SMTP Enumeration
We can also gather information about a host
or network from vulnerable mail servers.
SMTP supports several interesting commands,
such as VRFY and EXPN.
A VRFY request asks the server to verify an email address,
while EXPN asks the server for the membership of a mailing list.
These can often be abused to verify existing users on a mail server,
which is useful information during a penetration test.
We can observe how the success and error messages differ.
The SMTP server readily verifies that the user exists.
This procedure can be used to help guess valid usernames in an automated fashion.
Next,
let’s consider the following Python script,
which opens a TCP socket,
connects to the SMTP server,
and issues a VRFY command for a given username:
We can run the script by providing the username to be tested as a first argument,
and the target IP as a second argument.
Similarly,
we can obtain SMTP information about our target
from the Windows 11 client, as we did previously:
Unfortunately, with Test-NetConnection
we are prevented from fully interacting with the SMTP service.
Alternatively, if not already enabled,
we can install the Microsoft version of the Telnet client.
We should note that installing Telnet requires administrative privileges,
which could present challenges if we are running as a low-privilege user.
Once we have enabled Telnet on the testing machine,
we can connect to the target machine and perform enumeration as we did from Kali.
The output depicts yet another example of enumeration
that we can perform from a compromised Windows host
when Kali is not available.