# Exploitation

> Guides on relay abuse, spoofed email delivery, and auth brute force

- **URL:** https://hackindex.io/services/smtp/exploitation
- **Service:** [SMTP](https://hackindex.io/services/smtp.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

SMTP exploitation turns a mail server into an attack platform. Open relay abuse lets you send spoofed emails from the target's own domain, bypassing SPF checks for internal phishing. Credential brute-forcing with Hydra or nxc against AUTH LOGIN and AUTH PLAIN can hand you valid mailbox credentials, especially when password policies are weak.

Known CVEs in MTAs like Exim (CVE-2019-10149 for RCE), Haraka (command injection through email headers), and older Postfix/Sendmail builds provide direct remote code execution when the version is right. Shellshock-era SMTP vectors exploited bash through mail delivery scripts. Always check the MTA version from enumeration against public exploit databases.

Successful exploitation here gives you email access for credential harvesting, a relay for further phishing, or a full shell on the mail server itself.

## Guides

- [SMTP Credential Attacks](https://hackindex.io/services/smtp/exploitation/smtp-credential-attacks.md): Exploiting SMTP authentication weaknesses via brute force, credential stuffing, and relay abuse to gain unauthorized mail server access.
- [SMTP Relay Exploitation](https://hackindex.io/services/smtp/exploitation/smtp-credential-bruteforce.md)