Skip to content

Commit

Permalink
SMTP responses fixed and random wait time added
Browse files Browse the repository at this point in the history
  • Loading branch information
@HashCode55
HashCode55 committed Mar 31, 2017
1 parent 088f6df commit b37aafd
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 51 deletions.
24 changes: 0 additions & 24 deletions app/server.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ import (
"os"
"os/signal"
"sync"
"syscall"

log "github.com/Sirupsen/logrus"
"github.com/mushorg/glutton"
Expand Down Expand Up @@ -49,29 +48,6 @@ func main() {

// Setting up the logger
logger := log.New()

<<<<<<< HEAD
// get the uid of the user
uid := syscall.Getuid()
if uid == 0 {
// process is running as root
logger.Info("[glutton ] The server is running as root. Dropping privilages to nobody...")
// drop the group privilages to nobody user
if err := syscall.Setgid(65534); err != nil {
logger.Fatal("Could not set group privilages. ", err)
} else {
logger.Info("[glutton ] Group privilages dropped.")
}
// drop the user privilages
if err := syscall.Setuid(65534); err != nil {
logger.Fatal("Could not set user privilages. ", err)
} else {
logger.Info("[glutton ] User privilages dropped.")
}
}

=======
>>>>>>> upstream/master
// Write log to file and stdout
f, err := os.OpenFile(*logPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
onErrorExit(err)
Expand Down
42 changes: 24 additions & 18 deletions smtp.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"math/rand"
"net"
"regexp"
"strings"
"time"
)

Expand All @@ -27,20 +28,23 @@ func (c *Client) r(g *Glutton) string {
return reply
}

func random(min, max int) int {
func rwait() {
// makes the process sleep for random time
rand.Seed(time.Now().Unix())
return rand.Intn(max-min) + min
// between 0.5 - 1.5 seconds
rtime := rand.Intn(1500) + 500
duration := time.Duration(rtime) * time.Millisecond
time.Sleep(duration)
}

func validateMail(query string) bool {
email := regexp.MustCompile("^MAIL FROM:<.+@.+>$\\r\\n") // naive regex
email := regexp.MustCompile("^MAIL FROM:<.+@.+>$") // naive regex
if email.MatchString(query) {
return true
}
return false
}
func validateRCPT(query string) bool {
rcpt := regexp.MustCompile("^RCPT TO:<.+@.+>$\\r\\n")
rcpt := regexp.MustCompile("^RCPT TO:<.+@.+>$")
if rcpt.MatchString(query) {
return true
}
Expand All @@ -55,29 +59,31 @@ func (g *Glutton) HandleSMTP(conn net.Conn) {
bufin: bufio.NewReader(conn),
bufout: bufio.NewWriter(conn),
}
rand := random(500, 3000) // random time between 0.5 and 3 seconds
duration := time.Duration(rand) * time.Millisecond

rwait()
client.w("220 Welcome!")
for {
query := client.r(g)
query := strings.Trim(client.r(g), "\r\n")
g.logger.Infof("[smtp ] Payload : %q", query)
s := strings.Split(query, " ")
if s[0] == "HELO" && len(s) == 2 {
client.w("250 Hello " + s[1] + "! Pleased to meet you.")
} else if s[0] == "MAIL" && validateMail() {
if strings.HasPrefix(query, "HELO ") {
rwait()
client.w("250 Hello! Pleased to meet you.")
} else if validateMail(query) {
rwait()
client.w("250 OK")
} else if s[0] == "RCPT" && validateRCPT() {
} else if validateRCPT(query) {
rwait()
client.w("250 OK")
} else if s[0] == "DATA" && len(s) == 1 {
} else if strings.Compare(query, "DATA") == 0 {
client.w("354 End data with <CRLF>.<CRLF>")
} else if s[0] == "QUIT" && len(s) == 1 {
for strings.Compare(client.r(g), ".\r\n") != 0 {
}
rwait()
client.w("250 OK")
} else if strings.Compare(query, "QUIT") == 0 {
client.w("Bye")
break
} else {
client.w("Recheck the command you entered.")
}
// wait for random time
time.Sleep(duration)
}
}
9 changes: 0 additions & 9 deletions telnet.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,18 +21,13 @@ import (
// Mirai botnet - https://github.com/CymmetriaResearch/MTPot/blob/master/mirai_conf.json
// Hajime botnet - https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf
var miraiCom = map[string][]string{
<<<<<<< HEAD
"ps": []string{"1 pts/21 00:00:00 init"},
"cat /proc/mounts": []string{"tmpfs /run tmpfs rw,nosuid,noexec,relatime,size=3231524k,mode=755 0 0"},
=======
"ps": []string{"1 pts/21 00:00:00 init"},
"cat /proc/mounts": []string{"rootfs / rootfs rw 0 0\r\n/dev/root / ext2 rw,relatime,errors=continue 0 0\r\nproc /proc proc rw,relatime 0 0\r\nsysfs /sys sysfs rw,relatime 0 0\r\nudev /dev tmpfs rw,relatime 0 0\r\ndevpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0\r\n/dev/mtdblock1 /home/hik jffs2 rw,relatime 0 0\r\ntmpfs /run tmpfs rw,nosuid,noexec,relatime,size=3231524k,mode=755 0 0\r\n"},
"(cat .s || cp /bin/echo .s)": []string{"cat: .s: No such file or directory"},
"nc": []string{"nc: command not found"},
"wget": []string{"wget: missing URL"},
"(dd bs=52 count=1 if=.s || cat .s)": []string{"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00\x01\x00\x00\x00\xbc\x14\x01\x00\x34\x00\x00\x00"},
"sh": []string{"$"},
>>>>>>> upstream/master
"echo -e \\x6b\\x61\\x6d\\x69/dev > /dev/.nippon": []string{""},
"cat /dev/.nippon": []string{"kami/dev"},
"rm /dev/.nippon": []string{""},
Expand All @@ -50,11 +45,7 @@ var miraiCom = map[string][]string{
"/bin/busybox rm /run/.nippon": []string{""},
"/bin/busybox cat /bin/sh": []string{""},
"/bin/busybox cat /bin/echo": []string{"/bin/busybox cat /bin/echo\r\n\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00\x01\x00\x00\x00\x6c\xb9\x00\x00\x34\x00\x00\x00"},
<<<<<<< HEAD
"rm /dev/.human": []string{"rm: can't remote '/.t': No such file or directory\r\nrm: can't remote '/.sh': No such file or directory\r\nrm: can't remote '/.human': No such file or directory\r\ncd /dev"},
=======
"rm /dev/.human": []string{"rm: can't remove '/.t': No such file or directory\r\nrm: can't remove '/.sh': No such file or directory\r\nrm: can't remove '/.human': No such file or directory\r\ncd /dev"},
>>>>>>> upstream/master
}

func writeMsg(conn net.Conn, msg string, g *Glutton) error {
Expand Down

0 comments on commit b37aafd

Please sign in to comment.