perl » Apollo89.com

스패머 유인용 smtp 용 허니팟

by apollo89 Posted on 2007년 11월 30일

smtp 용 허니팟 스크립트 입니다. 그리고 정부기관의 배너로 스푸핑하는 것도 가능합니다.

#!/usr/local/bin/perl -w
#!c:\perl\bin\perl.exe -w

# Created by hackmen and weazy at Interz0ne '02
# Released by Cybnet Security Group as freeware
#
# Date Last Modified: 10/15/2002 1437
#
# Abstract: Simulates and SMTP server in order to catch crackers and spammers.
# Notes for future development:
# need to add comments
# modularize the prog to accept unique SMTP distro specs to allow easy emulation
# create IP masquerading to simulate an entire network from the same prog
#
# legalz: modify and use at will, if you make any changes, improvements, updates or use the code
# in another project, please send us what you did and give credit
# if you have any questions, post them at forum.hackerthreads.net
# be sure to check out hackerthreads.org for updates and new tutorials/downloads
# Alter $host = to whatever hostname you want to simulate

use strict;
use Socket;

my $port = 25;
my $host = "admin.secure.fbi.gov";
my $smtpver = "Sendmail 8.11.3";
my $tcp = getprotobyname('tcp');

socket(Server, PF_INET, SOCK_STREAM, $tcp) or die "socket: $!";
setsockopt(Server, SOL_SOCKET, SO_REUSEADDR, pack("l", 1)) or die "setsockopt: $!";
bind(Server, sockaddr_in($port, INADDR_ANY)) or die "bind: $!";
listen(Server,SOMAXCONN) or die "listen: $!";
print STDERR ("\n");
logmsg ("server started on port ", $port, "\n\n");
my ( $addr,
                @inetaddr
   );
my $old_handle = select Client;

$| =1;

select $old_handle;

*STDOUT = *Client;
*STDIN = *Client;

while (1) {

        $addr = accept(Client,Server);

        my(undef, undef, $inetaddr) = unpack('S n a4 x8', $addr);
        @inetaddr = unpack('C4', $inetaddr);

        print STDERR ("\n\n");

        logmsg ("incoming connection from: ", join(".", @inetaddr), "\n");

        &READ ();

}

close Client;


sub logmsg {
        print STDERR (scalar (localtime), ": ", $$, ": ", @_);
}

sub READ {

        my $saidhelo = 0;
        my $saidmail = 0;
        my $maildata;

        print ("220 ", $host, ' ', $smtpver, ' ',  scalar (localtime), "\r\n");

        while (1) {

                my $commands = <STDIN>;

                if (!defined ($commands)) {
                        return;
                }

                $commands =~ s/[\r\n]+|\s+$//g;
                my @commands = split (/\s+/, $commands);
                logmsg ($commands, "\n");

                if (!defined $commands[1]) {
                        $commands[1] = '';
                }

                if (!defined $commands[2]) {
                        $commands[2] = '';
                }

