Penetration Testing with Kali Linux OffSec

python3 smtp.py root 192.168.50.8
b'220 mail ESMTP Postfix (Ubuntu)\r\n' 
b'252 2.0.0 root\r\n' 
kali@kali:~/Desktop$ 
python3 smtp.py johndoe 192.168.50.8
b'220 mail ESMTP Postfix (Ubuntu)\r\n' 
b'550 5.1.1 : Recipient address rejected: User unknown in local recipient 
table\r\n' 
Listing 80 - Running the Python script to perform SMTP user enumeration 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
157 
Similarly, we can obtain SMTP information about our target from the Windows 11 client, as we 
did previously: 
PS C:\Users\student> 
Test-NetConnection -Port 25 192.168.50.8
ComputerName : 192.168.50.8 
RemoteAddress : 192.168.50.8 
RemotePort : 25 
InterfaceAlias : Ethernet0 
SourceAddress : 192.168.50.152 
TcpTestSucceeded : True 
Listing 81 - Port scanning SMB via PowerShell 
Unfortunately, with Test-NetConnection we are prevented from fully interacting with the SMTP 
service. Nevertheless, if not already enabled, we can install the Microsoft version of the Telnet 
client, as shown: 
PS C:\Windows\system32> 
dism /online /Enable-Feature /FeatureName:TelnetClient
... 
Listing 82 - Installing the Telnet client 
We should note that installing Telnet requires administrative privileges, which could present 
challenges if we are running as a low-privilege user. However, we could grab the Telnet binary 
located on another development machine of ours at c:\windows\system32\telnet.exe and 
transfer it to the Windows machine we are testing from. 
Once we have enabled Telnet on the testing machine, we can connect to the target machine and 
perform enumeration as we did from Kali. 
C:\Windows\system32>