Angle Brackets Broken in SMTP From Input

[rvillarreal-r7]

Thanks for reaching out! We're happy to help resolve issues as quickly as possible.

Please use this template when creating a new issue. If you do not follow this template format, your issue may be closed without comment.

Before filing a new issue, please use the search bar at the top of the browser to search for similar issues. Also, please make sure you have read our documentation, which covers how to use Gophish.

What version of Gophish are you using?: 0.11.0

Brief description of the issue: The angle brackets <> are breaking in parsing email addresses when sending to Gsuite

What are you expecting to see happen? : I expect the format for sending emails to be First Last email@domain.com

What are you seeing happen? When using First Last <email@domain.com> it returns a 555 5.5.2 Syntax error. If I remove the brackets and only use email@domain.com in the SMTP From field it works just fine.

Please provide any terminal output that may be relevant below:

I
time="2022-04-13T11:50:29-04:00" level=warning msg="555 5.5.2 Syntax error. n124-20020aca4082000000b002ecd08d8497sm13654592oia.5 - gsmtp" code=555 email="\"First Last\" <email@domain.com>"
time="2022-04-13T11:50:29-04:00" level=error msg="555 5.5.2 Syntax error. n124-20020aca4082000000b002ecd08d8497sm13654592oia.5 - gsmtp"
time="2022-04-13T11:50:29-04:00" level=info msg="127.0.0.1 - - [13/Apr/2022:11:50:29 -0400] \"POST /api/util/send_test_email HTTP/2.0\" 500 139 \"https://127.0.0.1:3333/sending_profiles\" \"Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\""

Please provide as many steps as you can to reproduce the problem:

• Step 1 - Insert First Last <email@domain.com>
• Step 2 - Send Test Email - Returns 550 syntax error

[rvillarreal-r7]

Update: Pulled down a pre-built release and it works fine. I didn't modify any code during the build process.

go version = go version go1.18 linux/amd64
git clone https://github.com/gophish/gophish.git
cd gophish
go build . 

[glennzw]

Hi @rvillarreal-r7 - thanks for reaching out. This looks like it might be a bug introduced by a recent PR: https://github.com/gophish/gophish/pull/2334

Could you help me reproduce this with the following:

• Does it only happen with GSuite? (have you tried with other providers)
• Are you using the above PR with the new sender envelope option
• Could you share a screenshot of your sending profile (and if you're using the new PR above the email template with the envelope sender)

I'll do my best to reproduce it on my side and figure out what's going wrong.

[rvillarreal-r7]

Thanks for reaching out!

1. I only have access to GSuite currently. Which makes sense why it's breaking with GSuite considering the 550 Syntax error is being returned from the gsmtp server.
2. I am not sure what the new sender envelope option is so I'm assuming I am not using it.

3. 

[glennzw]

Very odd. I was able to to send a Test email with a regular GMail account. Could you try that, just set up a regular free GMail account and see if you can send a test email? Then we can figure out if it's GSuite specifically that's causing the problem.

[bridge-four]

Can also confirm the angle brackets in the new "SMTP From" field does cause 501 error with Mailgun as an ESP. This can be avoided by only specifying the email (no brackets or alias). I'd recommend changing the placeholder text to just test@example.com to maybe play nicer with more ESPs.

[glennzw]

Thanks @bridge-four I can confirm the same behaviour after setting up a Mailgun account:

Now I need to figure out if this is a gophish issue or a Mailgun/GSuite restriction.

[glennzw]

I went down quite a rabbit hole. So this is a sample SMTP message that gophish sends when dispatching a test email:

EHLO foobar.com
AUTH LOGIN
d2h5YXJleW91bG9va2luZ0BteXVzZXJuYW1l
YW5kbXlwYXNzd29yZHB1bms=
MAIL FROM:<Bobby Phisher <bobby@internet.com>>
RCPT TO:<glenn@internet.com>
DATA
Mime-Version: 1.0
Date: Fri, 03 Jun 2022 15:09:41 +0100
From: "Bobby Phisher" <bphisher@internet.com>
X-Mailer: gophish
Subject: Default Email from Gophish
To: "Glenn Wilkinson" <glenn@internet.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

It works!

This is an email letting you know that your gophish
configuration was successful.
Here are the details:

Who you sent from: Bobby Phisher

Who you sent to:=20
 First Name: Glenn
 Last Name: Wilkinson
 Position: CEO

Now go send some phish!
.

The interesting part is the MAIL FROM::

MAIL FROM:<Bobby Phisher <bobby@internet.com>>

from my Sender set as:

...which I don't think is an acceptable input for that field (see RFC 5321 )with those double angle brackets.

But I guess a lot of mail servers are OK with that (either using the friendly name or just ignoring it). Given the double angle brackets I get the sense that, as @bridge-four suggested, this field is expecting just an email address and then the angle brackets are appended and pre-pended as part of the RFC spec, which is why we get this weird format here.

Well, long story short, I think I'll just change the example text to be test@example.com and the Mail Envelope can handle the sender name etc.

[glennzw]

Hnm, interestingly when dispatching a campaign (and not just a test email) the MAIL FROM: format is different (and correct):

MAIL FROM:<bphisher@internet.com>

[glennzw]

This might all have something to do with PR https://github.com/gophish/gophish/pull/2334

Thoughts, @ptitdoc and @ChessSpider?

[ptitdoc]

Something to do with the mail.parseAddress function?Le 3 juin 2022 17:05, Glenn Wilkinson @.***> a écrit : This might all have something to do with PR #2334 Thoughts, @ptitdoc and @ChessSpider?

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.***>

[gitmopp]

I might have a similar problem. In "Sending Profiles" the function "Send Test Email" returns:

level=warning msg="501 5.1.7 Invalid address" code=501 email="\"John Doe\" <john.doe@test.com>"
level=error msg="501 5.1.7 Invalid address"

When I send the email using the "Launch Campaign" it works, I see in the logs: level=info msg="Email sent" email="\"John Doe\" <john.doe@test.com>" envelope_from="\"GoPhish\" <test@test.com>" smtp_from=test@test.com

By the way in the "Sending Profiles" I cannot manually add "Custom Headers", nothing happens when I click the button.