Attacking Common Services - Attacking Email Services (SMTP)

HTB Content Academy
1

I’m trying to answer the second question: “Access the email account using the user credentials that you discovered and submit the flag in the email as your answer.”

I discovered the user m*****, then tried to bruteforce the password using the provided list and rockyou.txt. Nothing worked. I’m not sure what I’m missing.

2 Likes
2

Well done finding the user. Think about how you log into your mail service. Do you just use the username or do you need to complete your username with something?

10 Likes
3

Thank you. Got it :slight_smile:

1 Like
4

Any advice on finding the user for the first question? Things I’ve tried:

  1. Using the smtp-user-enum script with the provided user and password list from resources turns up no usernames since authentication is required.
  2. Password spraying the RDP and MSSQL services with hyrda. Hydra tends to have false positives when attacking RDP as the user names and passwords it finds don’t work.
  3. I made a telnet connection to the POP3 and SMTP services, however it appears that authentication is needed for both to enumerate users with VRFY

I’ve been stuck on this one for several hours now.

5

how did you login into his email account? is there a web interface somewhere, not seeing it.

6

nvm, got it.

8

I`m stuck here… got user and password but in the telnet session I get no emails :frowning:

9

Try to find it using the openssl command and loggin in there, telnet will just give you the banner

10

Thank! I got it :slight_smile: :slight_smile: I was trying through the wrong port!

1 Like
11

Finally :slight_smile:

  1. first enumerate for user
  2. find users password ( use full username for brute )
  3. we have user and pass
    post exploitation : Use Evolu** email clint if you unable to give commands :slight_smile:
5 Likes
12

The ‘full username’ is a very helpful note. Thanks!

4 Likes
13

I’m still stuck on the last question. I tried to brute force imap and pop3 using the full username and pw lists, thinking it might reveal another password for a different user that I could reuse but I get nothing. Can something give me a hint on how to find the pw?

Edit: I got it. I tried again on my VM instead of the pwnbox and it worked. didn’t need to use the full username list either.

14

I had an issue where the machine I spawned only had SQL servers open. Not sure why,… but of course running anything the email ports gave me no results. I had to reset the machine, then I was given a machine with the correct ports open.

Oddly enough, I was still able to enumerate the email username from the machine that had SQL ports open.

15

Im attempting to brute force using the ‘m*****@inlanefreight.htb’ using both SMTP and POP3 with both the password list provided and rock you and both will not work. Any ideas?

16

wow same here, wasted 2 hours. Love spending money to learn when the issues end up being on HTB. Worthless

19

Issue was with HTB, not wordlist

21

Sweet, that was not my issue lol - maybe read what I said again. Nothing to do with wordlists.

22

smtp-user-enum -M RCPT -U users.list -D inlanefreight.htb -t 10.129.132.243

23

I have the credentials but im struggling to obtain the flag. Can anyone point me in the right direction. Thanks

24

Think about how to login to the server and which protocol to use. Hint: telnet is your friend here. I had to google that part and which commands to use. Hope this helps!

1 Like