Hacking SMTP Mail Gateways

Mail Servers: They have their own language There are many types and brands of e-mail servers used on the Internet. There's Sendmail, been around for a long time and typically used on UNIX systems, Microsoft Exchange, a Microsoft product of course, and GroupWise, a Novell product, just to name a few. Regardless of the services and options each flavor of mail server offers you, they all have one thing in common. They must abide by the rules of the SMTP communications standards, and in effect, speak a common language. If you want to know more about this, read the SMTP "Request For Comment" , or RFC located here.

---

SMTP Mail Relaying and Social Engineering

Mail Relaying: What's the big deal?
Although not a traditional vulnerability, one of the most common forms of SMTP misuse is email relaying, or email spoofing. This method is routinely used by spammers to distribute their unwanted, and unsolicited information. In many cases, they setup their own mail servers, configured to allow mail relaying. However, if your smtp gateway is not setup to prevent mail relay, the spammers will kindly use it. This is a very simple procedure and in most cases is completely automated.

Social Engineering Attack by E-mail
Another common use of email relay and spoofing is social engineering attacks. We recently performed a security assessment for an organizing where we were permitted to perform social engineering and denial-of-service attacks. It turned out that this company's SMTP server was not configured to prevent email relaying. We attached to the SMTP gateway from the Internet, spoofed the e-mail address of one of the IT people, and sent an e-mail to ten end-users instructing them to "Shutdown their computers immediately because the IT team had detected a serious virus / or worm on their computer". All ten of the users did exactly as we asked. Imagine if we sent this e-mail to the "everyone" e-mail distribution group. Probably would not have been a good day for the IT folks.
I want to make the point that I am writing this article for the purpose of education and awareness. The purpose is NOT to provide someone the information needed to abuse SMTP services.

---

Speaking the SMTP Language

The Basics of Hacking SMTP Gateways and Communications

There are a handful of methods in direct SMTP communication but for the sake of this article we will only review a few items.  These items, if the SMTP gateway you are attached to allows mail relaying, is all that is needed to successfully email spoof or e-mail relay.

• Our Target: "smtpmailserver.ontheinternet.com";
• Our Tool: The good ole "telnet: client;
• Our Objective: Determine if mail relay is possible and execute it.

The following are the six commands (or steps) we will use to check for and execute a mail relay:

1. "telnet": A communications client used to connect to the SMTP port 25 on the target mail server;
2. "helo": SMTP command used to introduce ourselves to the SMTP server
3. "mail from:": SMTP command to identify who mail will be sent from
4. "rcpt to:": SMTP command telling the mail server who to send the e-mail too;
5. "data": SMTP command that instructs the mail server that the text typed after this command is the body of our message;
6. "(enter).(enter)": When we are finished writing our message we will hit the (enter) button, the period".", then another (enter) and the mail will be queued for delivery

---

Action: "telnet smtpmailserver.ontheinternet.com 25": Connect to our SMTP gateway, on port 25, using the telnet client" Response: "220 smtpmailserver.ontheinternet.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713 ready at Mon, 11 Apr 2005 11:15:50 -0400"
Result: You successfully connected to the Server!
Action: "helo": say hello to the gateway Response: "250 smtpmailserver.ontheinternet.com [10.1.1.x]"
Result: The gateway greets you!
Action: "rcpt to: person@targetdomain.com": Who are we sending the e-mail to? Response: "250 2.1.5 person@targetdomain.com"
Result: We are close to sending our spoofed e-mail message!!!Action: "data (then hit enter)": Tell the smtp server we are writing our message next!
Response: "354 Start mail input; end with <CRLF>.<CRLF>": The mail server is telling us to write our message then type "enter" a period ".", then "enter" again
Result: You type your message
Action: "(Hit enter) type "." (Hit enter)": Tell the smtp server we are finished writing our message!
Response: "250 2.6.0 <smtpmailserver WQm21OesnsI0000148e@smtpmailserver.ontheinternet.com> Queued mail for delivery"
Result: The SMTP mail server has just accepted your e-mail for delivery and has queued it for sending!

---

Conclusion

Automating The Process
As you can see, this process is pretty strait forward. Automating the process is quite simple and can be done by writing a script in any number of languages. A script designed to send out mass mail can do so very quickly and efficiently. If you or your companies mail server were to be a target of email relay, it could cause you a lot of trouble. It may even overwhelm your mail server to the point of causing a denial-of-service attack. Effectively preventing you from sending legitimate mail.
Securing Your Mail Server
Preventing mail relay is usually pretty easy to do. On some mail servers it's as easy as checking off a button. Others require a little more effort. For information regarding securing the few e-mail servers I mentioned above you can review the following links:
Microsoft Exchange: Securing Exchange Communications
Novell GroupWise: Secure Message Concepts
Sendmail: Linux: Securing Sendmail

Read More

HOW TO HACK RDP's

Today im sharing u How to Hack Many many Windows VPS.

All u need 2 Softwares called DuBrute and Vnc_scanner to hack VPS.
Download Links :
Vnc_scanner : http://www.mediafire.com/?q8w7waxeajcf6bc#1
Dubrute : http://www.mediafire.com/?dh4ob27iogl6hix

How to Use ?

1) Download both the files from the above link.
2) Extract both the files anywhere in ur pc.
3) Open Vnc_scanner folder
4) Open the exe file called vnc_scanner_gui.exe


5) Select any Country.
6) Click on Get Dial List
After the all ip list Came then :
7) Click on Start Scan


After that it will scan for VPS working ips.


After Scan finished click on Start parser.It will save good ips in new text file called IPs.txt.

Now u need to get the usernames and Passwords for Scanned ips.For that u have to use one of the hacking software called Dubrute.

1) Open Dubrute folder
2) Copy the IPs.txt file from vnc_scanner folder and paste in Dubrute folder
3) Open the DUBrute.exe



4) Click on Generation
5) Check the image below.


1st click on File ip then select the text file called IPs.txt and Open
2nd Select File Login then Open and then File Pass and Open.
3rd ,Click on Make and Press Ok.
Then Click on Exit

Now press Start in ur Dubrute.

Let it brute the combinations.When a working VPS which match IP , Username and Pass , it would be saved in Dubrute folder File called good.txt
http://i.imgur.com/kUanS.jpg
In this Image shows that I found 3 VPS which is working.

Note : Both the files has Virus.Ur anti-virus detect as Trojan etc.So when u download ,if ur anti-virus active then it will delete ur files.If u want to use then u have to turn off ur anti virus.Or u can hack vps with a VPS like me.I downloaded THese files on a VPS and hacked it ;P.These soft i used to hack VPS from last 1-2 weeks.I hacked around 100 working VPS.

This is a Detailed Tutorial about How to hack VPS ?.Should u have more doubt on this , feel free to reply here.am here to help u.
PS: Am posting at Garena section to let every members see and learn how to do it.I hope No1 against this.If neccessary , ill Move the thread

Thanks and Good Luck to all for hack many many VPS.

How to use VPS

Go to Start > Run > Type mstsc and press OK
Then put ur VPS ip and Connect.Then Type ur ID and pass then OK
Thats it.U are into the Virtual Private Server

How to Change Pass of VPS?
Press Ctrl + Alt + End u will see the option for Change pass.
Note : U could change pass if only u have the permission from the Administrator.

Read More