                my %smtphash = (   AUTH     => "503 AUTH mechanism not available.\x0d\x0a",
                                BADRCPT  => "503 5.0.0 Need MAIL before RCPT\x0d\x0a",
                                BADHELO  => "503 5.0.0 Polite people say HELO first\x0d\x0a",
                                DATA     => "354 Enter mail, end with \"\.\" on a line by itself\x0d\x0a",
                                DATAerr  => "503 5.0.0 Need MAIL command\x0d\x0a",
                                DATAsent => "250 2.0.0 g8684xUD014698 Message accepted for delivery\x0d\x0a",
                                EHLOOUT  => "501 5.0.0 HELO requires domain address.\x0d\x0a",
                                ERR      => "500 5.5.1 Command unrecognized: $commands\x0d\x0a",
                                ETRN     => "500 5.5.2 Parameter required\x0d\x0a",
                                EXPN     => "502 5.7.0 Sorry, we do not allow this operation.\x0d\x0a",
                                HELOERR  => "501 5.0.0 Invalid domain name\x0d\x0a",
                                HELOOUT  => "501 5.0.0 HELO requires domain address.\x0d\x0a",
                                HELOIN   => "250 $host Hello $commands[1], pleased to meet you.\x0d\x0a",
                                MAILFROM => "553 5.5.4 MAILDATA... Domain name required for sender address MAILDATA\x0d\x0a",
                                MAILTO   => "250 2.1.0 MAILDATA... Sender ok\x0d\x0a",
                                MAIL     => "501 5.5.2 Syntax error in parameters scanning \"$commands[1]\"\x0d\x0a",
                                NOOP     => "250 2.0.0 OK.\x0d\x0a",
                                QUIT     => "220 2.0.0 $host closing connection..\x0d\x0a",
                                RCPTTO   => "250 2.1.5 $commands[2]... Recipient ok\x0d\x0a",
                                RESET    => "250 2.0.0 Reset state.\x0d\x0a",
                                RSET     => "250 2.0.0 Reset state\x0d\x0a",
                                STARTTLS => "454 4.3.3 TLS not available after start..\x0d\x0a",
                                VRFY     => "252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger).\x0d\x0a",
                                HELP     => "214-2.0.0 Sendmail v8.4.3\x0d\x0a214-2.0.0 Topics:\x0d\x0a214-2.0.0       HELO    EHLO    MAIL    RCPT    DATA\x0d\x0a214-2.0.0       RSET    NOOP    QUIT    HELP    VRFY\x0d\x0a214-2.0.0       EXPN    VERB    ETRN    DSN     AUTH\x0d\x0a214-2.0.0       STARTTLS\x0d\x0a214-2.0.0 For more info use \"HELP <topic>\".\x0d\x0a214-2.0.0 For local information send email to Postmaster at your site.\x0d\x0a214 2.0.0 End of HELP info.\x0d\x0a",
                                EHLO     => "250-ENHANCEDSTATUSCODES\x0d\x0a250-8BITMIME\x0d\x0a250-SIZE\x0d\x0a250-DSN\x0d\x0a250-ONEX\x0d\x0a250-ETRN\x0d\x0a250-XUSR\x0d\x0a250 HELP\x0d\x0a",
                                );

                if (!defined ($commands[0]) or $commands[0] eq '') {
                        next;
                } elsif ($commands[0] =~ /^HELO$/) {
                        if($commands[1] eq '') {
                                print ($smtphash{HELOOUT});
                        } elsif ($commands[1] =~ /[\!\@\#\$\%\^&\*\(\)\|\\,>?\/\"\':;\{\}]/) {
                        print $smtphash{HELOERR};
                } else {
                        print $smtphash{HELOIN};
                        $saidhelo = 1;
                }

                } elsif ($commands[0] =~ /^HELP$|^RESET$|^NOOP$|^AUTH$|^STARTTLS$|^VRFY$|^EXPN$|^ETRN$|^RSET$/) {
                        print ($smtphash{$commands[0]});
                        sleep 1;
                } elsif ($commands[0] =~ /^EHLO$/) {

                        if($commands[1] eq '') {
                                print ($smtphash{EHLOOUT});
                        } else {
                                print ($smtphash{HELOIN});
                                print ($smtphash{EHLO});
                                $saidhelo = 1;
                        }

                } elsif ($commands[0] =~ /^QUIT$/) {
                        print $smtphash{QUIT};
                        return;
                } elsif ($commands[0] =~ /^MAIL$/) {

                        $maildata = $commands[2];

                        if ($commands[2] eq '') {
                                $maildata = $commands[1];
                                if ($commands[1] =~ m@.*from:<(.*)>@i) {
                                        $maildata = $1;
                                }
                        }

                        if ($saidhelo == 0) {
                                print $smtphash{BADHELO};
                        # Is there a space after from:
                        } elsif ($commands[1] =~ /from:/) {
                                if ($commands[2] =~ /\@/ || $commands[1] =~ /\@/) {
                                        $saidmail = 1;
                                        $smtphash{MAILTO} =~ s/MAILDATA/$maildata/g;
                                        print ($smtphash{MAILTO});
                                } else {
                                        $smtphash{MAILFROM} =~ s/MAILDATA/$maildata/g;
                                        print ($smtphash{MAILFROM});
                                }

                        } elsif ($saidhelo == 1) {
                                print ($smtphash{MAIL});
                        }
                } elsif ($commands[0] =~ /^RCPT$/) {
                        $maildata = $commands[2];

                        if ($commands[1] =~ /to:<(.*?)>/i || $commands[2] =~ /<(.*?)>/ ) {
                                $maildata = $1;
                        }

                        if ($saidmail == 0) {
                                print ($smtphash{BADRCPT});
                        } else {
                                # Is there a space after to:
                                if ($commands[1] =~ /to:/ && $maildata ne '') {
                                        print ("250 2.1.5 $maildata... Recipient ok\x0d\x0a");
                                } else {
                                        print ($smtphash{MAIL});
                                }
                        }
                } elsif ($commands[0] =~ /^DATA$/) {

