I just started using Hydra. Got a successful authentication over a pop3 service.
Trying the same username and password over the smtp service using hydra's "smtp-auth" module.
My understanding was hydra can try dictionary attack over an smtp service which uses NTLM hashing, my enumerationg results over the listening smtp confirms that it uses NTLM authen type.

Yet using Hydra gives me the following results:

command:  hydra -l username -p password(text) -o output.txt -v -V xxx.xxx.xxx.xxx

Output    Error: SMTP AUTH LOGIN error: 504 5.7.4 unrecognized authentication type

netcat prints out an error when i use EHLO with a mail domain.
Although when i telnet with the same:

c:\> telnet mail.domain.com 25

220 exch01.mail.domain.com Microsoft ESMTP MAIL Service ready at Sat, 3 Apr 2
010 19:05:06 +0500

EHLO mail2.domain.com

250-exch01.mail.domain.com Hello [xxx.xxx.xxx.xxx]
250-SIZE
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-X-ANONYMOUSTLS
250-AUTH NTLM
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250 XRDST

looking at the output it does seem to be accepting authentication requests.

Also strictly for my knowledge, when you asked me if i was sure whether smtp requires authentication. How would a user be able to send mail if that was not the case?

tx

this should get you a step further. Would you be so kind to post the results?