用三个包就可以触发SMTP的RST

original_method.txt

# source: http://blog.yegle.net/2012/05/01/email-and-tls/
# 从墙外向墙内SMTP服务器发起telnet连接
$ telnet mail.kingsoft.com 25
Trying 219.141.176.248...
Connected to telecom.mail.kingsoft.com.
Escape character is '^]'.
220 mail.kingsoft.com ESMTP
EHLO yegle.net
250-mail.kingsoft.com
250-8BITMIME
250 SIZE 20971520
MAIL FROM:我的邮箱地址@gmail.com
Connection closed by foreign host.

# 从墙内向墙外SMTP服务器发起telnet连接
$ telnet aspmx.l.google.com 25
Trying 209.85.225.27...
Connected to aspmx.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP u6si11379881igw.58
EHLO yegle.net
250-mx.google.com at your service, [183.151.34.162]
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250 ENHANCEDSTATUSCODES
MAIL FROM:<[email protected]>
250 2.1.0 OK u6si11379881igw.58
RCPT TO:<我的邮箱地址@gmail.com>
551 User not local; please try <forward-path>
Connection closed by foreign host.

trigger_smtp_tcp_rst.py

send(IP(dst=dst, src=src, id=ttl * 10 + 1, ttl=ttl) / TCP(sport=19840, dport=80, flags='S', seq=0))
send(IP(dst=dst, src=src, id=ttl * 10 + 2, ttl=ttl) / TCP(sport=19840, dport=80, seq=1, ack=100, flags='A')
send(IP(dst=dst, src=src, id=ttl * 10 + 3, ttl=ttl) / TCP(sport=19840, dport=80, seq=1, ack=100, flags='A') / Raw('MAIL FROM: [email protected]\r\n'))

# MAIL FROM can be RCPT TO as well
send(IP(dst=dst, src=src, id=ttl * 10 + 3, ttl=ttl) / TCP(sport=19840, dport=80, seq=1, ack=100, flags='A') / Raw('RCPT TO: [email protected]\r\n'))