                        if ($saidmail == 1) {
                                print ($smtphash{DATA});

                                while (<STDIN>) {
                                        last if /^\.\x0d$/;
                                }

                                print ($smtphash{DATAsent});
                        } else {
                                print ($smtphash{DATAERR});
                        }
                } else {
                        print ($smtphash{ERR});
                }
        }
 }

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

#!/usr/local/bin/perl -w

#!c:\perl\bin\perl.exe -w

# Created by hackmen and weazy at Interz0ne '02

# Released by Cybnet Security Group as freeware

# Date Last Modified: 10/15/2002 1437

# Abstract: Simulates and SMTP server in order to catch crackers and spammers.

# Notes for future development:

# need to add comments

# modularize the prog to accept unique SMTP distro specs to allow easy emulation

# create IP masquerading to simulate an entire network from the same prog

# legalz: modify and use at will, if you make any changes, improvements, updates or use the code

# in another project, please send us what you did and give credit

# if you have any questions, post them at forum.hackerthreads.net

# be sure to check out hackerthreads.org for updates and new tutorials/downloads

# Alter $host = to whatever hostname you want to simulate

use strict;

use Socket;

my $port = 25;

my $host = "admin.secure.fbi.gov";

my $smtpver = "Sendmail 8.11.3";

my $tcp = getprotobyname('tcp');

socket(Server, PF_INET, SOCK_STREAM, $tcp) or die "socket: $!";

setsockopt(Server, SOL_SOCKET, SO_REUSEADDR, pack("l", 1)) or die "setsockopt: $!";

bind(Server, sockaddr_in($port, INADDR_ANY)) or die "bind: $!";

listen(Server,SOMAXCONN) or die "listen: $!";

print STDERR ("\n");

logmsg ("server started on port ", $port, "\n\n");

my ( $addr,

@inetaddr

);

my $old_handle = select Client;

$| =1;

select $old_handle;

*STDOUT = *Client;

*STDIN = *Client;

while (1) {

$addr = accept(Client,Server);

my(undef, undef, $inetaddr) = unpack('S n a4 x8', $addr);

@inetaddr = unpack('C4', $inetaddr);

print STDERR ("\n\n");

logmsg ("incoming connection from: ", join(".", @inetaddr), "\n");

&READ ();

}

close Client;

sub logmsg {

print STDERR (scalar (localtime), ": ", $$, ": ", @_);

}

sub READ {

my $saidhelo = 0;

my $saidmail = 0;

my $maildata;

print ("220 ", $host, ' ', $smtpver, ' ', scalar (localtime), "\r\n");

while (1) {

my $commands = <STDIN>;

if (!defined ($commands)) {

return;

}

$commands =~ s/[\r\n]+|\s+$//g;

my @commands = split (/\s+/, $commands);

logmsg ($commands, "\n");

if (!defined $commands[1]) {

$commands[1] = '';

}

if (!defined $commands[2]) {

$commands[2] = '';

}

my %smtphash = ( AUTH => "503 AUTH mechanism not available.\x0d\x0a",

BADRCPT => "503 5.0.0 Need MAIL before RCPT\x0d\x0a",

BADHELO => "503 5.0.0 Polite people say HELO first\x0d\x0a",

DATA => "354 Enter mail, end with \"\.\" on a line by itself\x0d\x0a",

DATAerr => "503 5.0.0 Need MAIL command\x0d\x0a",

DATAsent => "250 2.0.0 g8684xUD014698 Message accepted for delivery\x0d\x0a",

EHLOOUT => "501 5.0.0 HELO requires domain address.\x0d\x0a",

ERR => "500 5.5.1 Command unrecognized: $commands\x0d\x0a",

ETRN => "500 5.5.2 Parameter required\x0d\x0a",

EXPN => "502 5.7.0 Sorry, we do not allow this operation.\x0d\x0a",

HELOERR => "501 5.0.0 Invalid domain name\x0d\x0a",

HELOOUT => "501 5.0.0 HELO requires domain address.\x0d\x0a",

HELOIN => "250 $host Hello $commands[1], pleased to meet you.\x0d\x0a",

MAILFROM => "553 5.5.4 MAILDATA... Domain name required for sender address MAILDATA\x0d\x0a",

MAILTO => "250 2.1.0 MAILDATA... Sender ok\x0d\x0a",

MAIL => "501 5.5.2 Syntax error in parameters scanning \"$commands[1]\"\x0d\x0a",

