~/service-smtp

SMTP

CPTS Notes3 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. TL;DR
  2. Commands
  3. Enumeration
  4. Common misconfigurations
  5. Version exploits
  6. Attack playbook
  7. Practice boxes

TL;DR

SMTP (Simple Mail Transfer Protocol). Sends mail from a client to a server and between servers. TCP 25 (server to server), 587 (authenticated submission over STARTTLS), 465 (implicit TLS). Cleartext by default, so ESMTP adds STARTTLS and AUTH. POP3 (110/995) and IMAP (143/993) are the retrieval side, often on the same host.

First checks: the MTA and version from the banner, user enumeration, and open relay.

How mail moves is in The Mail Pipeline.

Commands

Command Does
EHLO / HELO Open the session. EHLO also lists the ESMTP features.
VRFY Check whether a user exists.
EXPN Expand a mailing list or alias.
MAIL FROM Set the sender.
RCPT TO Set the recipient.
DATA Start the message body.
AUTH Authenticate.
RSET / QUIT Reset the transaction / close the session.

Enumeration

Workflow: sweep with nmap, enumerate users with smtp-user-enum, interact with swaks.

Sweep.

sudo nmap -p25,465,587 -sV --script smtp-commands,smtp-open-relay,smtp-enum-users -oA scans/smtp $TARGET

smtp-commands lists supported commands (a VRFY in the output means user enumeration is likely). smtp-open-relay runs 16 relay tests.

Banner by hand.

nc -nv $TARGET 25

Send EHLO mail to list the ESMTP features.

Enumerate users.

smtp-user-enum -M RCPT -U users.txt -D $DOMAIN -t $TARGET

-M picks the method (VRFY, EXPN, or RCPT). -U is the username list. -D sets the domain for RCPT. -t is the target. RCPT is the most reliable, since many servers now disable VRFY and EXPN.

Interact with swaks. The scriptable SMTP client, for testing relay, sending, and auth:

swaks --to user@$DOMAIN --from test@$DOMAIN --server $TARGET

--auth with --au/--ap sends credentials. -tls forces STARTTLS.

Common misconfigurations

  • User enumeration via VRFY, EXPN, or RCPT.
  • Open relay: the server relays mail to external domains for any sender.
  • Submission allowed without authentication.
  • Cleartext AUTH without STARTTLS, so credentials are sniffable.

Version exploits

Read the MTA and version from the banner, then match.

  • Exim CVE-2019-10149 (“Return of the WIZard”): remote code execution through a crafted recipient. Metasploit exploit/linux/smtp/exim4_string_format.
  • Apache James 2.3.2: insecure deserialization for remote code execution after admin access (default root:root on port 4555).
  • Older Sendmail and Exim builds carry their own remote code execution flaws.

Attack playbook

SMTP is usually reconnaissance and delivery, not the target.

  1. Enumerate users. VRFY, EXPN, and RCPT return valid usernames. The usual SMTP win: feed them to password spraying on SMTP, SSH, and other services.
  2. Abuse an open relay. Send spoofed internal mail for phishing, such as a document carrying CVE-2017-0199. swaks delivers it.
  3. Spray credentials. With a user list and authentication enabled, spray one password across the users.
  4. Version exploit. Match the MTA version, then see Version exploits above.

Practice boxes

Box Difficulty SMTP’s role
SolidState Easy Apache James mail server: admin default creds reset mailboxes, read over POP3 for credentials.
Reel Hard SMTP user enumeration harvests addresses to phish with a CVE-2017-0199 document.

SMTP rarely falls on its own. The wins are valid usernames, a relay to phish through, or a vulnerable MTA version.