# SMTP (Simple Mail Transfer Protocol) Pentesting

### Enumeration

```sh
nmap --script smtp-brute -p 25,465,587 <target-ip>
nmap --script smtp-commands -p 25,465,587 <target-ip>
nmap --script smtp-enum-users -p 25,465,587 <target-ip>
nmap --script smtp-ntlm-info --script-args smtp-ntlm-info.domain=example.com -p 25,465,587 <target-ip>
nmap --script smtp-vuln-cve2011-1764 -p 25,465,587 <target-ip>
nmap --script smtp-* -p 25,465,587 <target-ip>
```

#### MX Domains

```sh
dig mx example.com
```

#### Users

```sh
# VRFY - check if the user exists in the SMTP server
smtp-user-enum -M VRFY -u <username> -t <target-ip>
smtp-user-enum -M VRFY -U usernames.txt -t <target-ip>

# RCPT - check if the user is allowed to receive mails in the SMTP server
smtp-user-enum -M RCPT -u <username> -t <target-ip>
smtp-user-enum -M RCPT -U usernames.txt -t <target-ip>

# EXPN - reveal the actual email address
smtp-user-enum -M EXPN -u <username> -t <target-ip>
smtp-user-enum -M EXPN -D <hostname> -U usernames.txt -t <target-ip>
```

#### STARTTLS

```sh
# port 25
openssl s_client -starttls smtp -connect <target-ip>:25
# Port 465
openssl s_client -crlf -connect <target-ip>:465
# Port 587
openssl s_client -starttls smtp -crlf -connect <target-ip>:587
```

\\

### Connect

```sh
nc <target-ip> 25
# or
telnet <target-ip> 25
```

\\

### Commands

Commands are not case sensitive.

#### EHLO - list all supported enhanced functions

```sh
ehlo example.com
```

* **8BITMIME** - allow to send 8-bit data
* **AUTH** - authentication for the SMTP connection
* **CHUNKING** - transfer chunks of data
* **DSN (Delivery Status Notifications)** - notify delivery status
* **ENHANCEDSTATUSCODES** - allow to show more details of the status
* **ETRN** - process remote queue
* **EXPN** - expand mailing list
* **HELP** - help about commands
* **PIPELINING** - allow the multiple commands
* **SIZE** - maximum message size that can be received
* **SMTPUTF8** -
* **STARTTLS** - communicate with TLS
* **SEND** - send message to terminal
* **TURN** - swap client and server
* **VRFY** - check if the user exists in the SMTP server

#### Messages

```sh
# 1. check if the user exists
vrfy <username>
vrfy root

# 2. set the address of the mail sender
mail from: <username>
mail from: root
mail from: sender@example.com

# 3. set the address of the mail recipient
rcpt to: <username>
rcpt to: root
rcpt to: recipient@example.com

# 4. send data of message (the message end with ".")
data
subject: Test Mail
This is a test mail.
.
```

#### Others

```sh
# process remote queue
etrn example.com

# list the mailing list
expn example.com
```

\\

### Send Mails from External

[**swaks**](https://github.com/jetmore/swaks) is a swiss army knife for SMTP.

```sh
swaks --to remote-user@example.com --from local-user@<local-ip> --server mail.example.com --body "hello"
```

\\

### Start SMTP Server

```bash
# -n: No setuid
# -c: Classname
sudo python3 -m smtpd -n -c DebuggingServer 10.0.0.1:25
```
