Footprinting Module - SMTP user enum

HTB Content Academy
1

I try to further enumerate the SMTP server in order to find user that exist on the system. I am using smtp-user-enum with the wordlist provided in the resource.
I set the timeout to 10seconds and got 11 users firstname@inlanefreight.htb but none of them (with and without @inlanefreight.htb) is accepted as the solution to the question.

I think I am missing something here, but what?

2

Ok - obviously right after posting this question - I found the solution. I had to use a different tool than smtp-user-enum but I am still puzzled why I get different results from different tools.

  • smtp-user-enum: 11 users
  • other tool (not posting yet which one) only returns one (which is the correct one)

Could someone explain to me why there are so different results from different tools?

3

I had exactly the same problem

1 Like
4

What services running on the server did you discover in your enumeration? I think you are overlooking some service that you need to solve this lab.
Just for confirm, you are on the hard lab?

5

It’s an intermediate module called Footprinting at the HTB Academy. SMTP section

6

Oh I’m sorry, for some reason I think you are on the hard lab. LOL

Ok, do you tried enuramerate manully the users? I mean, put one by one the users in service over telnet or netcat connection?

7

NP. I said I had the same issue which means I don’t have it anymore :slight_smile:

If someone has the problem I could help.

Cheers

8

Set the timeout to 15 seconds!

1 Like
9

How do you set the time out ti 15 seconds? I might have missed something but I honestly don’t know how or where to set the time out?

10

smtp-user-enum -h
options are:
-m n Maximum number of processes (default: 5)
-M mode Method to use for username guessing EXPN, VRFY or RCPT (default: VRFY)
-u user Check if user exists on remote system
-f addr MAIL FROM email address. Used only in “RCPT TO” mode (default: user[@]example[.]com)
-D dom Domain to append to supplied user list to make email addresses (Default: none)
-U file File of usernames to check via smtp service
-t host Server host running smtp service
-T file File of hostnames running the smtp service
-p port TCP port on which smtp service runs (default: 25)
-d Debugging output
-w n Wait a maximum of n seconds for reply (default: 5)
-v Verbose
-h This help message

1 Like