25,465,587 - Pentesting SMTP/s
Instantly available setup for vulnerability assessment & penetration testing. Run a full pentest from anywhere with 20+ tools & features that go from recon to reporting. We don't replace pentesters - we develop custom tools, detection & exploitation modules to give them back some time to dig deeper, pop shells, and have fun.
Basic Information
The Simple Mail Transfer Protocol (SMTP) is a protocol utilized within the TCP/IP suite for the sending and receiving of e-mail. Due to its limitations in queuing messages at the recipient's end, SMTP is often employed alongside either POP3 or IMAP. These additional protocols enable users to store messages on a server mailbox and to periodically download them.
In practice, it is common for e-mail programs to employ SMTP for sending e-mails, while utilizing POP3 or IMAP for receiving them. On systems based on Unix, sendmail stands out as the SMTP server most frequently used for e-mail purposes. The commercial package known as Sendmail encompasses a POP3 server. Furthermore, Microsoft Exchange provides an SMTP server and offers the option to include POP3 support.
Default port: 25,465(ssl),587(ssl)
EMAIL Headers
If you have the opportunity to make the victim send you a email (via contact form of the web page for example), do it because you could learn about the internal topology of the victim seeing the headers of the mail.
You can also get an email from a SMTP server trying to send to that server an email to a non-existent address (because the server will send to the attacker a NDN mail). But, be sure that you send the email from an allowed address (check the SPF policy) and that you can receive NDN messages.
You should also try to send different contents because you can find more interesting information on the headers like: X-Virus-Scanned: by av.domain.com
You should send the EICAR test file.
Detecting the AV may allow you to exploit known vulnerabilities.
Basic actions
Banner Grabbing/Basic connection
SMTP:
SMTPS:
Finding MX servers of an organisation
Enumeration
NTLM Auth - Information disclosure
If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info here.
Or automate this with nmap plugin smtp-ntlm-info.nse
Internal server name - Information disclosure
Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is issued without a full address, disclosing its internal name:
Sniffing
Check if you sniff some password from the packets to port 25
Username Bruteforce Enumeration
Authentication is not always needed
RCPT TO
VRFY
EXPN
Automatic tools
Instantly available setup for vulnerability assessment & penetration testing. Run a full pentest from anywhere with 20+ tools & features that go from recon to reporting. We don't replace pentesters - we develop custom tools, detection & exploitation modules to give them back some time to dig deeper, pop shells, and have fun.
DSN Reports
Delivery Status Notification Reports: If you send an email to an organisation to an invalid address, the organisation will notify that the address was invalided sending a mail back to you. Headers of the returned email will contain possible sensitive information (like IP address of the mail services that interacted with the reports or anti-virus software info).
Sending an Email from linux console
Sending an Email with Python
SMTP Smuggling
SMTP Smuggling vulnerability allowed to bypass all the SMTP protections (check the next section for more info about protections). For more info on SMTP Smuggling check:
pageSMTP SmugglingMail Spoofing Countermeasures
Organizations are prevented from having unauthorized email sent on their behalf by employing SPF, DKIM, and DMARC due to the ease of spoofing SMTP messages.
A complete guide to these countermeasures is made available at https://seanthegeek.net/459/demystifying-dmarc/.
SPF
SPF was "deprecated" in 2014. This means that instead of creating a TXT record in _spf.domain.com you create it in domain.com using the same syntax.
Moreover, to reuse previous spf records it's quiet common to find something like "v=spf1 include:_spf.google.com ~all"
Sender Policy Framework (SPF) is a mechanism that enables Mail Transfer Agents (MTAs) to verify whether a host sending an email is authorized by querying a list of authorized mail servers defined by the organizations. This list, which specifies IP addresses/ranges, domains, and other entities authorized to send email on behalf of a domain name, includes various "Mechanisms" in the SPF record.
Mechanisms
From Wikipedia:
| Mechanism | Description |
|---|---|
ALL | Matches always; used for a default result like |
A | If the domain name has an address record (A or AAAA) that can be resolved to the sender's address, it will match. |
IP4 | If the sender is in a given IPv4 address range, match. |
IP6 | If the sender is in a given IPv6 address range, match. |
MX | If the domain name has an MX record resolving to the sender's address, it will match (i.e. the mail comes from one of the domain's incoming mail servers). |
PTR | If the domain name (PTR record) for the client's address is in the given domain and that domain name resolves to the client's address (forward-confirmed reverse DNS), match. This mechanism is discouraged and should be avoided, if possible. |
EXISTS | If the given domain name resolves to any address, match (no matter the address it resolves to). This is rarely used. Along with the SPF macro language it offers more complex matches like DNSBL-queries. |
INCLUDE | References the policy of another domain. If that domain's policy passes, this mechanism passes. However, if the included policy fails, processing continues. To fully delegate to another domain's policy, the redirect extension must be used. |
REDIRECT | A redirect is a pointer to another domain name that hosts an SPF policy, it allows for multiple domains to share the same SPF policy. It is useful when working with a large amount of domains that share the same email infrastructure. It SPF policy of the domain indicated in the redirect Mechanism will be used. |
It's also possible to identify Qualifiers that indicates what should be done if a mechanism is matched. By default, the qualifier "+" is used (so if any mechanism is matched, that means it's allowed). You usually will note at the end of each SPF policy something like: ~all or -all. This is used to indicate that if the sender doesn't match any SPF policy, you should tag the email as untrusted (~) or reject (-) the email.
