# 143,993 - Pentesting IMAP
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS Red Team Expert）！ 支持HackTricks的其他方式： * 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com) * 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。** * 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
**Try Hard Security Group**
{% embed url="" %} *** ## 互联网消息访问协议 **互联网消息访问协议（IMAP）旨在使用户能够通过互联网连接从任何位置访问其电子邮件消息**。实质上，电子邮件**保留在服务器上**，而不是下载并存储在个人设备上。这意味着当电子邮件被访问或阅读时，是直接从服务器上进行的。这种能力允许方便地从**多个设备**检查电子邮件，确保无论使用哪种设备，都不会错过任何消息。 默认情况下，IMAP协议在两个端口上运行： * **端口143** - 这是默认的IMAP非加密端口 * **端口993** - 这是您需要使用的端口，如果要安全地使用IMAP进行连接 ``` PORT STATE SERVICE REASON 143/tcp open imap syn-ack ``` ## 横幅抓取 ```bash nc -nv 143 openssl s_client -connect :993 -quiet ``` ### NTLM认证 - 信息泄露 如果服务器支持NTLM认证（Windows），您可以获取敏感信息（版本）： ``` root@kali: telnet example.com 143 * OK The Microsoft Exchange IMAP4 service is ready. >> a1 AUTHENTICATE NTLM + >> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= + TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA ``` 或者使用 **nmap** 插件 `imap-ntlm-info.nse` **自动化** 这个过程。 ### [IMAP暴力破解](/generic-methodologies-and-resources/brute-force.md#imap) ## 语法 IAMP命令示例来自[这里](https://donsutherland.org/crib/imap): ``` Login A1 LOGIN username password Values can be quoted to enclose spaces and special characters. A " must then be escape with a \ A1 LOGIN "username" "password" List Folders/Mailboxes A1 LIST "" * A1 LIST INBOX * A1 LIST "Archive" * Create new Folder/Mailbox A1 CREATE INBOX.Archive.2012 A1 CREATE "To Read" Delete Folder/Mailbox A1 DELETE INBOX.Archive.2012 A1 DELETE "To Read" Rename Folder/Mailbox A1 RENAME "INBOX.One" "INBOX.Two" List Subscribed Mailboxes A1 LSUB "" * Status of Mailbox (There are more flags than the ones listed) A1 STATUS INBOX (MESSAGES UNSEEN RECENT) Select a mailbox A1 SELECT INBOX List messages A1 FETCH 1:* (FLAGS) A1 UID FETCH 1:* (FLAGS) Retrieve Message Content A1 FETCH 2 body[text] A1 FETCH 2 all A1 UID FETCH 102 (UID RFC822.SIZE BODY.PEEK[]) Close Mailbox A1 CLOSE Logout A1 LOGOUT ``` ### 演进 ``` apt install evolution ``` ![](/files/WKM13XlPRfKV9Wv2QvOB) ### CURL 使用[CURL](https://ec.haxx.se/usingcurl/usingcurl-reademail#imap)可以进行基本导航，但文档细节较少，建议查看[源代码](https://github.com/curl/curl/blob/master/lib/imap.c)以获取精确细节。 1. 列出邮箱（imap 命令 `LIST "" "*"`） ```bash curl -k 'imaps://1.2.3.4/' --user user:pass ``` 2. 在邮箱中列出消息（imap 命令 `SELECT INBOX` 然后 `SEARCH ALL`） ```bash curl -k 'imaps://1.2.3.4/INBOX?ALL' --user user:pass ``` 这次搜索的结果是一个消息索引列表。 也可以提供更复杂的搜索条件。例如，在邮件正文中搜索带有密码的草稿： ```bash curl -k 'imaps://1.2.3.4/Drafts?TEXT password' --user user:pass ``` A nice overview of the search terms possible is located [here](https://www.atmail.com/blog/imap-commands/). 3. Downloading a message (imap command `SELECT Drafts` and then `FETCH 1 BODY[]`) ```bash curl -k 'imaps://1.2.3.4/Drafts;MAILINDEX=1' --user user:pass ``` 邮件索引将是从搜索操作返回的相同索引。 也可以使用`UID`（唯一标识符）来访问消息，但这样做不太方便，因为搜索命令需要手动格式化。例如： ```bash curl -k 'imaps://1.2.3.4/INBOX' -X 'UID SEARCH ALL' --user user:pass curl -k 'imaps://1.2.3.4/INBOX;UID=1' --user user:pass ``` 另外，可以下载消息的部分内容，例如前5条消息的主题和发件人（需要使用 `-v` 来查看主题和发件人）： ```bash $ curl -k 'imaps://1.2.3.4/INBOX' -X 'FETCH 1:5 BODY[HEADER.FIELDS (SUBJECT FROM)]' --user user:pass -v 2>&1 | grep '^<' ``` 虽然，编写一个小的for循环可能更清晰： ```bash for m in {1..5}; do echo $m curl "imap://1.2.3.4/INBOX;MAILINDEX=$m;SECTION=HEADER.FIELDS%20(SUBJECT%20FROM)" --user user:pass done ``` ## Shodan * `port:143 CAPABILITY` * `port:993 CAPABILITY` **尝试困难安全团队**
{% embed url="" %} ## HackTricks 自动命令 ``` Protocol_Name: IMAP #Protocol Abbreviation if there is one. Port_Number: 143,993 #Comma separated if there is more than one. Protocol_Description: Internet Message Access Protocol #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for WHOIS Note: | The Internet Message Access Protocol (IMAP) is designed for the purpose of enabling users to access their email messages from any location, primarily through an Internet connection. In essence, emails are retained on a server rather than being downloaded and stored on an individual's personal device. This means that when an email is accessed or read, it is done directly from the server. This capability allows for the convenience of checking emails from multiple devices, ensuring that no messages are missed regardless of the device used. https://book.hacktricks.xyz/pentesting/pentesting-imap Entry_2: Name: Banner Grab Description: Banner Grab 143 Command: nc -nv {IP} 143 Entry_3: Name: Secure Banner Grab Description: Banner Grab 993 Command: openssl s_client -connect {IP}:993 -quiet Entry_4: Name: consolesless mfs enumeration Description: IMAP enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/imap/imap_version; set RHOSTS {IP}; set RPORT 143; run; exit' ```
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS红队专家）！ 其他支持HackTricks的方式： * 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com) * 探索我们的独家\[**NFTs**]收藏品，[**The PEASS Family**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。** * 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://hacktricks.xsx.tw/network-services-pentesting/pentesting-imap.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.