SMTP Enumeration.
In this video, we're going to be taking a look at how
to enumerate as much information as possible
from SMTP through the use of auxiliary modules.
So first and foremost, what is SMTP?
SMTP stands for the Simple Mail Transfer Protocol.
This is a communication protocol that
is used for the transmission of email.
So for any of you who have used email before
and have configured your own inboxes,
you will be familiar with SMTP, right?
Now SMTP, uses TCP port 25 by default.
However, it can also be configured to run on TCP port
465 and 587 if an SSL or TLS certificate has been set up
for encryption, right?
Now, we can utilize the various auxiliary modules available
or that are afforded to us by the Metasploit Framework
to number one, enumerate the version of SMTP that's running.
And as I mentioned previously, the version information
is going to come in handy during the vulnerability
scanning section.
And we'll be taking a look at how to, again,
identify vulnerabilities for these services,
or rather inherent vulnerabilities
for these services.
And again, so far what we've been doing
is performing enumeration.
And then exploiting various misconfigurations
to either obtain more information
or to obtain some level of access.
We can also utilize auxiliary modules
to perform a brute force attack on SMTP in order
to obtain or to find various user accounts on the target
system.
So that's one of the great things
with SMTP is that through the various auxiliary modules,
we can also identify users on the target system.
And this information can be very useful
if we SSH open on the target.
And we can then use that username
to perform a brute force on SSH and then gain access via SSH.
So again, in terms of SMTP, it really
can provide us with much in regards
to exploitation unless we exploit
the exact version of SMTP that's running on the target.
However, we can use the information
we gather from SMTP to stage our other attacks.
So I will be taking a look at all of this within the lab
environment.
So let's actually get started now.
All right, so I am back in the lab environment.
And again, starting off, we need to get the target IP, which we
can do by typing in ifconfig.
And the interface we're interested in is ethernet 1.
So we'll get our IP here, and the target IP
is going to be the same subnet.
But instead of a 2 it's going to be a 3.
So I'm just going to copy that.
And we'll then start up the PostgreSQL Database Service
like so.
And so Service PostgreSQL--
let me just type that in correctly.
There we are.
That's going to start it up for us
so that we can utilize the Metasploit Framework database.
Once that is done, we can essentially
start up the Metasploit Framework console
by typing in MSFConsole.
Give that a few seconds to start up.
All right, we can now add our workspace for SMTP enumeration.
So we're going to say SMTP and then underscore enum, right?
And we should have that as our active interface,
or rather, our active workspace.
Now that that is done, we need to set up our global variables.
So we're going to set up the global variable value
for RHOSTS, primarily because we don't
want to waste time always setting
the target IP for each module.
Setting up the global variable for RHOSTS
will again, load up the target IP
with whichever module we use.
So again, paste that in and change the 2 into a 3.
And that is set up.
All right, excellent.
So we can begin performing SMTP enumeration.
So we can search for the various Metasploit Framework
auxiliary modules that are pertinent to SMTP.
So again, we can essentially use a search filter like Auxiliary
to limit our results to only auxiliary modules.
And then the name, we will specify SMTP.
All right?
So we get quite a few auxiliary modules.
And the first one we want to take a look at
is the SMTP Version module, which will essentially
just tell us what version of SMTP is running on the target.
Now again, as I said, SMTP may be configured
to run on different ports.
So I would recommend performing a port scan in order
to identify what port SMTP is running on.
But in this case, we do know through the lab environment
that it is running on port 25.
So we can then just load the module here.
And if we show the options for this particular module,
you can see that the RHOST value has been set.
The RPORT has been set to 25, which
is the default, as I said.
And you can then modify the threads value,
which in this case, we don't because we are only
targeting one target system.
So we'll just hit Run.
And as you can see, it tells us immediately the version
of SMTP that's running, which is Postfix.
And it also gives us the email address, or rather the domain
for this particular SMTP server, right?
Which again, can be extremely useful
as we move on to exploitation.
However, in this case, we've already
been able to enumerate or to get the version of SMTP
so we can again, perform a search for the other SMTP
modules.
So I'll just use the previous search filter.
And the next module that we want to take a look at
is the SMTP enum module, which again,
performs user enumeration.
So we'll copy that module and we'll paste that in there.
And again, if you want to learn more about a particular module,
just type in Info.
And as you can see, it gives you a description
of what's going on or what this module is doing.
So it says the SMTP service has two internal commands that
allow the enumeration of users.
So we can use Verify, which will confirm
the names of valid users, and EXPN,
which reveals the actual addresses of user aliases
and lists of email or mailing lists.
Through the implementation of these SMTP
commands can reveal a list of valid users,
so we can use this to enumerate user accounts, right?
So we have the target IP set, the target port
is set correctly.
And again, we can also modify the Unix Only option here.
So this will skip Microsoft branded servers
when testing Unix users.
And because we know we are dealing with a Linux target,
the user file that we specify for the brute force is going
to be the default unix_users.txt word list that's found under
User Share Metasploit Framework Data Word Lists, and then,
of course, Unix users.
And we've used this before.
So we need to do now is just type in Run.
And again, it's going to begin the brute force.
So give this a few seconds to a few minutes.
It's going to take a while.
All right, so the enumeration is complete.
That took a few minutes.
And as you can see, it's able to enumerate the various uses
on the system.
So we have an admin, account, administrator, backup, bin,
daemon, as well as a few other interesting ones
like the www-data user account, which again, may provide us
with an idea of what this server is set up to do.
And again, all of this information
can be very useful in staging other attacks.
So for example, if we had SSH running on this server,
then we could use these usernames
to perform a brute force.
And of course, having a username narrows down your brute force
attack and makes it more efficient.
So all of this information is extremely important.
Now, that's as far as we can enumerate in terms of SMTP.
During the exploitation section, we'll
be taking a look at how to exploit a vulnerable SMTP
server.
But for now, this should be it in regards to enumeration.
So that concludes the lab demonstration.
All right, so that is essentially SMTP enumeration
through the use of the Metasploit Framework
auxiliary modules.
And that also concludes the information gathering
and enumeration section of this course.
In the next section, which covers vulnerability scanning,
we'll be taking a look at how to use all of this version
information, or rather the service version information
to identify exploits that we can use to exploit these services.
And we'll also be taking a look at how
to perform web application vulnerability scanning.
So I'll see you there.