/usr/share/thpot/lib/pop3.pl is in tinyhoneypot 0.4.6-10.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | use POSIX qw(strftime);
sub pop3 {
%pop3hash = (
dele => "-ERR Incorrect command sequence\x0d\x0a",
list => "-ERR Incorrect command sequence\x0d\x0a",
noop => "-ERR Incorrect command sequence\x0d\x0a",
pass => "-ERR Unknown user or incorrect password\x0d\x0a",
quit => "+OK $hostname.$domain closing connection\x0d\x0a",
retr => "-ERR Incorrect command sequence\x0d\x0a",
rset => "-ERR Incorrect command sequence\x0d\x0a",
stat => "-ERR Incorrect command sequence\x0d\x0a",
top => "-ERR Incorrect command sequence\x0d\x0a",
user => "OK $commands[1] \x0d\x0a",
usernull => "-ERR Parameters required\x0d\x0a"
);
my $DATE = strftime "%a %b %e %H:%M:%S %Y", localtime;
chomp $DATE;
print STDERR "+OK $hostname.$domain $pop3ver, $DATE -0500 <20020904175615@$hostname.domain>\x0d\x0a\r";
while (my $commands = <STDIN>) {
open(LOG, ">>$sesslog");
print LOG $commands;
chomp $commands;
$commands =~ s/\r//;
@commands=split /\s+/,($commands);
if ($commands[0] =~ /dele|list|noop|retr|rset|stat|top/i) {
print STDERR $pop3hash{$commands[0]};
sleep 5;
}
elsif($commands[0] =~ /quit/i) {
print STDERR $pop3hash{quit};
return;
}
elsif($commands[0] =~ /pass/i) {
sleep 3;
print STDERR $pop3hash{pass};
}
elsif($commands[0] =~ /user/i) {
if($commands[1] eq ''){
print STDERR $pop3hash{usernull};
}
else{
print STDERR "OK $commands[1] \x0d\x0a";
# print STDERR $pop3hash{user};
}
}
else {
print STDERR "-ERR Command unrecognized: \"$commands\" \x0d\x0a";
}
}
close LOG;
}
|