HackTricks HackTricks HackTricks Training

25,465,587 - Pentesting SMTP/s

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red
Team Expert)!

Instantly available setup for vulnerability assessment & penetration testing. Run a full
pentest from anywhere with 20+ tools & features that go from recon to reporting. We
don't replace pentesters - we develop custom tools, detection & exploitation modules to
give them back some time to dig deeper, pop shells, and have fun.
Pentest-Tools.com | 25+ Online Penetration Testing Tools
Pentest-Tools.com

Basic Information
The Simple Mail Transfer Protocol (SMTP) is a protocol utilized within the TCP/IP suite
for the sending and receiving of e-mail. Due to its limitations in queuing messages at
the recipient's end, SMTP is often employed alongside either POP3 or IMAP. These
additional protocols enable users to store messages on a server mailbox and to
periodically download them.
In practice, it is common for e-mail programs to employ SMTP for sending e-mails,
while utilizing POP3 or IMAP for receiving them. On systems based on Unix, sendmail
stands out as the SMTP server most frequently used for e-mail purposes. The
commercial package known as Sendmail encompasses a POP3 server. Furthermore,
Microsoft Exchange provides an SMTP server and offers the option to include POP3
support.
Default port: 25,465(ssl),587(ssl)
PORT STATE SERVICE REASON VERSION
25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959

EMAIL Headers
If you have the opportunity to make the victim send you a email (via contact form of the
web page for example), do it because you could learn about the internal topology of
the victim seeing the headers of the mail.
You can also get an email from a SMTP server trying to send to that server an email to a
non-existent address (because the server will send to the attacker a NDN mail). But, be
sure that you send the email from an allowed address (check the SPF policy) and that
you can receive NDN messages.
You should also try to send different contents because you can find more interesting
information on the headers like: X-Virus-Scanned: by av.domain.com
You should send the EICAR test file.
Detecting the AV may allow you to exploit known vulnerabilities.

Basic actions
Banner Grabbing/Basic connection
SMTP:
nc -vn <IP> 25

SMTPS:
openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls
openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587
Finding MX servers of an organisation
dig +short mx google.com

Enumeration
nmap -p25 --script smtp-commands 10.10.10.10
nmap -p25 --script smtp-open-relay 10.10.10.10 -v

NTLM Auth - Information disclosure

If the server supports NTLM auth (Windows) you can obtain sensitive info (versions).
More info here.
root@kali: telnet example.com 587
220 example.com SMTP Server Banner
>> HELO
250 example.com Hello [x.x.x.x]
>> AUTH NTLM 334
NTLM supported
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA

Or automate this with nmap plugin smtp-ntlm-info.nse

Internal server name - Information disclosure

Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is
issued without a full address, disclosing its internal name:
 220 somedomain.com Microsoft ESMTP MAIL Service, Version: Y.Y.Y.Y ready at We
EHLO all
250-somedomain.com Hello [x.x.x.x]
250-TURN
250-SIZE 52428800
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250 OK
MAIL FROM: me
250 2.1.0 me@PRODSERV01.somedomain.com....Sender OK

Sniffing
Check if you sniff some password from the packets to port 25

Auth bruteforce
Username Bruteforce Enumeration
Authentication is not always needed

RCPT TO
 $ telnet 1.1.1.1 25
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO x
250 myhost Hello 18.28.38.48, pleased to meet you
MAIL FROM:example@domain.com
250 2.1.0 example@domain.com... Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:admin
550 5.1.1 admin... User unknown
RCPT TO:ed
250 2.1.5 ed... Recipient ok

VRFY
$ telnet 1.1.1.1 25
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
250 myhost Hello 18.28.38.48, pleased to meet you
VRFY root
250 Super-User root@myhost
VRFY blah
550 blah... User unknown

EXPN
 $ telnet 1.1.1.1 25
Trying 1.1.1.1...
Connected to 1.1.1.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
EXPN test
550 5.1.1 test... User unknown
EXPN root
250 2.1.5 ed.williams@myhost
EXPN sshd
250 2.1.5 sshd privsep sshd@myhost

Automatic tools
Metasploit: auxiliary/scanner/smtp/smtp_enum
smtp-user-enum: smtp-user-enum -M <MODE> -u <USER> -t <IP>
Nmap: nmap --script smtp-enum-users <IP>

Instantly available setup for vulnerability assessment & penetration testing. Run a full
pentest from anywhere with 20+ tools & features that go from recon to reporting. We
don't replace pentesters - we develop custom tools, detection & exploitation modules to
give them back some time to dig deeper, pop shells, and have fun.
Pentest-Tools.com | 25+ Online Penetration Testing Tools
Pentest-Tools.com

DSN Reports
Delivery Status Notification Reports: If you send an email to an organisation to an
invalid address, the organisation will notify that the address was invalided sending a
mail back to you. Headers of the returned email will contain possible sensitive
information (like IP address of the mail services that interacted with the reports or anti-
virus software info).

Commands
Sending an Email from linux console
sendEmail -t to@domain.com -f from@attacker.com -s <ip smtp> -u "Important sub
Reading message body from STDIN because the '-m' option was not used.
If you are manually typing in a message:
- First line must be received within 60 seconds.
- End manual input with a CTRL-D on its own line.

<phishing message>

swaks --to $(cat emails | tr '\n' ',' | less) --from test@sneakymailer.htb --

Sending an Email with Python

Pyhton code here

SMTP Smuggling
SMTP Smuggling vulnerability allowed to bypass all the SMTP protections (check the
next section for more info about protections). For more info on SMTP Smuggling check:
PAGE
SMTP Smuggling

Mail Spoofing Countermeasures

Organizations are prevented from having unauthorized email sent on their behalf by
employing SPF, DKIM, and DMARC due to the ease of spoofing SMTP messages.
A complete guide to these countermeasures is made available at
https://seanthegeek.net/459/demystifying-dmarc/.

SPF
SPF was "deprecated" in 2014. This means that instead of creating a TXT record in
_spf.domain.com you create it in domain.com using the same syntax.
Moreover, to reuse previous spf records it's quiet common to find something like
"v=spf1 include:_spf.google.com ~all"

Sender Policy Framework (SPF) is a mechanism that enables Mail Transfer Agents
(MTAs) to verify whether a host sending an email is authorized by querying a list of
authorized mail servers defined by the organizations. This list, which specifies IP
addresses/ranges, domains, and other entities authorized to send email on behalf of a
domain name, includes various "Mechanisms" in the SPF record.
Mechanisms
From Wikipedia:
Mechanism Description
ALL Matches always; used for a default result like
-all for all IPs not matched by prior mechanisms.

A If the domain name has an address record (A or AAAA)

that can be resolved to the sender's address, it will match.
IP4 If the sender is in a given IPv4 address range, match.
IP6 If the sender is in a given IPv6 address range, match.
If the domain name has an MX record resolving to the
MX sender's address, it will match (i.e. the mail comes
from one of the domain's incoming mail servers).
PTR If the domain name (PTR record) for the client's address is
in the given domain and that domain name resolves to the
Mechanism Description
client's address (forward-confirmed reverse DNS), match. This mechanism is
discouraged and should be avoided, if possible.
If the given domain name resolves to any address, match (no matter
EXISTS the address it resolves to). This is rarely used. Along with the SPF
macro language it offers more complex matches like DNSBL-queries.
References the policy of another domain. If that domain's
INCLUDE policy passes, this mechanism passes. However, if the
included policy fails, processing continues. To fully delegate to
another domain's policy, the redirect extension must be used.
A redirect is a pointer to another domain name that hosts
an SPF policy, it allows for multiple domains to share the
REDIRECT same SPF policy. It is useful when working with a large
amount of domains that share the same email infrastructure.
It SPF policy of the domain indicated in the redirect Mechanism will be used.
It's also possible to identify Qualifiers that indicates what should be done if a
mechanism is matched. By default, the qualifier "+" is used (so if any mechanism is
matched, that means it's allowed).
You usually will note at the end of each SPF policy something like: ~all or -all. This is
used to indicate that if the sender doesn't match any SPF policy, you should tag the
email as untrusted (~) or reject (-) the email.
Qualifiers
Each mechanism within the policy may be prefixed by one of four qualifiers to define the
intended result:
+ : Corresponds to a PASS result. By default, mechanisms assume this qualifier,
making +mx equivalent to mx .
? : Represents a NEUTRAL result, treated similarly to NONE (no specific policy).

~ : Denotes SOFTFAIL, serving as a middle ground between NEUTRAL and FAIL.

Emails meeting this result are typically accepted but marked accordingly.
- : Indicates FAIL, suggesting that the email should be outright rejected.

In the upcoming example, the SPF policy of google.com is illustrated. Note the inclusion
of SPF policies from different domains within the first SPF policy:
 dig txt google.com | grep spf
google.com. 235 IN TXT "v=spf1 include:_spf.google.co

dig txt _spf.google.com | grep spf

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt _spf.google.com
;_spf.google.com. IN TXT
_spf.google.com. 235 IN TXT "v=spf1 include:_netblocks.goo

dig txt _netblocks.google.com | grep spf

_netblocks.google.com. 1606 IN TXT "v=spf1 ip4:35.190.247.0/24 ip

dig txt _netblocks2.google.com | grep spf

_netblocks2.google.com. 1908 IN TXT "v=spf1 ip6:2001:4860:4000::/3

dig txt _netblocks3.google.com | grep spf

_netblocks3.google.com. 1903 IN TXT "v=spf1 ip4:172.217.0.0/19 ip4

Traditionally it was possible to spoof any domain name that didn't have a correct/any
SPF record. Nowadays, if email comes from a domain without a valid SPF record is
probably going to be rejected/marked as untrusted automatically.
To check the SPF of a domain you can use online tools like:
https://www.kitterman.com/spf/validate.html

DKIM (DomainKeys Identified Mail)

DKIM is utilized to sign outbound emails, allowing their validation by external Mail
Transfer Agents (MTAs) through the retrieval of the domain's public key from DNS. This
public key is located in a domain's TXT record. To access this key, one must know both
the selector and the domain name.
For instance, to request the key, the domain name and selector are essential. These can
be found in the mail header DKIM-Signature , e.g., d=gmail.com;s=20120113 .
A command to fetch this information might look like:
dig 20120113._domainkey.gmail.com TXT | grep p=
# This command would return something like:
20120113._domainkey.gmail.com. 280 IN TXT "k=rsa\; p=MIIBIjANBgkqhkiG9w0B

DMARC (Domain-based Message Authentication,

Reporting & Conformance)
DMARC enhances email security by building on SPF and DKIM protocols. It outlines
policies that guide mail servers in the handling of emails from a specific domain,
including how to deal with authentication failures and where to send reports about email
processing actions.
To obtain the DMARC record, you need to query the subdomain _dmarc
# Reject
dig _dmarc.facebook.com txt | grep DMARC
_dmarc.facebook.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:a@dmar

# Quarantine
dig _dmarc.google.com txt | grep DMARC
_dmarc.google.com. 300 IN TXT "v=DMARC1; p=quarantine; rua=mailto:mailauth-r

# None
dig _dmarc.bing.com txt | grep DMARC
_dmarc.bing.com. 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:Bin

DMARC tags
Tag Name Purpose Sample
v Protocol version v=DMARC1

pct Percentage of messages pct=20

subjected to filtering

ruf Reporting URI for forensic reports ruf=mailto:authfail@example.c

om

rua Reporting URI of aggregate reports rua=mailto:aggrep@example.c

om
p Policy for organizational domain p=quarantine
sp Policy for subdomains of the OD sp=reject
adkim Alignment mode for DKIM adkim=s
aspf Alignment mode for SPF aspf=r

What about Subdomains?

From here.
You need to have separate SPF records for each subdomain you wish to send mail from.
The following was originally posted on openspf.org, which used to be a great resource
for this kind of thing.
The Demon Question: What about subdomains?
If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should
I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a
different customer, and each customer might have their own policy. It wouldn't make
sense for Demon's policy to apply to all its customers by default; if Demon wants to
do that, it can set up SPF records for each subdomain.
So the advice to SPF publishers is this: you should add an SPF record for each
subdomain or hostname that has an A or MX record.
Sites with wildcard A or MX records should also have a wildcard SPF record, of the
form: * IN TXT "v=spf1 -all"
This makes sense - a subdomain may very well be in a different geographical location
and have a very different SPF definition.

Open Relay
When emails are sent, ensuring they don't get flagged as spam is crucial. This is often
achieved through the use of a relay server that is trusted by the recipient. However, a
common challenge is that administrators might not be fully aware of which IP ranges are
safe to allow. This lack of understanding can lead to mistakes in setting up the SMTP
server, a risk frequently identified in security assessments.
A workaround that some administrators use to avoid email delivery issues, especially
concerning communications with potential or ongoing clients, is to allow connections
from any IP address. This is done by configuring the SMTP server's mynetworks
parameter to accept all IP addresses, as shown below:
mynetworks = 0.0.0.0/0

For checking whether a mail server is an open relay (which means it could forward email
from any external source), the nmap tool is commonly used. It includes a specific script
designed to test this. The command to conduct a verbose scan on a server (for example,
with IP 10.10.10.10) on port 25 using nmap is:
 nmap -p25 --script smtp-open-relay 10.10.10.10 -v

Tools
https://github.com/serain/mailspoof Check for SPF and DMARC misconfigurations
https://pypi.org/project/checkdmarc/ Automatically get SPF and DMARC configs

Send Spoof Email

https://www.mailsploit.com/index
http://www.anonymailer.net/
https://emkei.cz/
Or you could use a tool:
https://github.com/magichk/magicspoofing
# This will send a test email from test@victim.com to destination@gmail.com
python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com
# But you can also modify more options of the email
python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com --subject
 If you get any error using in the dkim python lib parsing the key feel free to use this
following one.
NOTE: This is just a dirty fix to do quick checks in cases where for some reason the openssl
private key cannot be parsed by dkim.
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDdkohAIWT6mXiHpfAHF8bv2vHTDboN2dl5pZKG5ZSHCYC5Z1bt
spr6chlrPUX71hfSkk8WxnJ1iC9Moa9sRzdjBrxPMjRDgP8p8AFdpugP5rJJXExO
pkZcdNPvCXGYNYD86Gpous6ubn6KhUWwDD1bw2UFu53nW/AK/EE4/jeraQIDAQAB
AoGAe31lrsht7TWH9aJISsu3torCaKyn23xlNuVO6xwdUb28Hpk327bFpXveKuS1
koxaLqQYrEriFBtYsU8T5Dc06FQAVLpUBOn+9PcKlxPBCLvUF+/KbfHF0q1QbeZR
fgr+E+fPxwVPxxk3i1AwCP4Cp1+bz2s58wZXlDBkWZ2YJwECQQD/f4bO2lnJz9Mq
1xsL3PqHlzIKh+W+yiGmQAELbgOdX4uCxMxjs5lwGSACMH2nUwXx+05RB8EM2m+j
ZBTeqxDxAkEA3gHyUtVenuTGClgYpiwefaTbGfYadh0z2KmiVcRqWzz3hDUEWxhc
GNtFT8wzLcmRHB4SQYUaS0Df9mpvwvdB+QJBALGv9Qci39L0j/15P7wOYMWvpwOf
422+kYxXcuKKDkWCTzoQt7yXCRzmvFYJdznJCZdymNLNu7q+p2lQjxsUiWECQQCI
Ms2FP91ywYs1oWJN39c84byBKtiFCdla3Ib48y0EmFyJQTVQ5ZrqrOrSz8W+G2Do
zRIKHCxLapt7w0SZabORAkEAxvm5pd2MNVqrqMJHbukHY1yBqwm5zVIYr75eiIDP
K9B7U1w0CJFUk6+4Qutr2ROqKtNOff9KuNRLAOiAzH3ZbQ==
-----END RSA PRIVATE KEY-----

Or you could do it manually:

PHP Python
# This will send an unsigned message
mail("your_email@gmail.com", "Test Subject!", "hey! This is a test", "From

More info
Find more information about these protections in
https://seanthegeek.net/459/demystifying-dmarc/

Other phishing indicators

Domain’s age
Links pointing to IP addresses
Link manipulation techniques
Suspicious (uncommon) attachments
 Broken email content
Values used that are different to those of the mail headers
Existence of a valid and trusted SSL certificate
Submission of the page to web content filtering sites

Exfiltration through SMTP

If you can send data via SMTP read this.

Config file
Postfix
Usually, if installed, in /etc/postfix/master.cf contains scripts to execute when for
example a new mail is receipted by a user. For example the line
flags=Rq user=mark argv=/etc/postfix/filtering-f ${sender} -- ${recipient}
means that /etc/postfix/filtering will be executed if a new mail is received by the
user mark.
Other config files:
sendmail.cf
submit.cf

References
https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-
their-value/
https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with
_misconfigured_smtp/

HackTricks Automatic Commands

Protocol_Name: SMTP #Protocol Abbreviation if there is one.
Port_Number: 25,465,587 #Comma separated if there is more than one.
Protocol_Description: Simple Mail Transfer Protocol #Protocol Abbrevi

Entry_1:
Name: Notes
Description: Notes for SMTP
Note: |
SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending

https://book.hacktricks.xyz/pentesting/pentesting-smtp

Entry_2:
Name: Banner Grab
Description: Grab SMTP Banner
Command: nc -vn {IP} 25

Entry_3:
Name: SMTP Vuln Scan
Description: SMTP Vuln Scan With Nmap
Command: nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,

Entry_4:
Name: SMTP User Enum
Description: Enumerate uses with smtp-user-enum
Command: smtp-user-enum -M VRFY -U {Big_Userlist} -t {IP}

Entry_5:
Name: SMTPS Connect
Description: Attempt to connect to SMTPS two different ways
Command: openssl s_client -crlf -connect {IP}:465 &&&& openssl s_client -sta

Entry_6:
Name: Find MX Servers
Description: Find MX servers of an organization
Command: dig +short mx {Domain_Name}

Entry_7:
Name: Hydra Brute Force
Description: Need Nothing
Command: hydra -P {Big_Passwordlist} {IP} smtp -V

Entry_8:
Name: consolesless mfs enumeration
Description: SMTP enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_version; set RHOS
Instantly available setup for vulnerability assessment & penetration testing. Run a full
pentest from anywhere with 20+ tools & features that go from recon to reporting. We
don't replace pentesters - we develop custom tools, detection & exploitation modules to
give them back some time to dig deeper, pop shells, and have fun.
Pentest-Tools.com | 25+ Online Penetration Testing Tools
Pentest-Tools.com

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red
Team Expert)!

Previous
23 - Pentesting Telnet
Next
SMTP Smuggling
Last updated 2 months ago