SMTP Pentesting Best Practices

SMTP

SMTP usually uses ports 25, 465, 587, 2525, 2526

What is SMTP?

SMTP, which stands for Simple Mail Transfer Protocol, is an email protocol used for sending email messages from one email account to another via the internet.

Email protocols are sets of rules that let different email clients and accounts easily exchange information, and SMTP is one of the most common ones alongside POP and IMAP. It is also the only dedicated protocol for sending emails. Most email clients—including Outlook, Apple Mail, Gmail, and Yahoo Mail—rely on SMTP to “push” or send messages from a sender to a recipient.

PORT     STATE SERVICE               VERSION
25/tcp   open  smtp

Sender Policy Framework (SPF)

Sender Policy Framework (SPF) provides a mechanism that allows MTAs to check if a host sending an email is authorized.

Then, the organisations can define a list of authorised mail servers and the MTAs can query for this lists to check if the email was spoofed or not.

In order to define IP addresses/ranges, domains and others that are allowed to send email on behalf a domain name, different “Mechanism” cam appear in the SPF registry.

It SPF policy of the domain indicated in the redirect Mechanism will be used.

It’s also possible to identify Qualifiers that indicates what should be done if a mechanism is matched. By default, the qualifier “+” is used (so if any mechanism is matched, that means it’s allowed).

You usually will note at the end of each SPF policy something like: ~all or -all. This is used to indicate that if the sender doesn’t match any SPF policy, you should tag the email as untrusted (~) or reject (-) the email.

Qualifiers

Each mechanism can be combined with one of four qualifiers:

• + for a PASS result. This can be omitted; e.g., +mx is the same as mx.
• ? for a NEUTRAL result interpreted like NONE (no policy).
• ~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.
• - (minus) for FAIL, the mail should be rejected (see below).

In the following example you can read the SPF policy of google.com. Note how the first SPF policy includes SPF policies of other domains:

kali@kali:~$ dig txt google.com | grep spf
google.com.             235     IN      TXT     "v=spf1 include:_spf.google.com ~all"

kali@kali:~$ dig txt _spf.google.com | grep spf
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt _spf.google.com
;_spf.google.com.               IN      TXT
_spf.google.com.        235     IN      TXT     "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"

kali@kali:~$ dig txt _netblocks.google.com | grep spf
_netblocks.google.com.  1606    IN      TXT     "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"

kali@kali:~$ dig txt _netblocks2.google.com | grep spf
_netblocks2.google.com. 1908    IN      TXT     "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"

kali@kali:~$ dig txt _netblocks3.google.com | grep spf
_netblocks3.google.com. 1903    IN      TXT     "v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all"

Traditionally it was possible to spoof any domain name that didn’t have a correct/any SPF record. Nowadays, if email comes from a domain without a valid SPF record is probably going to be rejected/marked as untrusted automatically.

To check the SPF of a domain you can use online tools like: https://www.kitterman.com/spf/validate.html

DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM) is a mechanism by which outbound email is signed and validated by foreign MTAs upon retrieving a domain’s public key via DNS. The DKIM public key is held within a TXT record for a domain; however, you must know both the selector and domain name to retrieve it.

Then, to ask for the key you need the domain name and the selector of the mail from the mail header DKIM-Signature for example: d=gmail.com;s=20120113

dig 20120113._domainkey.gmail.com TXT | grep p=
20120113._domainkey.gmail.com. 280 IN   TXT    "k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg
KCAQEA1Kd87/UeJjenpabgbFwh+eBCsSTrqmwIYYvywlbhbqoo2DymndFkbjOVIPIldNs/m40KF+yzMn1skyoxcTUGCQs8g3

DMARC

Domain-based Message Authentication, Reporting & Conformance (DMARC) is a method of mail authentication that expands upon SPF and DKIM. Policies instruct mail servers how to process email for a given domain and report upon actions performed.

To obtain the DMARC record, you need to query the subdomain _dmarc

root@kali:~# dig _dmarc.yahoo.com txt | grep DMARC
_dmarc.yahoo.com.  1785 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\; 
rua=mailto:dmarc-yahoo-rua@yahoo-inc.com, mailto:dmarc_y_rua@yahoo.com\;"

root@kali:~# dig _dmarc.google.com txt | grep DMARC
_dmarc.google.com. 600 IN TXT "v=DMARC1\; p=quarantine\; rua=mailto:mailauth-reports@google.com"

root@kali:~# dig _dmarc.paypal.com txt | grep DMARC
_dmarc.paypal.com. 300 IN TXT "v=DMARC1\; p=reject\; rua=mailto:d@rua.agari.com\; 
ruf=mailto:dk@bounce.paypal.com,mailto:d@ruf.agari.com"

PayPal and Yahoo instruct mail servers to reject messages that contain invalid DKIM signatures or do not originate from their networks. Notifications are then sent to the respective email addresses within each organization. Google is configured in a similar way, although it instructs mail servers to quarantine messages and not outright reject them.

