Sending Email with Netcat

Pete Vargas Mas — Tue, 20 Apr 2010 17:04:52 +0000

Is it possible to send an email from a host that has no email client software installed? As long as you have netcat, of course it is!

Netcat (/usr/bin/nc on Red Hat Enterprise Linux systems) is a simple utility for reading and writing data across TCP/UDP connections. It's often used for testing and debugging network connections. In its most basic usage, netcat allows you to feed a stream of data to a specific port on a specific host, which is perfect for our purpose here. Check the netcat man page for more information on it's various features. There are also sample scripts under /usr/share/doc/nc-*/. If netcat is not installed on your Red Hat Enterprise Linux, CentOS or Fedora system, you can install it with the command yum install nc.

What we will be doing with netcat is using it to feed a stream of data to port 25 (SMTP) on a mail relay, making it believe it's talking to a regular email client. In order to do this, we first need to figure out what our email server expects to see from a client. This can be done by connecting via telnet to our SMTP relay host and issuing the correct SMTP commands, as in the following example:

   [user@host]# telnet smtp.domain.com 25
   Trying 192.168.0.1...
   Connected to smtp.domain.com (192.168.0.1).
   Escape character is '^]'.
   220 myrelay.domain.com ESMTP
   HELO smtp.domain.com
   250 myrelay.domain.com
   MAIL FROM:
   250 sender  ok
   RCPT TO:
   250 recipient  ok
   DATA
   354 go ahead
   From: [Alice Hacker] 
   To: [Bob Smith] 
   Date: Mon, 12 Apr 2010 14:21:26 -0400
   Subject: Test Message

   Hi there!
   This is supposed to be a real email...

   Have a good day!
   Alice


   .
   250 ok:  Message 222220902 accepted
   QUIT
   221 myrelay.domain.com
   Connection closed by foreign host.
   [user@host]#

Note that the userid part of the "From" address does not have to contain a valid userid, only a valid domain name. You will have to replace "smtp.domain.com" with a valid SMTP relay that allows relaying from your host. Generally, experienced admins will disallow relaying from unknown hosts to discourage spam. Additionally, the body of the email (everything after the "DATA" command) is ended by sending a blank line, followed by a line with a period (.) on it by itself.

Now that we know what the remote server expects to see, we can craft a text file with our SMTP commands and the message to be sent. The recipients mail server will expect the date to be in a particular format.

Use the command:

date '+%a, %d %b %Y %H:%M:%S %z'

To generate a date string that resembles:

Mon, 12 Apr 2010 14:21:26 -0400

The contents of your message file should resemble this example:

Go to Full Article