Qualifiers
Each mechanism within the policy may be prefixed by one of four qualifiers to define the intended result:
+: Corresponds to a PASS result. By default, mechanisms assume this qualifier, making+mxequivalent tomx.?: Represents a NEUTRAL result, treated similarly to NONE (no specific policy).~: Denotes SOFTFAIL, serving as a middle ground between NEUTRAL and FAIL. Emails meeting this result are typically accepted but marked accordingly.-: Indicates FAIL, suggesting that the email should be outright rejected.
In the upcoming example, the SPF policy of google.com is illustrated. Note the inclusion of SPF policies from different domains within the first SPF policy:
Traditionally it was possible to spoof any domain name that didn't have a correct/any SPF record. Nowadays, if email comes from a domain without a valid SPF record is probably going to be rejected/marked as untrusted automatically.
To check the SPF of a domain you can use online tools like: https://www.kitterman.com/spf/validate.html
DKIM (DomainKeys Identified Mail)
DKIM is utilized to sign outbound emails, allowing their validation by external Mail Transfer Agents (MTAs) through the retrieval of the domain's public key from DNS. This public key is located in a domain's TXT record. To access this key, one must know both the selector and the domain name.
For instance, to request the key, the domain name and selector are essential. These can be found in the mail header DKIM-Signature, e.g., d=gmail.com;s=20120113.
A command to fetch this information might look like:
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC enhances email security by building on SPF and DKIM protocols. It outlines policies that guide mail servers in the handling of emails from a specific domain, including how to deal with authentication failures and where to send reports about email processing actions.
To obtain the DMARC record, you need to query the subdomain _dmarc
DMARC tags
| Tag Name | Purpose | Sample |
|---|---|---|
v | Protocol version | v=DMARC1 |
pct | Percentage of messages subjected to filtering | pct=20 |
ruf | Reporting URI for forensic reports | ruf=mailto:authfail@example.com |
rua | Reporting URI of aggregate reports | rua=mailto:aggrep@example.com |
p | Policy for organizational domain | p=quarantine |
sp | Policy for subdomains of the OD | sp=reject |
adkim | Alignment mode for DKIM | adkim=s |
aspf | Alignment mode for SPF | aspf=r |
What about Subdomains?
From here. You need to have separate SPF records for each subdomain you wish to send mail from. The following was originally posted on openspf.org, which used to be a great resource for this kind of thing.
The Demon Question: What about subdomains?
If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain.
So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record.
Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: * IN TXT "v=spf1 -all"
This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.
Open Relay
When emails are sent, ensuring they don't get flagged as spam is crucial. This is often achieved through the use of a relay server that is trusted by the recipient. However, a common challenge is that administrators might not be fully aware of which IP ranges are safe to allow. This lack of understanding can lead to mistakes in setting up the SMTP server, a risk frequently identified in security assessments.
A workaround that some administrators use to avoid email delivery issues, especially concerning communications with potential or ongoing clients, is to allow connections from any IP address. This is done by configuring the SMTP server's mynetworks parameter to accept all IP addresses, as shown below:
For checking whether a mail server is an open relay (which means it could forward email from any external source), the nmap tool is commonly used. It includes a specific script designed to test this. The command to conduct a verbose scan on a server (for example, with IP 10.10.10.10) on port 25 using nmap is:
Tools
https://github.com/serain/mailspoof Check for SPF and DMARC misconfigurations
https://pypi.org/project/checkdmarc/ Automatically get SPF and DMARC configs
Send Spoof Email
Or you could use a tool:
If you get any error using in the dkim python lib parsing the key feel free to use this following one. NOTE: This is just a dirty fix to do quick checks in cases where for some reason the openssl private key cannot be parsed by dkim.
Or you could do it manually:
More info
Find more information about these protections in https://seanthegeek.net/459/demystifying-dmarc/
Other phishing indicators
Domain’s age
Links pointing to IP addresses
Link manipulation techniques
Suspicious (uncommon) attachments
Broken email content
Values used that are different to those of the mail headers
Existence of a valid and trusted SSL certificate
Submission of the page to web content filtering sites
Exfiltration through SMTP
If you can send data via SMTP read this.
Config file
Postfix
Usually, if installed, in /etc/postfix/master.cf contains scripts to execute when for example a new mail is receipted by a user. For example the line flags=Rq user=mark argv=/etc/postfix/filtering-f ${sender} -- ${recipient} means that /etc/postfix/filtering will be executed if a new mail is received by the user mark.
Other config files:
References
HackTricks Automatic Commands
Instantly available setup for vulnerability assessment & penetration testing. Run a full pentest from anywhere with 20+ tools & features that go from recon to reporting. We don't replace pentesters - we develop custom tools, detection & exploitation modules to give them back some time to dig deeper, pop shells, and have fun.
Last updated
