Attacking Common Services - Attacking Email Services (SMTP)

HTB Content Academy
1

I’m trying to answer the second question: “Access the email account using the user credentials that you discovered and submit the flag in the email as your answer.”

I discovered the user m*****, then tried to bruteforce the password using the provided list and rockyou.txt. Nothing worked. I’m not sure what I’m missing.

1 Like
2

Well done finding the user. Think about how you log into your mail service. Do you just use the username or do you need to complete your username with something?

7 Likes
3

Thank you. Got it :slight_smile:

1 Like
4

Any advice on finding the user for the first question? Things I’ve tried:

  1. Using the smtp-user-enum script with the provided user and password list from resources turns up no usernames since authentication is required.
  2. Password spraying the RDP and MSSQL services with hyrda. Hydra tends to have false positives when attacking RDP as the user names and passwords it finds don’t work.
  3. I made a telnet connection to the POP3 and SMTP services, however it appears that authentication is needed for both to enumerate users with VRFY

I’ve been stuck on this one for several hours now.

5

how did you login into his email account? is there a web interface somewhere, not seeing it.

6

nvm, got it.

8

I`m stuck here… got user and password but in the telnet session I get no emails :frowning:

9

Try to find it using the openssl command and loggin in there, telnet will just give you the banner

10

Thank! I got it :slight_smile: :slight_smile: I was trying through the wrong port!

1 Like
11

Finally :slight_smile:

  1. first enumerate for user
  2. find users password ( use full username for brute )
  3. we have user and pass
    post exploitation : Use Evolu** email clint if you unable to give commands :slight_smile:
1 Like
12

The ‘full username’ is a very helpful note. Thanks!

1 Like
13

I’m still stuck on the last question. I tried to brute force imap and pop3 using the full username and pw lists, thinking it might reveal another password for a different user that I could reuse but I get nothing. Can something give me a hint on how to find the pw?

Edit: I got it. I tried again on my VM instead of the pwnbox and it worked. didn’t need to use the full username list either.