NOOP => "250 2.0.0 OK.\x0d\x0a",

QUIT => "220 2.0.0 $host closing connection..\x0d\x0a",

RCPTTO => "250 2.1.5 $commands[2]... Recipient ok\x0d\x0a",

RESET => "250 2.0.0 Reset state.\x0d\x0a",

RSET => "250 2.0.0 Reset state\x0d\x0a",

STARTTLS => "454 4.3.3 TLS not available after start..\x0d\x0a",

VRFY => "252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger).\x0d\x0a",

HELP => "214-2.0.0 Sendmail v8.4.3\x0d\x0a214-2.0.0 Topics:\x0d\x0a214-2.0.0 HELO EHLO MAIL RCPT DATA\x0d\x0a214-2.0.0 RSET NOOP QUIT HELP VRFY\x0d\x0a214-2.0.0 EXPN VERB ETRN DSN AUTH\x0d\x0a214-2.0.0 STARTTLS\x0d\x0a214-2.0.0 For more info use \"HELP <topic>\".\x0d\x0a214-2.0.0 For local information send email to Postmaster at your site.\x0d\x0a214 2.0.0 End of HELP info.\x0d\x0a",

EHLO => "250-ENHANCEDSTATUSCODES\x0d\x0a250-8BITMIME\x0d\x0a250-SIZE\x0d\x0a250-DSN\x0d\x0a250-ONEX\x0d\x0a250-ETRN\x0d\x0a250-XUSR\x0d\x0a250 HELP\x0d\x0a",

);

if (!defined ($commands[0]) or $commands[0] eq '') {

next;

} elsif ($commands[0] =~ /^HELO$/) {

if($commands[1] eq '') {

print ($smtphash{HELOOUT});

} elsif ($commands[1] =~ /[\!\@\#\$\%\^&\*\|\\,>?\/\"\':;\{\}]/) {

print $smtphash{HELOERR};

} else {

print $smtphash{HELOIN};

$saidhelo = 1;

}

} elsif ($commands[0] =~ /^HELP$|^RESET$|^NOOP$|^AUTH$|^STARTTLS$|^VRFY$|^EXPN$|^ETRN$|^RSET$/) {

print ($smtphash{$commands[0]});

sleep 1;

} elsif ($commands[0] =~ /^EHLO$/) {

if($commands[1] eq '') {

print ($smtphash{EHLOOUT});

} else {

print ($smtphash{HELOIN});

print ($smtphash{EHLO});

$saidhelo = 1;

}

} elsif ($commands[0] =~ /^QUIT$/) {

print $smtphash{QUIT};

return;

} elsif ($commands[0] =~ /^MAIL$/) {

$maildata = $commands[2];

if ($commands[2] eq '') {

$maildata = $commands[1];

if ($commands[1] =~ m@.*from:<(.*)>@i) {

$maildata = $1;

}

if ($saidhelo == 0) {

print $smtphash{BADHELO};

# Is there a space after from:

} elsif ($commands[1] =~ /from:/) {

if ($commands[2] =~ /\@/ || $commands[1] =~ /\@/) {

$saidmail = 1;

$smtphash{MAILTO} =~ s/MAILDATA/$maildata/g;

print ($smtphash{MAILTO});

} else {

$smtphash{MAILFROM} =~ s/MAILDATA/$maildata/g;

print ($smtphash{MAILFROM});

}

} elsif ($saidhelo == 1) {

print ($smtphash{MAIL});

}

} elsif ($commands[0] =~ /^RCPT$/) {

$maildata = $commands[2];

if ($commands[1] =~ /to:<(.*?)>/i || $commands[2] =~ /<(.*?)>/ ) {

$maildata = $1;

}

if ($saidmail == 0) {

print ($smtphash{BADRCPT});

} else {

# Is there a space after to:

if ($commands[1] =~ /to:/ && $maildata ne '') {

print ("250 2.1.5 $maildata... Recipient ok\x0d\x0a");

} else {

print ($smtphash{MAIL});

}

} elsif ($commands[0] =~ /^DATA$/) {

if ($saidmail == 1) {

print ($smtphash{DATA});

while (<STDIN>) {

last if /^\.\x0d$/;

}

print ($smtphash{DATAsent});

} else {

print ($smtphash{DATAERR});

}

} else {

print ($smtphash{ERR});

