""ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool""

SID: 2049923

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2024_01_05, deployment Perimeter, confidence High, signature_severity Critical, tag Exploit, updated_at 2024_01_05

Reference:

  • cve

  • 2023-51765

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "From|3a 20|setup|5f|check|40|"

  • Value: "To|3a 20|"

  • Value: "Subject|3a 20|SETUP|20|CHECK"

  • Value: "Date|3a 20|"

  • Value: "Message|2d|ID|3a 20|"

  • Value: "Your setup seems to be working! You can now proceed with smuggling tests!"

Within:

PCRE:

Special Options:

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • fast_pattern

source