$ telnet example.com 587
220 example.com SMTP Server Banner
>> EHLO example.com
250-example.com Hello [x.x.x.x]
250-SIZE
...
...
250-AUTH NTLM
...
...
250 XSHADOW
>> AUTH NTLM
NTLM supported
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
334 [base64-encoded internal info]
or use nmap:
nmap -p 587 --script smtp-ntlm-info x.x.x.x
with the result:
Target_Name: TEST
NetBIOS_Domain_Name: TEST
NetBIOS_Computer_Name: CN01
DNS_Domain_Name: test.local
DNS_Computer_Name: cn01.test.local
DNS_Tree_Name: test.local
Product_Version: 6.2.9200