Re: Discovering users by RCPT TO

From: GuidoZ (uberguidoz_at_gmail.com)
Date: 01/13/05

  • Next message: Idol Crash: "Re: Google Hacking" 
    Date: Wed, 12 Jan 2005 18:50:03 -0800
To: Andres Molinetti <andymolinetti@hotmail.com>

    [snip]
    > Testing for Open Relay, I realized that the server answers different to
    > existing users and non-existing users, when trying to deliver mails using
    > RCPT TO:

    Interesting. It wouldn't be hard to make a Perl script (or other) that
    logs into the SMTP server, then runs through a list of predefined
    users to test and see if they have an account. I would call it
    information disclosure for sure.

    As for how to fix it, I don't know that you can. It's part of the
    protocol to answer to RCPT TO. What version of Sendmail? In the more
    recent versions, you can alter the text that is displayed there...
    maybe change it all to something like "I'll try that address" for
    both. 

    --
Peace. ~G
On Wed, 12 Jan 2005 20:42:04 +0000, Andres Molinetti
<andymolinetti@hotmail.com> wrote:
> I'm currently over a pen-test and I have found that their SMTP Server
> (SendMail) does not have VRFY or EXPN methods available, which was the most
> probably thing to happen taking into account the server has been through
> some hardening before.
> 
> Testing for Open Relay, I realized that the server answers different to
> existing users and non-existing users, when trying to deliver mails using
> RCPT TO:
> 
> E.g:
> 
> rcpt to: asdfasdf@domain
> 550 5.1.1 asdfasdf@domain... User unknown
> rcpt to: bin@domain
> 250 2.1.5 bin@domain... Recipient ok
> rcpt to: nobody@domain
> 250 2.1.5 nobody@domain... Recipient ok
> rcpt to: oper@domain
> 550 5.1.1 oper@domain... User unknown
> rcpt to: root@domain
> 250 2.1.5 root@domain... Recipient ok
> 
> Is this ok or is it information disclousure? Is there any way to fix it? It
> is Sendmail...
> 
> Thanks in advance,
> 
> Andres Molinetti
> CISSP
> 
> _________________________________________________________________
> Acepta el reto MSN Premium: Protección para tus hijos en internet.
> Descárgalo y pruébalo 2 meses gratis.
> http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_proteccioninfantil
> 
>
  • Next message: Idol Crash: "Re: Google Hacking"

    Relevant Pages

    • Re: proxy for RCPT TO command
      ... Its a real transparent SMTP Proxy which has lots of features which start at ... simple IP, domain, rcpt to, mail from checks up to SPF and SenderID checks. ... > able to verify recipients on the other server? ... In order for IIS to run it, it has to be configured (eg. ...
      (microsoft.public.inetserver.iis.smtp_nntp)
    • =?Windows-1252?Q?Re:_Winsock-Erg=E4nzung_mit_BCC?=
      ... Vorher hattest Du das aber nicht in den Headern RCPT TO, sondern im DATA Bereich als "To:" drin. ... Das unten ist eigentlich für den POP Server auf der anderen Seite, damit dieser weiss, wohin er das Mail versorgen soll. ... Gib da mal eine exisitierende E-Mail Adresse ein. ...
      (microsoft.public.de.access)
    • Re: Winsock-Ergänzung mit BCC
      ... Vorher hattest Du das aber nicht in den Headern RCPT TO, ... Mail versorgen soll. ... 'Send RCPT TO command to the server ... Microsoft MVP Office Access ...
      (microsoft.public.de.access)
    • Re: Discovering users by RCPT TO
      ... > I'm currently over a pen-test and I have found that their SMTP Server ... > (SendMail) does not have VRFY or EXPN methods available, ... > using RCPT TO: ... All mails are send from fake addresses, so after 2-3 waves of such ...
      (Pen-Test)
    • Re: [SLE] SMTP authentication
      ... So eventhough my local SMTP server dials up to the internet with a certain username and password, that same username and password would not be used as authentication between my local SMTP server and the ISP's one, should it be used as a relay? ... either defer all outgoing mails until you connect to the internet, then flush out all the mails in the queue. ... Your local server would use an external program like fetchmail to poll the mailserver of your ISP, download the mails and feed them to Postfix. ... The test does NOT say "All clients must be in mynetworks, ...
      (SuSE)