I’m trying to answer the second question: “Access the email account using the user credentials that you discovered and submit the flag in the email as your answer.”
I discovered the user m*****, then tried to bruteforce the password using the provided list and rockyou.txt. Nothing worked. I’m not sure what I’m missing.
Well done finding the user. Think about how you log into your mail service. Do you just use the username or do you need to complete your username with something?
Any advice on finding the user for the first question? Things I’ve tried:
Using the smtp-user-enum script with the provided user and password list from resources turns up no usernames since authentication is required.
Password spraying the RDP and MSSQL services with hyrda. Hydra tends to have false positives when attacking RDP as the user names and passwords it finds don’t work.
I made a telnet connection to the POP3 and SMTP services, however it appears that authentication is needed for both to enumerate users with VRFY
I’ve been stuck on this one for several hours now.
I’m still stuck on the last question. I tried to brute force imap and pop3 using the full username and pw lists, thinking it might reveal another password for a different user that I could reuse but I get nothing. Can something give me a hint on how to find the pw?
Edit: I got it. I tried again on my VM instead of the pwnbox and it worked. didn’t need to use the full username list either.