# SMTP

Ports

```
25, 465, 587
```

Enumerating what commands are available to us

```
sudo nmap -p25 --script=smtp-commands 10.129.34.39
```

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2F5MpZ6RP7KRsauwYtAmrh%2Fimage.png?alt=media&#x26;token=d17f3f0f-4f69-494a-b644-2836a1df57b7" alt=""><figcaption></figcaption></figure>

Enumerating users

we can enumerate users if at least one of the following commands are enabled on the smtp server

* `VRFY`
* `RCPT TO`

MANUALLY

we can make use of `telnet` or `netcat` to establish a connection to the smtp server

```
telnet 10.129.34.39 25
Trying 10.129.34.39...
Connected to 10.129.34.39.
Escape character is '^]'.
220 Mail Service ready
HELO shrek123@shrek123.com
250 Hello.
MAIL FROM: <shrek123@shrek123>
250 OK
RCPT TO: <nico@megabank.com>
250 OK

```

* We can see we have identified a user on the smtp server <nico@megabank.com>
* if the user didn't exists we would smtp would have replied with&#x20;

```
550 unknown user
```

we can also utilize a script to automate the process

```
sudo perl /opt/smtp-user-enum/smtp-user-enum.pl -M RCPT -u nico@megabank.com -t 10.129.34.39
```

<figure><img src="https://3268621211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ0Egip1S9PA8zcUeKiqm%2Fuploads%2Fr3YTn46FQDxspnaGryGB%2Fimage.png?alt=media&#x26;token=3dec3dcb-bd29-4211-845b-b2ded56abf93" alt=""><figcaption></figcaption></figure>
