SMTP question

HTB Content Academy
77

you are a savior
Thank You

78

I can’t figure it out. Please give me the answer what the f is the user name :(( I’m gettind annoyed .

1 Like
79

I don’t believe what you are saying is right. I didn’t have to mess with any timeout settings for the solution. What they probably meant is that it can take a long time to enumerate through the wordlist used due to the nature of the enumeration(using the VRFY command, which if you use it within telnet, takes a few seconds to illicit a response).

80

On the top right of the screen there is a button that says “Resources”. Click on it and there is a download option. It took me a while to figure out, but all I was missing was that wordlist. I tried several other ones for hours with no luck.

If you’re using pwnbox, you can download it onto the VM by using the “wget” command. It will download into your current directory.

You could use smtp-user-enum, but there are other options like smtp-enum in the popular framework(for this you just have to set your USER_FILE to the wordlist provided by HTB).

I would search online for “SMTP Enumeration”, as there are many great guides. If you haven’t used the popular framework yet, I would recommend the course in the Penetration Tester Job Role Path before moving forward.

I hope that helps. I know it can be frustrating from my own experiences, but it’s worth it when you know what to do down the road from all the skills you’ve learned. You got this :slight_smile:

81

Thanks bro, i just figured out for the first time :man_facepalming:

82

use this bro and pray for me

msfconsole
use auxiliary/scanner/smtp/smtp_enum
set RHOSTS 10.129.108.148
set RPORT 25
set USER_FILE /path/to/user_list.txt
run

83

use this bro and pray for me

msfconsole
use auxiliary/scanner/smtp/smtp_enum
set RHOSTS 10.129.108.148
set RPORT 25
set USER_FILE /path/to/user_list.txt
run
:v:

84

I got stuck on this all night, It took me ages to figure out what I was doing wrong, I was using the VRFY method but had also specified the domain with -D inlanefreight.htb, don’t do this because it will verify any username with this subdomain, like a few others said, look at the query timeout with -w, the default is 5 experiment with what the hint says and you should get it !

85

@Filthyone Thank you so much! :blush: Your instructions were clear! Done without the popular framework