260 lines
11 KiB
Markdown
260 lines
11 KiB
Markdown
# 25,465,587 - Pentesting SMTP/s
|
||
|
||
## **Basic Information**
|
||
|
||
**SMTP \(Simple Mail Transfer Protocol\)** is a TCP/IP protocol used in **sending** and receiving **e-mail**. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server.
|
||
|
||
In other words, **users typically use** a program that uses **SMTP for sending e-mail** and either **POP3 or IMAP for receiving** e-mail. On Unix-based systems, **sendmail** is the most widely-used SMTP server for e-mail. A commercial package, Sendmail, includes a POP3 server. **Microsoft Exchange** includes an SMTP server and can also be set up to include POP3 support.
|
||
From [here](https://whatis.techtarget.com/definition/SMTP-Simple-Mail-Transfer-Protocol).
|
||
|
||
**Default port:** 25,465\(ssl\),587\(ssl\)
|
||
|
||
```text
|
||
PORT STATE SERVICE REASON VERSION
|
||
25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959
|
||
```
|
||
|
||
### EMAIL Headers
|
||
|
||
If you have the opportunity to **make the victim send you a emai**l \(via contact form of the web page for example\), do it because **you could learn about the internal topology** of the victim seeing the headers of the mail.
|
||
|
||
You can also get an email from a SMTP server trying to **send to that server an email to a non-existent address** \(because the server will send to the attacker a NDN mail\). But, be sure that you send the email from an allowed address \(check the SPF policy\) and that you can receive NDN messages.
|
||
|
||
You should also try to **send different contents because you can find more interesting information** on the headers like: `X-Virus-Scanned: by av.domain.com`
|
||
You should send the EICAR test file.
|
||
Detecting the **AV** may allow you to exploit **known vulnerabilities.**
|
||
|
||
## Basic actions
|
||
|
||
### **Banner Grabbing/Basic connection**
|
||
|
||
**SMTP:**
|
||
|
||
```bash
|
||
nc -vn <IP> 25
|
||
```
|
||
|
||
**SMTPS**:
|
||
|
||
```bash
|
||
openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls command
|
||
openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587
|
||
```
|
||
|
||
### Finding MX servers of an organisation
|
||
|
||
```bash
|
||
dig +short mx google.com
|
||
```
|
||
|
||
### Enumeration
|
||
|
||
```bash
|
||
nmap -p25 --script smtp-commands 10.10.10.10
|
||
```
|
||
|
||
### NTLM Auth - Information disclosure
|
||
|
||
If the server supports NTLM auth \(Windows\) you can obtain sensitive info \(versions\). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666).
|
||
|
||
```bash
|
||
root@kali: telnet example.com 587
|
||
220 example.com SMTP Server Banner
|
||
>> HELO
|
||
250 example.com Hello [x.x.x.x]
|
||
>> AUTH NTLM 334
|
||
NTLM supported
|
||
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
|
||
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA
|
||
```
|
||
|
||
Or **automate** this with **nmap** plugin `smtp-ntlm-info.nse`
|
||
|
||
### Sniffing
|
||
|
||
Check if you sniff some password from the packets to port 25
|
||
|
||
### [Auth bruteforce](../../brute-force.md#smtp)
|
||
|
||
## Username Bruteforce Enumeration
|
||
|
||
**Authentication is not always needed**
|
||
|
||
### RCPT TO
|
||
|
||
```bash
|
||
$ telnet 10.0.10.1 25
|
||
Trying 10.0.10.1...
|
||
Connected to 10.0.10.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO x
|
||
250 myhost Hello [10.0.0.99], pleased to meet you
|
||
MAIL FROM:test@test.org
|
||
250 2.1.0 test@test.org... Sender ok
|
||
RCPT TO:test
|
||
550 5.1.1 test... User unknown
|
||
RCPT TO:admin
|
||
550 5.1.1 admin... User unknown
|
||
RCPT TO:ed
|
||
250 2.1.5 ed... Recipient ok
|
||
```
|
||
|
||
### VRFY
|
||
|
||
```text
|
||
$ telnet 10.0.0.1 25
|
||
Trying 10.0.0.1...