}

Posted in Python/Ruby/Perl | Tagged perl, smtp, 스푸핑, 정부기관, 허니팟 | Leave a comment

특정 경로이하 또는 파일에서 특정 문자열을 원하는 문자열로 변경하는 펄 스크립트

by apollo89 Posted on 2007년 7월 20일

특정 경로이하 또는 파일에서 특정 문자열을 원하는 문자열로 변경하는 펄 스크립트

#! /usr/bin/perl -w
# PERL Scripted by bando
# DATE : 20040805
# Mail : bando@bando.org
# MSN : bando@bando.org
# 특정 경로이하 또는 파일에서 특정 문자열을 원하는 문자열로 변경하는 펄 스크립트

if ( $#ARGV != 2 ) {

&Usage();

}


$Chan_path = $ARGV[0];
$Chan_ch = $ARGV[1];
$Chand_ch = $ARGV[2];
$total = 0;

if ( ! -e $Chan_path) {

print "$Chan_path 와 같은 파일이나 디렉토리는 없습니다!\n";
exit 1;

}

@arry = `grep "$Chan_ch" -l -r $Chan_path`;

foreach(0..$#arry) {

$arry[$_] =~ s/\&/\\&/g;
$arry[$_] =~ s/\(/\\(/g;
$arry[$_] =~ s/\)/\\)/g;
chomp($arry[$_]);
`perl -p -i -e 's/$Chan_ch/$Chand_ch/g' $arry[$_]`;
print "$arry[$_] : $Chan_ch => $Chand_ch [OK]\n";
$total++;

}


print "\nTOTAL : $total 개 변경됨!\n\n";

sub Usage {

print "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n";
print "사용법 : $0 [이 경로이하 또는 파일에서] [이 문자열을] [이 문자열로 변경]\n\n";
print "설명 : 일치하는 문자열을 특정 문자열로 변경한다.\n";
print "예제 : $0 /home localhost 127.0.0.1\n";
print "결과 : /home 디렉토리 이하의 모든 파일에서 localhost문자열을 127.0.0.1문자열로 변경한다.\n";
print "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n";
exit;

}

#! /usr/bin/perl -w

# PERL Scripted by bando

# DATE : 20040805

# Mail : bando@bando.org

# MSN : bando@bando.org

# 특정 경로이하 또는 파일에서 특정 문자열을 원하는 문자열로 변경하는 펄 스크립트

if ( $#ARGV != 2 ) {

&Usage();

}

$Chan_path = $ARGV[0];

$Chan_ch = $ARGV[1];

$Chand_ch = $ARGV[2];

$total = 0;

if ( ! -e $Chan_path) {

print "$Chan_path 와 같은 파일이나 디렉토리는 없습니다!\n";

exit 1;

}

@arry = `grep "$Chan_ch" -l -r $Chan_path`;

foreach(0..$#arry) {

$arry[$_] =~ s/\&/\\&/g;

$arry[$_] =~ s/\(/\\(/g;

$arry[$_] =~ s/\)/\\)/g;

chomp($arry[$_]);

`perl -p -i -e 's/$Chan_ch/$Chand_ch/g' $arry[$_]`;

print "$arry[$_] : $Chan_ch => $Chand_ch [OK]\n";

$total++;

}

print "\nTOTAL : $total 개 변경됨!\n\n";

sub Usage {

print "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n";

print "사용법 : $0 [이 경로이하 또는 파일에서] [이 문자열을] [이 문자열로 변경]\n\n";

print "설명 : 일치하는 문자열을 특정 문자열로 변경한다.\n";

print "예제 : $0 /home localhost 127.0.0.1\n";

print "결과 : /home 디렉토리 이하의 모든 파일에서 localhost문자열을 127.0.0.1문자열로 변경한다.\n";

print "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n";

exit;

}

Posted in Python/Ruby/Perl | Tagged perl, script, 문자열변경 | Leave a comment

find grep perl 을 이용한 변경

by apollo89 Posted on 2007년 6월 28일

find grep perl 을 이용한 변경 현재 폴더에서 word가 들어간 파일 찾기

find . -type f -print |xargs grep "word"

1	find . -type f -print \|xargs grep "word"

현재 폴더에서 파일에서 aaa가 를 bbb로 바꾸기

find . -type f -print |xargs perl -ei -p 's/aaa/bbb/gc'

1	find . -type f -print \|xargs perl -ei -p 's/aaa/bbb/gc'

Posted in System | Tagged find, grep, perl, xargs, 변경 | Leave a comment

Apollo89.com

아폴로씨의 잡다한 경험들..

Tag Archives: perl

스패머 유인용 smtp 용 허니팟

특정 경로이하 또는 파일에서 특정 문자열을 원하는 문자열로 변경하는 펄 스크립트

find grep perl 을 이용한 변경

카테고리

최신 댓글

메타