Attacking Email Services
Last updated
Last updated
Related Sites & Tools
: Microsoft Office 365
: Microsoft Office 365
: Gmail or Okta
A mail server (sometimes also referred to as an email server) is a server that handles and delivers email over a network, usually over the Internet. A mail server can receive emails from a client device and send them to other mail servers. A mail server can also deliver emails to a client device. A client is usually the device where we read our emails (computers, smartphones, etc.).
When we press the Send button in our email application (email client), the program establishes a connection to an SMTP server on the network or Internet. The name SMTP stands for Simple Mail Transfer Protocol, and it is a protocol for delivering emails from clients to servers and from servers to other servers.
When we download emails to our email application, it will connect to a POP3 or IMAP4 server on the Internet, which allows the user to save messages in a server mailbox and download them periodically.
By default, POP3 clients remove downloaded messages from the email server. This behavior makes it difficult to access email on multiple devices since downloaded messages are stored on the local computer. However, we can typically configure a POP3 client to keep copies of downloaded messages on the server.
On the other hand, by default, IMAP4 clients do not remove downloaded messages from the email server. This behavior makes it easy to access email messages from multiple devices. Let's see how we can target mail servers.
We can use the Mail eXchanger (MX) DNS record to identify a mail server. The MX record specifies the mail server responsible for accepting email messages on behalf of a domain name. It is possible to configure several MX records, typically pointing to an array of mail servers for load balancing and redundancy.
These MX records indicate that the first three mail services are using a cloud services G-Suite (aspmx.l.google.com), Microsoft 365 (microsoft-com.mail.protection.outlook.com), and Zoho (mx.zoho.com), and the last one may be a custom mail server hosted by the company.
This information is essential because the enumeration methods may differ from one service to another. For example, most cloud service providers use their mail server implementation and adopt modern authentication, which opens new and unique attack vectors for each service provider. On the other hand, if the company configures the service, we could uncover bad practices and misconfigurations that allow common attacks on mail server protocols.
If we are targeting a custom mail server implementation such as inlanefreight.htb, we can enumerate the following ports:
TCP/25
SMTP Unencrypted
TCP/143
IMAP4 Unencrypted
TCP/110
POP3 Unencrypted
TCP/465
SMTP Encrypted
TCP/587
TCP/993
IMAP4 Encrypted
TCP/995
POP3 Encrypted
We can use Nmap's default script -sC option to enumerate those ports on the target system:
Email services use authentication to allow users to send emails and receive emails. A misconfiguration can happen when the SMTP service allows anonymous authentication or support protocols that can be used to enumerate valid usernames.
The SMTP server has different commands that can be used to enumerate valid usernames VRFY, EXPN, and RCPT TO. If we successfully enumerate valid usernames, we can attempt to password spray, brute-forcing, or guess a valid password. So let's explore how those commands work.
VRFY this command instructs the receiving SMTP server to check the validity of a particular email username. The server will respond, indicating if the user exists or not. This feature can be disabled.
EXPN is similar to VRFY, except that when used with a distribution list, it will list all users on that list. This can be a bigger problem than the VRFY command since sites often have an alias such as "all."
RCPT TO identifies the recipient of the email message. This command can be repeated multiple times for a given message to deliver a single message to multiple recipients.
We can also use the POP3 protocol to enumerate users depending on the service implementation. For example, we can use the command USER followed by the username, and if the server responds OK. This means that the user exists on the server.
As discussed, cloud service providers use their own implementation for email services. Those services commonly have custom features that we can abuse for operation, such as username enumeration. Let's use Office 365 as an example and explore how we can enumerate usernames in this cloud platform.
O365 Spray
Now, we can attempt to identify usernames.
We can use Hydra to perform a password spray or brute force against email services such as SMTP, POP3, or IMAP4. First, we need to get a username list and a password list and specify which service we want to attack. Let us see an example for POP3.
hydra: This is the command to run Hydra, a tool used for cracking passwords by performing brute-force attacks.
-L users.txt: This option specifies a file containing a list of usernames (users.txt). Hydra will attempt to use each username from this file during the attack.
-p 'Company01!': This option specifies a single password to use for the attack. In this case, 'Company01!' is the password Hydra will try with each username. If you wanted to use a list of passwords, you would use -P instead of -p.
-f: This flag tells Hydra to stop the attack as soon as it finds a valid password. Without this flag, Hydra would continue testing all combinations even after a successful login attempt.
10.10.110.20: This is the target IP address where Hydra will attempt to perform the brute-force attack. Replace this with the IP address of the target system you want to test.
pop3: This specifies the service that Hydra will attack. In this case, it’s pop3, which is the Post Office Protocol version 3, used for retrieving email from a server.
An open relay is a Simple Mail Transfer Protocol (SMTP) server, which is improperly configured and allows an unauthenticated email relay. Messaging servers that are accidentally or intentionally configured as open relays allow mail from any source to be transparently re-routed through the open relay server. This behavior masks the source of the messages and makes it look like the mail originated from the open relay server.
