- Simple Mail Transport Protocol or SMTP
is used to send email.
Very common protocol.
There are encrypted methods for sending emails.
Today however, most mail servers
will still listen on TCP/25.
And you can connect to TCP/25.
You simply telnet, IP or host name, space 25
and you can start talking to an SMTP server.
There are several verbs or commands
that you can execute against an SMTP server
such as EXPN, VRFY, RCPT TO.
These three commands are listed specifically
because they can be used to determine
if a recipient is valid.
Now, it may or may not work these days.
Back in the late '90s, early 2000s,
quite a bit more common
to see execution of these verbs against mail servers
in order to validate the existence of a user account.
So if you did, for example, verify admin@example.com
then it could tell you that, yeah, it's true.
Now you have a username and you can, you know,
whatever, brute force, but you know the username.
We wanna call out a tool here, NetScanTools Pro
available over at netscantools.com.
It provides several features
for interacting with SMTP servers.
Take a look at that, play around with it.
You can actually learn a lot about the protocols
by looking at tools like this one.
Now, I wanted to give you an example
of how to spoof an email.
I don't believe we talk about it in this course
but it falls into this concept, to this discussion
of connecting to an SMTP server
and sending commands manually.
So we had the verify command, for example.
So in this example, I am connecting to an SMTP server
and I'm sending the valid commands
to send an email to a recipient.
So let's run through what's happening here on the screen.
Before we run through that though, I want to touch
on a point, and that is the security of email servers today
in the 2020s is quite a bit more advanced
than it was, you know, 10, 20 years ago.
Being able to do this, to spoof an email in this manner
while it still does work, you can still connect to port 25
or pretty much any email server out there,
there's gonna be protections there.
And we run into one of those protections here
at the end of this example.
So we'll talk about that when we get there.
So let's start off.
First thing we need to do
is determine the mail exchanger for the domain.
So I'm spoofing an email to a user@gmail.com.
So we have dig MX gmail.com.
Dig, we're gonna talk about here in about two slides.
It's used for querying DNS servers.
We need the MX record for the domain.
I run dig MX gmail.com and it returns to me
five valid mail exchangers for gmail.com.
It's up to the client which one to connect to.
In our example here, we are going to telnet
to the final record, the one with priority five.
We're gonna telnet to that name on port 25.
It does the DNS resolution, we see 77..27.
And right here, 220 MX ESMTP, GSMTP.
We're ready to go, it'll sit there waiting for input.
So we've opened a session to the SMTP service
and it's waiting for our input.
What command do you wanna execute?
We start off with the hello and then an identifier.
This identifier, in this case I use doe.com,
could be anything.
Next up, mail from and then we have colon
and a less than symbol and then the email address
where we are sending from, in this case, John@doe.com.
Next up is receipt two.
So this is who you are sending to.
Now, you'll notice that there's a black space there,
that's because there is an actual email address there
and I don't want to reveal that.
So receipt two, username@gmail.com.
And it says, OK, this is important right here.
So this OK that is indicated right here.
Also on mail from we have an OK.
It'll say syntax error in the case of Gmail
but various mail servers may say other things.
You're gonna wanna see that OK.
The various mail clients are looking for the OK
to move forward.
Next up we send the word data and hit enter.
Once we do that, the SMTP server is waiting
for the actual contents of the email.
If we're just sending plain text email,
we can simply start typing.
Now, you'll notice I send subject, colon, we need to talk.
So subject with some words after it
and then two carriage returns.
The TP server knows that that is the subject
and that is what will be displayed
in the subject line for the email.
Then we send the contents of our email.
Here, I just sent never mind.
We send a period on a line by itself.
That concludes the email
as far as the SMTP server is concerned.
Now, I do have this error here.
Our system has detected that this message is suspicious
due to very low reputation of the sending IP.
So I was sending this from my house
and I don't send very many emails from my house.
So low reputation, of course.
So they did not expect this.
So they are rate limiting me from sending future emails,
at least for a period of time,
until I can achieve a higher reputation.
Which I never will.
So this does work pretty much every email server out there.
Still listens on port 25.
You can talk to it and you can send commands.
You might hit some roadblocks along the way,
particularly if you're sending it from something
that is not trusted on the internet.
All right, next up domain name system enumeration.
So DNS is used for translating names to IP addresses.
Computers don't talk names, they talk numbers, right?
So when you type in google.com in your browser,
a request goes to a DNS server, gets translated to an IP,
your browser will then tell the operating system
I need to open a session to this IP.
And, you know, on down the stack it goes.
So DNS can be used to gather information as well.
You know, building up your playbook of your target.
Let's talk about DNS for a second.
So we already talked, it does the translation.
UDP port 53.
There's a concept within DNS called zone transfer
which is pretty hard to do these days.
Similar to SMTP, the ability is usually turned off
for running things like an SMDP verify.
You're probably not gonna see that enabled very often.
Similarly, zone transfers are usually disabled
as a means of security.
As I mentioned right here, zone transfer protected
in modern name servers, meaning it's turned off by default.
Here's an example of a zone transfer attempt.
The capability is there, it's defined in the RFCs
to be able to do zone transfers.
So the commands that are out there such as on Windows,
NS lookup, set type equal name server asdf.com.
We get the authoritative name server.
Switch to that name server with the server command.
Set type to any, and then ls -d asdf.com
will try to do a zone transfer.
You notice here, bad error value because most DNS servers
these days will turn that feature off.
Now, here's an example of doing it with dig.
Dig is a command for interacting with DNS servers
that you commonly see installed on Linux systems.
Dig stands for domain information groper, seriously.
This is a zone transfer attempt, so dig NS apple.com.
This will query for the authoritative name server
for apple.com.
We can see that NS is in server two.apple.com.
And then we can run the dig with the options
for a domain transfer.
So we have dig axfr@,
the at sign says I wanna send this request
directly to this server.
We're gonna send it to the authoritative name server
for apple.com and then give it the domain apple.com.
And we see here transfer failed.
So again, finding a DNS server today
that has zone transfer enabled is going to be difficult.
However, somewhere on the internet there's a DNS server
that's been up and running for 15, 20 years,
it's doing its job, no one ever looks at it,
and no one ever took the time to disable this functionality.
If you are able to do a zone transfer successfully,
there's a wealth of information in there.
Every A record is going to be listed.
That'll give you names of computers
and other relevant information about your target.
So attempt it.
You might not be successful, but give it a shot.
You might be surprised.