Python to do it I would like very much to see it). I will definitely re-visit this issue once I have a bit more time and I will keep studying Python until I get this right.

Thanks all for the support to my question!!

Upvotes: 0

Adam Smith
Adam Smith

Reputation: 54163

If you're using Python3.3+, this is mostly simple

import ipaddress # new in Python3.3

start_ip, end_ip = however_you_get_these_as_strings()

ip_networks = ipaddress.summarize_address_range(
                 ipaddress.IPv4Address(start_ip),
                 ipaddress.IPv4Address(end_ip))
# list of networks between those two IPs

for network in ip_networks:
    for ip in network:
        # ip is an ipaddress.IPv4Address object
        probe(str(ip))
        # which converts nicely to str

Upvotes: 1

bmhkim
bmhkim

Reputation: 774

I would implement this by turning your code as it stands into a function to probe a single host, taking the host name/ip as an argument. Then, loop over your list of hosts (either from the command line, a file, interactive querying of a user, or wherever) and make a call to your single host probe for each host in the loop.

Upvotes: 0

Related Questions