From an attacker's standpoint, we can abuse this for phishing by sending emails as non-existing users or spoofing someone else's email. For example, imagine we are targeting an enterprise with an open relay mail server, and we identify they use a specific email address to send notifications to their employees. We can send a similar email using the same address and add our phishing link with this information. With the nmap smtp-open-relay script, we can identify if an SMTP port allows an open relay.
Next, we can use any mail client to connect to the mail server and send our email.
With a username list we can enumerate the users on the SMTP server with smtp-user-enum :
We find the user account marlin@inlanefreight.htb with a password list we can now use hydra to brute force the password on pop3:
We now have a username and password combo login: marlin@inlanefreight.htb password: poohbear and now we can use telnet to connect to the POP3 server:
Here we need to initialize a connection with the SMTP service first. This can be automated by a script or entered manually. After the connection is established, an email must be composed in which we define the sender, the recipient, and the actual message for the recipient. The desired system command is inserted in the sender field connected to the sender address with a semicolon (;). As soon as we finish writing, the data entered is processed by the OpenSMTPD process.
Initiation of the Attack
1.
The source is the user input that can be entered manually or automated during direct interaction with the service.
Source
2.
The service will take the email with the required information.
Process
3.
Listening to the standardized ports of a system requires root privileges on the system, and if these ports are used, the service runs accordingly with elevated privileges.
Privileges
4.
As the destination, the entered information is forwarded to another local process.
Destination
This is when the cycle starts all over again, but this time to gain remote access to the target system.
Trigger Remote Code Execution
5.
This time, the source is the entire input, especially from the sender area, which contains our system command.
Source
6.
The process reads all the information, and the semicolon (;) interrupts the reading due to special rules in the source code that leads to the execution of the entered system command.
Process
7.
Since the service is already running with elevated privileges, other processes of OpenSMTPD will be executed with the same privileges. With these, the system command we entered will also be executed.
Privileges
8.
The destination for the system command can be, for example, the network back to our host through which we get access to the system.
Destination
Email servers are complex and usually require us to enumerate multiple servers, ports, and services. Furthermore, today most companies have their email services in the cloud with services such as or . Therefore, our approach to attacking the email service depends on the service in use.
We can use tools such as host or dig and online websites such as to query information about the MX records:
SMTP Encrypted/
To automate our enumeration process, we can use a tool named . We can specify the enumeration mode with the argument -M followed by VRFY, EXPN, or RCPT, and the argument -U with a file containing the list of users we want to enumerate. Depending on the server implementation and enumeration mode, we need to add the domain for the email address with the argument -D. Finally, we specify the target with the argument -t.
is a username enumeration and password spraying tool aimed at Microsoft Office 365 (O365) developed by . This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in . Let's first validate if our target domain is using Office 365.
If cloud services support SMTP, POP3, or IMAP4 protocols, we may be able to attempt to perform password spray using tools like Hydra, but these tools are usually blocked. We can instead try to use custom tools such as or for Microsoft Office 365 or for Gmail or Okta. Keep in mind that these tools need to be up-to-date because if the service provider changes something (which happens often), the tools may not work anymore. This is a perfect example of why we must understand what our tools are doing and have the know-how to modify them if they do not work properly for some reason.
One of the most recent publicly disclosed and dangerous vulnerabilities was discovered in up to version 6.6.2 service was in 2020. This vulnerability was assigned and leads to RCE. It has been exploitable since 2018. This service has been used in many different Linux distributions, such as Debian, Fedora, FreeBSD, and others. The dangerous thing about this vulnerability is the possibility of executing system commands remotely on the system and that exploiting this vulnerability does not require authentication.
According to , at the time of writing (April 2022), there are over 5,000 publicly accessible OpenSMTPD servers worldwide, and the trend is growing. However, this does not mean that this vulnerability affects every service. Instead, we want to show you how significant the impact of an RCE would be in case this vulnerability were discovered now. However, of course, this applies to all other services as well.
As we already know, with the SMTP service, we can compose emails and send them to desired people. The vulnerability in this service lies in the program's code, namely in the function that records the sender's email address. This offers the possibility of escaping the function using a semicolon (;) and making the system execute arbitrary shell commands. However, there is a limit of 64 characters, which can be inserted as a command. The technical details of this vulnerability can be found .
An has been published on the platform for this vulnerability which can be used for more detailed analysis and the functionality of the trigger for the execution of system commands.
As we've seen, email attacks can lead to sensitive data disclosure through direct access to a user's inbox or by combining a misconfiguration with a convincing phishing email. There are other ways to attack email services that can be very effective as well. A few Hack The Box boxes demonstrate email attacks, such as , which deals with brute-forcing Outlook Web Access (OWA) and then sending a document with a malicious macro to phish a user, which has elements of phishing and enumerating a user's inbox using Netcat and an IMAP client, and which dealt with brute-forcing SMTP users and phishing with a malicious RTF file.
It's worth playing these boxes, or at least watching the Ippsec video or reading a walkthrough to see examples of these attacks in action. This goes for any attack demonstrated in this module (or others). The site can be used to search for common terms and will show which HTB boxes these appear in, which will reveal a wealth of targets to practice against.