|
||
Connected to 10.0.0.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO
|
||
501 HELO requires domain address
|
||
HELO x
|
||
250 myhost Hello [10.0.0.99], pleased to meet you
|
||
VRFY root
|
||
250 Super-User <root@myhost>
|
||
VRFY blah
|
||
550 blah... User unknown
|
||
```
|
||
|
||
### EXPN
|
||
|
||
```text
|
||
$ telnet 10.0.10.1 25
|
||
Trying 10.0.10.1...
|
||
Connected to 10.0.10.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO
|
||
501 HELO requires domain address
|
||
HELO x
|
||
EXPN test
|
||
550 5.1.1 test... User unknown
|
||
EXPN root
|
||
250 2.1.5 <ed.williams@myhost>
|
||
EXPN sshd
|
||
250 2.1.5 sshd privsep <sshd@mail2>
|
||
```
|
||
|
||
Extracted from: [https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/june/username-enumeration-techniques-and-their-value/](https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/june/username-enumeration-techniques-and-their-value/)
|
||
|
||
### Automatic tools
|
||
|
||
```text
|
||
Metasploit: auxiliary/scanner/smtp/smtp_enum
|
||
smtp-user-enum
|
||
nmap –script smtp-enum-users.nse <IP>
|
||
```
|
||
|
||
## DSN Reports
|
||
|
||
**Delivery Status Notification Reports**: If you send an **email** to an organisation to an **invalid address**, the organisation will notify that the address was invalided sending a **mail back to you**. **Headers** of the returned email will **contain** possible **sensitive information** \(like IP address of the mail services that interacted with the reports or anti-virus software info\).
|
||
|
||
## [Commands](smtp-commands.md)
|
||
|
||
## Send Email from linux console
|
||
|
||
```text
|
||
root@kali:~# sendEmail -t itdept@victim.com -f techsupport@bestcomputers.com -s 192.168.8.131 -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf
|
||
Reading message body from STDIN because the '-m' option was not used.
|
||
If you are manually typing in a message:
|
||
- First line must be received within 60 seconds.
|
||
- End manual input with a CTRL-D on its own line.
|
||
|
||
IT Dept,
|
||
|
||
We are sending this important file to all our customers. It contains very important instructions for upgrading and securing your software. Please read and let us know if you have any problems.
|
||
|
||
Sincerely,
|
||
```
|
||
|
||
From: [https://www.offensive-security.com/metasploit-unleashed/client-side-exploits/](https://www.offensive-security.com/metasploit-unleashed/client-side-exploits/)
|
||
|
||
## Mail Spoofing
|
||
|
||
Most of this section was extracted from the book **Network Security Assessment 3rd Edition**.
|
||
|
||
SMTP messages are easily spoofed, and so organizations use **SPF**, **DKIM**, and **DMARC** features to prevent parties from sending unauthorised email.
|
||
|
||
A **complete guide of these countermeasures** can be found in [https://seanthegeek.net/459/demystifying-dmarc/](https://seanthegeek.net/459/demystifying-dmarc/)
|
||
|
||
### SPF
|
||
|
||
Sender Policy Framework \(SPF\) provides a mechanism that allows MTAs to check if a host sending an email is authorized.
|
||
Then, the organisations can define a list of authorised mail servers and the MTAs can query for this lists to check if the email was spoofed or not.
|
||
|
||
```text
|
||
cpolo@DESKTOP-RVEHVKS:~$ dig txt google.com | grep spf
|
||
google.com. 235 IN TXT "v=spf1 include:_spf.google.com ~all"
|
||
cpolo@DESKTOP-RVEHVKS:~$ dig txt _spf.google.com | grep spf
|
||
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt _spf.google.com
|
||
;_spf.google.com. IN TXT
|
||
_spf.google.com. 235 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
|
||
cpolo@DESKTOP-RVEHVKS:~$ dig txt _netblocks.google.com | grep spf
|
||
_netblocks.google.com. 1606 IN TXT "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
|
||
cpolo@DESKTOP-RVEHVKS:~$ dig txt _netblocks2.google.com | grep spf
|
||
_netblocks2.google.com. 1908 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
|
||
cpolo@DESKTOP-RVEHVKS:~$ dig txt _netblocks3.google.com | grep spf
|
||
_netblocks3.google.com. 1903 IN TXT "v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all"
|
||
```
|
||
|
||
To check the SPF of a domain you can use online tools like: [https://www.kitterman.com/spf/validate.html](https://www.kitterman.com/spf/validate.html)
|
||
If you get _**No valid SPF record**_ you probably can send an email using that domain.
