# 25, 465, 587 - SMTP
## Banner Grabbing
### **Telnet**
```sh
telnet 10.0.0.3 25
```
### **Netcat**
```sh
nc -n 10.0.0.3 25
```
### **Openssl (SMTPS)**
```sh
openssl s_client -starttls smtp -crlf -connect 10.0.0.3:587
```
Parameters
* `s_client`: SSL/TLS client program.
* `-starttls `: send the protocol-specific message(s) to switch to TLS for communication.
* `-crlf`: translate a line feed from the terminal into `CR+LF`.
## Enumeration
[**smtp-commands**](https://nmap.org/nsedoc/scripts/smtp-commands.html) **NSE Script**
```sh
nmap -p 25,465,587 --script smtp-commands 10.0.0.3
```
[**smtp-enum-users**](https://nmap.org/nsedoc/scripts/smtp-enum-users.html) **NSE Script**
```sh
nmap -p 25,465,587 --script smtp-enum-users 10.0.0.3
```
## NTLM Information Disclosure
On Windows, with NTLM authentication enabled, sending a SMTP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.
**Manually**
```sh
telnet example.com 587
...
>> HELO
250 example.com Hello [x.x.x.x]
>>AUTH NTLM 334
NTLM supported
>>TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA
```
[**smtp-ntlm-info**](https://nmap.org/nsedoc/scripts/smtp-ntlm-info.html) **NSE Script**
```sh
nmap -p 587 --script smtp-ntlm-info --script-args smtp-ntlm-info.domain=example.com 10.0.0.3
```
## Commands
```txt
HELO Identify to the SMTP server.
EHLO Alternative HELO for Extended SMTP protocol.
MAIL FROM: Sender's email address.
RCPT TO: Recipient's email address.
DATA Initiate message content transfer. Command is terminated with a line containing only a .
RSET Reset the session. Connection will not be closed.
VRFY Verify username or mailbox.
NOOP No-op. Keeps connection open.
QUIT Ends session.
```
Note: Sessions must start with HELO and end with QUIT.
## Configuration files
```
sendmail.cf
submit.cf
```
## Other
The following Python script opens a TCP socket, connects to the SMTP server, and issues a VRFY command for a given username:
```python
#!/usr/bin/python
import socket
import sys
if len(sys.argv) != 2:
print "Usage: vrfy.py "
sys.exit(0)
# Create a Socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# Connect to the Server
connect = s.connect(('10.11.1.217',25))
# Receive the banner
banner = s.recv(1024)
print banner
# VRFY a user
s.send('VRFY ' + sys.argv[1] + '\r\n')
result = s.recv(1024)
print result
# Close the socket
s.close()
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://oscp.nstsec.com/services-exploitation/25-465-587-smtp.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.