rapid7/metasploit-framework — pull request #2928 by xistence (2014-01-29 06:50:55+00:00)
Title: Added Extended SMTP Open Relay aux module

This auxiliary module will do more extended tests for an open SMTP relay. This is done by using configuration or old mailserver design flaws.
The existing "smtp_relay" auxiliary module only tests for a simple MAIL FROM: / MAIL TO: relay. This module will test for 16 different types of relaying.

The idea for the module is based on the NMAP smtp-open-relay NSE script which can be found on https://svn.nmap.org/nmap/scripts/smtp-open-relay.nse

msf > use auxiliary/scanner/smtp/smtp_relay_ext
msf auxiliary(smtp_relay_ext) > set RHOSTS 192.168.0.123
RHOSTS => 192.168.0.123
msf auxiliary(smtp_relay_ext) > run

[*] 192.168.0.123:25 - SMTP 220 mail.mymailserver.com ESMTP\x0d\x0a
[*] 192.168.0.123:25 - Test #1 - No relay detected
[*] 192.168.0.123:25 - Test #2 - No relay detected
[*] 192.168.0.123:25 - Test #3 - No relay detected
[+] 192.168.0.123:25 - Test #4 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[+] 192.168.0.123:25 - Test #5 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[+] 192.168.0.123:25 - Test #6 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[*] 192.168.0.123:25 - Test #7 - No relay detected
[+] 192.168.0.123:25 - Test #8 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:<"human%ahhhzombies111.net">
[+] 192.168.0.123:25 - Test #9 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[+] 192.168.0.123:25 - Test #10 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:<"human@ahhhzombies111.net"@[192.168.0.123]>
[+] 192.168.0.123:25 - Test #11 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[*] 192.168.0.123:25 - Test #12 - No relay detected
[*] 192.168.0.123:25 - Test #13 - No relay detected
[+] 192.168.0.123:25 - Test #14 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[+] 192.168.0.123:25 - Test #15 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[+] 192.168.0.123:25 - Test #16 - Potential open SMTP relay detected: - MAIL FROM: -> RCPT TO:
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed