Port 25 (SMTP)

nc -vn <IP> 25
telnet <IP> 25

NMAP Scanning

sudo nmap 10.129.14.128 -sC -sV -p25

nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 {IP}

Open Relay

sudo nmap 10.129.14.128 -p25 --script smtp-open-relay -v

NTLM Auth - Information disclosure

If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info here.

root@kali: telnet example.com 587 
220 example.com SMTP Server Banner 
>> HELO 
250 example.com Hello [x.x.x.x] 
>> AUTH NTLM 334 
NTLM supported 
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= 
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwAD

Internal server name - Information disclosure

Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is issued without a full address, disclosing its internal name:

Username Bruteforce Enumeration

Authentication is not always needed

RCPT TO

VRFY

The command VRFY can be used to enumerate existing users on the system. However, this does not always work.

EXPN

Send e-mail

smtp-user-enum

PreviousPort 23 (DNS)NextPort 79 (finger)

Last updated