DMARC tags

Tag Name	Purpose	Sample
v	Protocol version	v=DMARC1
pct	Percentage of messages subjected to filtering	pct=20
ruf	Reporting URI for forensic reports	ruf=mailto:authfail@example.com
rua	Reporting URI of aggregate reports	rua=mailto:aggrep@example.com
p	Policy for organizational domain	p=quarantine
sp	Policy for subdomains of the OD	sp=reject
adkimadkim	Alignment mode for DKIM	adkim=s
aspf	Alignment mode for SPF	aspf=r

Subdomains

You need to have separate SPF records for each subdomain you wish to send mail from.

The following was originally posted on openspf.org, which used to be a great resource for this kind of thing.

This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.**

• https://github.com/serain/mailspoof Check for SPF and DMARC misconfigurations
• https://pypi.org/project/checkdmarc/ Automatically get SPF and DMARC configs

Check Spoofing

You can use the online tool http://www.anonymailer.net/ to send you an email spoofing an address and check if reaches you email.**

Other phishing indicators

• Domain’s age
• Links pointing to IP addresses
• Link manipulation techniques
• Suspicious (uncommon) attachments
• Broken email content
• Values used that are different to those of the mail headers
• Existence of a valid and trusted SSL certificate
• Submission of the page to web content filtering sites

Simple SMTP Commands

#HELO
It’s the first SMTP command: is starts the conversation identifying the sender server and is generally followed by its domain name.
#EHLO
An alternative command to start the conversation, underlying that the server is using the Extended SMTP protocol.
#MAIL FROM
With this SMTP command the operations begin: the sender states the source email address in the “From” field and actually starts the email transfer.
#RCPT TO
It identifies the recipient of the email; if there are more than one, the command is simply repeated address by address.
#SIZE
This SMTP command informs the remote server about the estimated size (in terms of bytes) of the attached email. It can also be used to report the maximum size of a message to be accepted by the server.
#DATA
With the DATA command the email content begins to be transferred; it’s generally followed by a 354 reply code given by the server, giving the permission to start the actual transmission.
#VRFY
The server is asked to verify whether a particular email address or username actually exists.
#TURN
This command is used to invert roles between the client and the server, without the need to run a new connaction.
#AUTH
With the AUTH command, the client authenticates itself to the server, giving its username and password. It’s another layer of security to guarantee a proper transmission.
#RSET
It communicates the server that the ongoing email transmission is going to be terminated, though the SMTP conversation won’t be closed (like in the case of QUIT).
#EXPN
This SMTP command asks for a confirmation about the identification of a mailing list.
#HELP
It’s a client’s request for some information that can be useful for the a successful transfer of the email.
#QUIT
It terminates the SMTP conversation.

SMTP Pentesting

Shodan search query :
port:25,465,587,2525,2526

Information Gathering

#Banner Grabbing
PORT   STATE SERVICE REASON  VERSION
25/tcp open  smtp    syn-ack Microsoft ESMTP 6.0.3790.3959

Basic Connection

#SMTP
nc -vn <IP> 25

#SMTPS
openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls command
openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587

Finding MX servers of an organisation

dig +short mx google.com

Finding SMTP Commands

nmap -p25 --script smtp-commands 10.10.10.10

NTLM Auth - Information disclosure

If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info here.

root@kali: telnet example.com 587 
220 example.com SMTP Server Banner 
>> HELO 
250 example.com Hello [x.x.x.x] 
>> AUTH NTLM 334 
NTLM supported 
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= 
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA

Or automate this with nmap plugin smtp-ntlm-info.nse

Sniffing

Check if you sniff some password from the packets to port 25

Credentials

Authentication Bruteforcing

hydra -l root -P passwords.txt [-t 32] <IP> ssh
ncrack -p 22 --user root -P passwords.txt <IP> [-T 5]
medusa -u root -P 500-worst-passwords.txt -h <IP> -M ssh

Enumeration Username With Bruteforce

smtp-user-enum -M VRFY -U users.txt -t <IP>

Example smtp-user-enum.pl output for ‘VRFY’ command.

Authentication is not always needed

RCPT TO

$ telnet 10.0.10.1 25
Trying 10.0.10.1...
Connected to 10.0.10.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO x
250 myhost Hello [10.0.0.99], pleased to meet you
MAIL FROM:test@test.org
250 2.1.0 test@test.org... Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:admin
550 5.1.1 admin... User unknown
RCPT TO:ed
250 2.1.5 ed... Recipient ok

VRFY

$ telnet 10.0.0.1 25
Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
250 myhost Hello [10.0.0.99], pleased to meet you
VRFY root
250 Super-User <root@myhost>
VRFY blah
550 blah... User unknown

EXPN

$ telnet 10.0.10.1 25
Trying 10.0.10.1...
Connected to 10.0.10.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
EXPN test
550 5.1.1 test... User unknown
EXPN root
250 2.1.5 <ed.williams@myhost>
EXPN sshd
250 2.1.5 sshd privsep <sshd@mail2>

Another technique

msf > use auxiliary/scanner/smtp/smtp_enum
smtp-user-enum: smtp-user-enum -M <MODE> -u <USER> -t <IP>
nmap --script smtp-enum-users <IP>

SMTP Spoofing

Most of this section was extracted from the book Network Security Assessment 3rd Edition.

SMTP messages are easily spoofed, and so organizations use SPF, DKIM, and DMARC features to prevent parties from sending unauthorised email.

A complete guide of these countermeasures can be found in https://seanthegeek.net/459/demystifying-dmarc/

If you can send data via SMTP read this.