143, 993 - IMAP

Banner Grabbing

Telnet

telnet 10.0.0.3 143

Netcat

nc -n 10.0.0.3 143

openssl

openssl s_client -connect 10.0.0.3:993

Read mail using a recovered identity

Use a valid mailbox account. Connect using the server's hostname and verify its certificate:

openssl s_client -connect TARGET:993 -servername HOST -verify_return_error -verify_hostname HOST -crlf -quiet

For a private CA, supply its reviewed CA file using -CAfile /PATH/ca.pem; establish certificate trust before sending credentials.

Enter these IMAP commands in that session; replace 1 with a message number returned by SEARCH:

a1 LOGIN "USER" "PASSWORD"
a2 LIST "" "*"
a3 EXAMINE INBOX
a4 SEARCH ALL
a5 FETCH 1 BODY.PEEK[HEADER]
a6 FETCH 1 BODY.PEEK[TEXT]
a7 LOGOUT

Each command needs its own tag. Tagged OK confirms that operation; NO or BAD needs interpretation before continuing. EXAMINE opens the mailbox read-only and BODY.PEEK avoids setting the seen flag. Read relevant messages for internal hostnames, reset links or credentials, then validate any recovered identity in its correct service/domain context.

openssl s_client -starttls imap -connect TARGET:143 -servername HOST -verify_return_error -verify_hostname HOST -crlf -quiet

NTLM Information Disclosure

Manually

telnet example.com 143
...
>> a1 AUTHENTICATE NTLM
+
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
+ TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA

imap-ntlm-info NSE Script

nmap -p 143,993 --script imap-ntlm-info 10.0.0.3