25, 465 - SMTP

Theory

Simple Mail Transfer Protocol is used to send e‐mails, and it uses TCP port 25. SMTP can be used over SSL using port 465.

Methodology

  • Check whether the server supports the VRFY command so we can enumerate users.

  • Check if there is a public exploit for the target server.

Practical

Nmap Basic Enumeration

nmap ‐sV ‐O ‐sC ‐p25 ‐T5 <IP>
Nmap Output

Nmap Advanced Enumeration

nmap -sV -O -p25 --script=smtp* -T5 <IP>
Nmap Output

Enumerate Users

Netcat

Use netcat to connect to the server and look for two users:

  • User gus, which doesn't exist

  • User root, which exists on the server

nc <IP> 25

VRFY gus

VRFY root
Netcat Output

Metasploit

msfconsole -q

use auxiliary/scanner/smtp/smtp_enum

set RHOSTS <IP>

run

Github Tool

python3 smtp-enum.py <IP>

REFERENCES

Previous23 - TelnetNext110, 143 - POP3, IMAP4

Last updated

Was this helpful?