I’m trying to answer the second question: “Access the email account using the user credentials that you discovered and submit the flag in the email as your answer.”
I discovered the user m*****, then tried to bruteforce the password using the provided list and rockyou.txt. Nothing worked. I’m not sure what I’m missing.
Well done finding the user. Think about how you log into your mail service. Do you just use the username or do you need to complete your username with something?
Any advice on finding the user for the first question? Things I’ve tried:
Using the smtp-user-enum script with the provided user and password list from resources turns up no usernames since authentication is required.
Password spraying the RDP and MSSQL services with hyrda. Hydra tends to have false positives when attacking RDP as the user names and passwords it finds don’t work.
I made a telnet connection to the POP3 and SMTP services, however it appears that authentication is needed for both to enumerate users with VRFY
I’ve been stuck on this one for several hours now.
I’m still stuck on the last question. I tried to brute force imap and pop3 using the full username and pw lists, thinking it might reveal another password for a different user that I could reuse but I get nothing. Can something give me a hint on how to find the pw?
Edit: I got it. I tried again on my VM instead of the pwnbox and it worked. didn’t need to use the full username list either.
I had an issue where the machine I spawned only had SQL servers open. Not sure why,… but of course running anything the email ports gave me no results. I had to reset the machine, then I was given a machine with the correct ports open.
Oddly enough, I was still able to enumerate the email username from the machine that had SQL ports open.
Im attempting to brute force using the ‘m*****@inlanefreight.htb’ using both SMTP and POP3 with both the password list provided and rock you and both will not work. Any ideas?
Think about how to login to the server and which protocol to use. Hint: telnet is your friend here. I had to google that part and which commands to use. Hope this helps!