[prev in list] [next in list] [prev in thread] [next in thread] 

List:       nessus-plugins-writers
Subject:    Re: [Plugins-writers] W2k Esmtp disconnects from NASL script.
From:       "George A. Theall" <theall () tenablesecurity ! com>
Date:       2006-03-08 22:04:23
Message-ID: 440F54E7.6000608 () tenablesecurity ! com
[Download RAW message or body]

On Wed, Mar 08, 2006 at 11:25:38AM -0600, Steven W Smith wrote:

> # Reference 1
> data = recv(socket: soc, length: 2048, timeout:20);
> display(data);
> 
> # Reference 2
> send(socket:soc, data: string("HELO Mydomain.com"+'\n'));
> data = recv(socket: soc, length: 2048, timeout:20);
> display(data);
...
> Now, it works fine against a Sendmail server; however, when I run it 
> against an ESMTP server (Win 2K is the test server), the code acheives 
> "Reference 1" and displays the login banner.  When I get to "Reference 2", 
> the socket is as dead as a post.

Define "dead as a post". Has the socket been closed or do you just fail
to get a response from recv()?

> I can telnet to the server and issue the "HELO" just fine.  I can also 
> configure a client such as Evolution and it works perfectly.  When I 
> inspect the server log, I see that the NASL script's connection was 
> established followed by an immediate "QUIT" that I didn't send.  The
> "recv" following "Reference 2" times out and no data are displayed.

Have you verified what's actually sent with a packet dump? Do you have a
firewall in front of the Win 2K server that is filtering traffic to the
SMTP port?

> I don't know where to begin looking for a solution.

RFC 821 specifies that lines end with CR/LF. Assuming you're not leaving
out the linefeed on purpose, perhaps the creators of your SMTP server
didn't know about the old maxim about "be generous in what you accept".


George
-- 
theall@tenablesecurity.com
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers
[prev in list] [next in list] [prev in thread] [next in thread]