Sunday, October 6, 2019

Enumerating SMTP Servers with Metasploit

Grabbing SMTP Banners

Metasploit peforms simple banner grabbing with its smtp_version module. The only option you need to set to get going is the RHOSTS option.

msf5 > use auxiliary/scanner/smtp/smtp_version
msf5 auxiliary(scanner/smtp/smtp_version) > set RHOSTS 192.168.0.38
RHOSTS => 192.168.0.38
msf5 auxiliary(scanner/smtp/smtp_version) > run

[+] 192.168.0.38:25       - 192.168.0.38:25 SMTP 220 asus ESMTP Postfix (Ubuntu)\x0d\x0a
[*] 192.168.0.38:25       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/smtp/smtp_version) >

Check for open SMTP relays

You can check for open relays with metasploit using the smtp_relay module.

msf5 > use auxiliary/scanner/smtp/smtp_relay
msf5 auxiliary(scanner/smtp/smtp_relay) > set RHOSTS 192.168.0.38
RHOSTS => 192.168.0.38
msf5 auxiliary(scanner/smtp/smtp_relay) > run

[+] 192.168.0.38:25       - SMTP 220 asus ESMTP Postfix (Ubuntu)\x0d\x0a
[*] 192.168.0.38:25       - No relay detected
[*] 192.168.0.38:25       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/smtp/smtp_relay) >

Enumerate SMTP Users

Here metasploit will attempt to uncover possible users on the system using SMTP to verify is the user exists on the system or not. By default metasploit uses the 'unix-users.txt' wordlist from its data directory. You can set your own user file by specifying the 'USER_FILE' option.

msf5 > use auxiliary/scanner/smtp/smtp_enum
msf5 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 192.168.56.102
RHOSTS => 192.168.56.102
msf5 auxiliary(scanner/smtp/smtp_enum) > run

[*] 192.168.56.102:25     - 192.168.56.102:25 Banner: 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
[+] 192.168.56.102:25     - 192.168.56.102:25 Users found: , backup, bin, daemon, distccd, ftp, games, gnats, irc, libuuid, list, lp, mail, man, news, 
nobody, postgres, postmaster, proxy, service, sshd, sync, sys, syslog, user, uucp, www-data
[*] 192.168.56.102:25     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/smtp/smtp_enum) >
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...
  • Socat Encrypted Bind and Reverse shells
    Encrypted Bind Shell First we need to generate a new openssl key to use with our bind shell. Victim Box: user@debian:~$ openssl req -ne...
  • DVWA: SQL Injection (Blind) with sqlmap
    We start off by getting the database names hosted on the remote server. sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192...
  • Exploring NTP servers
    The ntpupdate command is used for updating your system time from a remote NTP server root@asus:~/unix% ntpdate -d 48.21.33.124 24 Sep 11:...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...