Rednote
GuidebooksTerminalCode
  • Welcome!
  • Utility
    • General
    • Server
    • Transferring File
      • Main
      • Code
      • Miscellaneous
    • Reverse & Bind Shells
      • Havoc
    • Metasploit
    • Service
      • FTP (21)
      • SSH (22)
      • DNS (53)
      • HTTP/HTTPS (80-443)
      • SMTP (25-465-587)
      • POP3 (110-995)
      • IMAP (143-993)
      • MySQL (3306)
      • MSSQL (1433-2433)
      • SMB (139-445)
      • RDP (3389)
      • WinRM (5985-5986)
      • WMI (135)
      • LLMNR & NBT-NS (5355-137)
      • NFS (111-2049)
      • SNMP (161-162)
      • VNC (5900)
      • Rsync (873)
      • R-Service (512-513-514)
      • IPMI (623)
      • Oracle TNS (1521)
  • Pentesting Process
    • Information Gathering
      • Passive
      • Active
      • OSINT
    • Vulnerability
    • Web Attacks
      • GENERAL
      • Crawling/Spidering & Fuzzing
      • Information Disclosure
      • Command Injection
      • Unrestricted File Upload
      • File Inclusion/Path Traversal
      • Request Smuggling
      • Clickjacking
      • Web Cache Poisoning
      • Web Cache Deception
      • Insecure Deserialization
      • Prototype Pollution
      • OAuth 2.0
      • JWT
      • SQLi
        • sqlmap
      • NoSQLi
      • GraphQL
      • XSS
      • SSRF
      • XXE
      • IDOR
      • API
      • SSTI
      • CSRF
      • CORS
      • AJP
      • SSI
      • ESI
      • XSLT
      • Cloud
      • LLM Prompt Security
    • Software Attacks
      • Binary
      • Shellcode
      • AV Evasion & Obfuscation
    • Network Attacks
      • ARP Poisoning
      • Local DNS Cache Poisoning
      • Baby Local DoS
    • Crypto Attacks
      • Utility
      • RSA
      • DSA/DSS
      • PRNG
        • LGC
        • MT
        • LFSR
    • Misc Attacks
    • Social Engineering
    • Password Cracking
      • Wordlist
      • Offline
      • Online
    • Pivoting & Tunneling
    • Local Enumeration
      • Linux
      • Windows
    • Privilege Escalation
      • Linux
        • Linux Privilege Escalation with Groups
        • Linux Privilege Escalation with Library
      • Windows
        • Windows Privilege Escalation with Groups and Privileges
        • Windows Privilege Escalation with DLL Hijacking
    • Active Directory
      • Enumeration
      • Abuse ACL
      • Extract Hash & Password
      • Pass The Hash
      • Pass The Ticket
      • Overpass the Hash
      • Relay Attack
      • Password Spraying Attack
      • AS-REP Roasting
      • Kerberoasting
      • Silver Ticket
      • Golden Ticket
      • DC Synchronization
      • AD Certificates
      • Attacking Domain Trusts
    • Reports
      • Bug Bounty Report
    • CVE
      • Linux
      • Windows
    • OTHER
      • CMS
        • WordPress
        • Joomla
        • Drupal
      • Tomcat
      • Jenkins
      • Splunk
      • Web Service
      • Navigating Python Objects
      • JavaScript Deobfuscation
  • Extra
    • My Books
    • My Exploits
    • Compiled Binaries
Powered by GitBook
On this page
  • Port
  • Config File
  • Interact
  • Attacks
  • User Discovery
  • Open Relay

Was this helpful?

  1. Utility
  2. Service

SMTP (25-465-587)

Simple Mail Transfer Protocol.

Last updated 3 months ago

Was this helpful?

Protocol Information

SMTP is a communication protocol used for the transmission of electronic mail. SMTP is often combined with or protocols, for email management.

Client (MUA) ➞ Submission Agent (MSA) ➞ Open Relay (MTA) ➞ Mail Delivery Agent (MDA) ➞ Mailbox (POP3/IMAP)

Port

25 TCP

SMTP (unencrypted)

465 TCP

SMTP (encrypted)

587 TCP

SMTP (encrypted)

Config File

  • /etc/postfix/main.cf

Interact

telnet <IP> <PORT>
nc <IP> <PORT>

.

Example
telnet <IP> <PORT>
> HELO mail1.inlanefreight.htb   # or EHLO inlanefreight.htb
> AUTH PLAIN 
> <OUTPUT>  # echo -ne '\0mail1.inlanefreight.htb\0<PASSWORD>' | base64
> MAIL FROM: <cry0l1t3@inlanefreight.htb>
> RCPT TO: <mrb3n@inlanefreight.htb> NOTIFY=success,failure
> DATA
> SUBJECT: Test message
> <MESSAGE>
> .
> QUIT

Attacks

User Discovery

The VRFY command causes the server to check whether or not a particular user exists and get the answer. The EXPN command is used with a mailing list and will list all users on that list. The RCPT TO command identifies the recipient of the e-mail message and can be repeated several times to list valid users.

Tools
Details

smtp-user-enum -M [VRFY,EXPN,RCPT] -U <WORDLIST> -t <IP> -w 60 [-D <DOMAIN> for RCPT]

Open Relay

An open relay is a mail server that is configured in such a way that it allows email to be sent to anyone, even unauthorized users, without any authentication control or limitation on access. In other words, it is an “open” mail server that accepts to forward email from external sources to recipients outside its domain. This configuration can be very problematic because it makes the server vulnerable to improper use, particularly by spammers and malicious attackers (phishing). These can exploit open relay to send huge amounts of unwanted email, hiding their identities and making it appear that the mail traffic is coming from the exploited server.

Check if it is an Open Relay

NMAP NSE: smtp-open-relay

Sending emails without authentication

swaks --from notifications@inlanefreight.com --to employees@inlanefreight.com --header 'Subject: Company Notification' --body 'Hi All, we want to hear from you! Please complete the following survey. http://mycustomphishinglink.com/' --server <IP>

IMAP
POP3
Commands and Response
smtp-user-enum