smtp-pentest

name	smtp-pentest
description	Guides SMTP mail transfer service penetration testing. Use when port 25 or 587 is discovered during scanning or when SMTP is identified on a target.

SMTP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Phishing and external mail abuse: load initial-access-pentest.

Ports and detection

Port	Service
25/tcp	SMTP (plain or STARTTLS)
587/tcp	SMTP submission (STARTTLS)
465/tcp	SMTPS (implicit TLS)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 25
openssl s_client -starttls smtp -crlf -connect <target>:587
nmap -p25,587 --script smtp-commands,smtp-open-relay,smtp-enum-users <target>

Workflow

Task Progress:
- [ ] Banner and command enumeration
- [ ] VRFY/EXPN user enumeration
- [ ] Open relay testing
- [ ] SPF/DMARC/DKIM checks
- [ ] Exchange NTLM info disclosure
- [ ] Document findings

Command enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "THREADS": 5}
)

CLI fallback:

nmap -p25 --script smtp-commands <target>
telnet <target> 25
# EHLO test
# 250-VRFY, 250-EXPN, 250-AUTH, etc.

VRFY user enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_vrfy",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "USER_FILE": "/path/to/users.txt", "THREADS": 5}
)

CLI fallback:

telnet <target> 25
HELO test
VRFY root
VRFY admin
smtp-user-enum -M VRFY -U users.txt -t <target>
nmap --script smtp-enum-users -p 25 <target>

EXPN user enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "USER_FILE": "/path/to/users.txt", "THREADS": 5}
)

**CLI fallback:**
```bash
telnet <target> 25
HELO test
EXPN all
EXPN staff
EXPN administrators
smtp-user-enum -M EXPN -U users.txt -t <target>
# RCPT TO method when VRFY/EXPN disabled
MAIL FROM:[e-mail]
RCPT TO:admin
RCPT TO:test

Open relay testing

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_relay",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25, "MAILFROM": "[e-mail]", "MAILTO": "[e-mail]"}
)

CLI fallback:

nmap -p25 --script smtp-open-relay <target> -v
swaks --to [e-mail] --from [e-mail] --server <target>
swaks --to [e-mail] --from [e-mail] --server <target> --port 587 --tls

Exchange NTLM information disclosure

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smtp/smtp_ntlm_domain",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 25}
)

CLI fallback:

nmap -p25 --script smtp-ntlm-info <target>
# Manual AUTH NTLM after EHLO
telnet <target> 25
EHLO test
AUTH NTLM
# Send base64 Type 1 NTLM message; parse Type 2 for domain/computer name
python3 -c "import smtplib; s=smtplib.SMTP('<target>'); s.ehlo(); print(s.docmd('AUTH NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA='))"
# Internal hostname leak via incomplete MAIL FROM
MAIL FROM: me
# 250 [e-mail]... Sender OK

SPF / DMARC / DKIM checks

MSF: No direct module; use CLI.

CLI fallback:

dig +short txt <domain>                    # SPF
dig +short txt _dmarc.<domain>             # DMARC
dig +short txt default._domainkey.<domain> # DKIM
dig +short mx <domain>
# Parse SPF for weak mechanisms (~all, +all, no include)
# Parse DMARC for p=none (spoofing possible)
host -t TXT <domain>
nslookup -type=TXT _dmarc.<domain>

SMTP auth brute force

MSF: No direct SMTP auth brute module; use CLI.

CLI fallback:

hydra -L users.txt -P passwords.txt <target> smtp -S -u -t 4
swaks --auth LOGIN --auth-user [e-mail] --auth-password pass --server <target> --port 587 --tls

Email spoofing test

MSF: No direct module; use CLI.

CLI fallback:

swaks --to [e-mail] --from [e-mail] --server <target> --header "Subject: Test"
sendEmail -t [e-mail] -f [e-mail] -s <target> -u "Subject" -m "Body"

Only test domains in scope with ROE authorization.

Post-access

• Valid SMTP creds enable mail send for phishing (initial-access-pentest)
• Harvest internal hostnames from headers for further enumeration
• Relay access enables outbound mail from trusted IP

Related skills

• initial-access-pentest - phishing and external mail entry vectors
• dns-pentest - MX record discovery and SEG bypass via DNS