|
||
|
||
**Use checkdmarc to check the SPF record:** [**https://pypi.org/project/checkdmarc/**](https://pypi.org/project/checkdmarc/)\*\*\*\*
|
||
|
||
### DKIM
|
||
|
||
DomainKeys Identified Mail \(DKIM\) is a mechanism by which **outbound email is signed and validated by foreign MTAs upon retrieving a domain’s public key via DNS**. The DKIM public key is held within a TXT record for a domain; however, you must know both the selector and domain name to retrieve it.
|
||
|
||
Then, to ask for the key you need the domain name and the selector of the mail from the mail header `DKIM-Signature` for example: `d=gmail.com;s=20120113`
|
||
|
||
```text
|
||
dig 20120113._domainkey.gmail.com TXT | grep p=
|
||
20120113._domainkey.gmail.com. 280 IN TXT "k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg
|
||
KCAQEA1Kd87/UeJjenpabgbFwh+eBCsSTrqmwIYYvywlbhbqoo2DymndFkbjOVIPIldNs/m40KF+yzMn1skyoxcTUGCQs8g3
|
||
```
|
||
|
||
### DMARC
|
||
|
||
Domain-based Message Authentication, Reporting & Conformance \(DMARC\) is a method of mail authentication that expands upon SPF and DKIM. Policies instruct mail servers how to process email for a given domain and report upon actions performed.
|
||
|
||
|
||
|
||
**To obtain the DMARC record, you need to query the subdomain \_dmarc**
|
||
|
||
```text
|
||
root@kali:~# dig _dmarc.yahoo.com txt | grep DMARC
|
||
_dmarc.yahoo.com. 1785 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\;
|
||
rua=mailto:dmarc-yahoo-rua@yahoo-inc.com, mailto:dmarc_y_rua@yahoo.com\;"
|
||
root@kali:~# dig _dmarc.google.com txt | grep DMARC
|
||
_dmarc.google.com. 600 IN TXT "v=DMARC1\; p=quarantine\; rua=mailto:mailauth-reports@google.com"
|
||
root@kali:~# dig _dmarc.paypal.com txt | grep DMARC
|
||
_dmarc.paypal.com. 300 IN TXT "v=DMARC1\; p=reject\; rua=mailto:d@rua.agari.com\;
|
||
ruf=mailto:dk@bounce.paypal.com,mailto:d@ruf.agari.com"
|
||
|
||
```
|
||
|
||
PayPal and Yahoo instruct mail servers to reject messages that contain invalid DKIM signatures or do not originate from their networks. Notifications are then sent to the respective email addresses within each organization. Google is configured in a similar way, although it instructs mail servers to quarantine messages and not outright reject them.
|
||
|
||
**Use checkdmarc to check the DMARC record:** [**https://pypi.org/project/checkdmarc/**](https://pypi.org/project/checkdmarc/)\*\*\*\*
|
||
|
||
### **Tools**
|
||
|
||
You can attack some **characteristics** of **mail clients** to make the user think that the **mail** is **coming** from **any address**, more info: [**https://www.mailsploit.com/index**](https://www.mailsploit.com/index) ****
|
||
|
||
## Exfiltration through SMTP
|
||
|
||
**If you can send data via SMTP** [**read this**](../../exfiltration.md#smtp)**.**
|
||
|
||
## Config file
|
||
|
||
```text
|
||
sendmail.cf
|
||
submit.cf
|
||
```
|
||
|
||
|
||
|