<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=text/html;charset=utf-8 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16588"></HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody leftMargin=0 topMargin=0 bgColor=#ffffff
CanvasTabStop="true" name="Compose message area">
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A
title="mailto:Kit@simplysites.net
CTRL + Click to follow link"
href="mailto:Kit@simplysites.net">Kit Wong</A> </DIV>
<DIV><B>Sent:</B> Wednesday, July 21, 2010 7:58 AM</DIV>
<DIV><B>To:</B> <A title=blueonyx@blueonyx.it
href="mailto:blueonyx@blueonyx.it">BlueOnyx General Mailing List</A> </DIV>
<DIV><B>Cc:</B> <A title=blueonyx@blueonyx.it
href="mailto:blueonyx@blueonyx.it">BlueOnyx General Mailing List</A> </DIV>
<DIV><B>Subject:</B> [BlueOnyx:05084] Re: OT get username + password frompop3
connections</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV>Hey chuck</DIV>
<DIV><BR></DIV>
<DIV>Fantastic. I knew someone will know a trick on this list. Thanks
everyone</DIV>
<DIV><BR></DIV>
<DIV>Kit<BR><BR>Sent from my iPhone</DIV>
<DIV><BR>On 21 Jul 2010, at 07:38, Chuck Tetlow <<A
href="mailto:chuck@tetlow.net">chuck@tetlow.net</A>> wrote:<BR><BR></DIV>
<DIV></DIV>
<BLOCKQUOTE type="cite">
<DIV>OK, yes there is a way to get that. And maybe I shouldn't be
passing along this trick. But someone needs help. So I pass it
along and just hope no one on this list will abuse this ability. <BR><BR>Log
into the server and change user to root. Once root, you can run a
program called "tcpdump". <BR><BR>This program that is built right into most
flavors of Linux. It gives you the ability to pull raw network layer 2
data right out of the interface. And there a LOT of options to tell it
what you want and how to display it. Most of the data requires knowledge
of the Ethernet layer and the TCP protocol of the network layer. But to
get this password, you can look for some key words. <BR><BR>First, to make it
easy - get the IP address of that user who is checking his e-mail via
POP. Once you have the IP address of that user, use the command
<BR>tcpdump -An host xxx.xxx.xxx.xxx and tcp port 110 <BR><BR>That command
will dump the actual raw ASCII data (-A switch) and display in numeric without
name lookups (-n switch). You must tell it the host the connection is
coming from with the keyword "host" followed by the IP address. You are
filtering further by telling it "and" to add another filter rule, and "tcp
port 110" is the port the POP3 protocol operates on. <BR><BR>What you'll wind
up with is data from the TCP port 110 connection coming from that user.
But you get everything - all the TCP handshakes as it sets up the connection,
checks the mail, and clears the connection. It could result in a lot of
lines of data. Hopefully, it will only be 20 lines per POP check (if
there was no e-mai). <BR><BR>Look in the lines of ASCII data for the keywords
"USER" and a few lines down "PASS". This is the originating computer's
e-mail client telling the dovecot POP server the user's name for login,
followed by the user's password. <BR><BR>Here is an example from a local test
I did (to be sure it still worked before I sent this out): <BR><BR><FONT
size=2>01:06:06.677763 IP 98.23.181.194.61112 > 216.54.43.14.pop3: P
1:13(12) ack 21 win 65320 <BR>E..4e@.t..,b....6.|...n......].P..(....<SPAN
style="FONT-WEIGHT: bold">USER bettyboop</SPAN> <BR><BR>01:06:06.677782 IP
216.54.43.14.pop3 > 98.23.181.194.61112: . ack 13 win 5840
<BR>E..(..@.@.^h.6.|b....n....].....P....... <BR>01:06:06.677829 IP
216.54.43.14.pop3 > 98.23.181.194.61112: P 21:26(5) ack 13 win 5840
<BR>E..-..@.@.^b.6.|b....n....].....P.......+OK <BR><BR>01:06:06.705538 IP
98.23.181.194.61112 > 216.54.43.14.pop3: P 13:26(13) ack 26 win 65315
<BR>E..5e.@.t..)b....6.|...n......].P..#B$..<SPAN
style="FONT-WEIGHT: bold">PASS agu51167</SPAN> <BR></FONT><BR>As you can see,
the user is identified by "USER" and the username "bettyboop". Then the
password is sent to the dovecot server with "PASS" identification and the
actual password "agu51167". <BR><BR>So - there you go. A method to
recover a user's password <SPAN style="FONT-WEIGHT: bold">IF</SPAN> the user
still has a working e-mail client. <BR><BR>Good luck Kit.
<BR><BR><BR><BR>Chuck <BR><BR><BR><BR>P.S. - For the jokers out there - don't
bother trying those user names or IP addresses. I've changed them just
enough to prevent any exploitation. Or as the show stated "The names
have been changed to protect the innocent". <BR><BR><BR><BR><FONT
size=2><BR><B>---------- Original Message -----------</B> <BR>From: Kit Wong
<<A href="mailto:Kit@simplysites.net">Kit@simplysites.net</A>> <BR>To:
"<A href="mailto:blueonyx@blueonyx.it">blueonyx@blueonyx.it</A>" <<A
href="mailto:blueonyx@blueonyx.it">blueonyx@blueonyx.it</A>> <BR>Sent: Tue,
20 Jul 2010 19:40:57 +0100 <BR>Subject: [BlueOnyx:05079] OT get username
+ password from pop3 connections <BR><BR>> Hi all <BR>> <BR>> It may
sound stupid but I have a client who has a pop3 connector that connects to my
bluequartz to pick up emails. The trouble is that he doesn't know how to
change the password on his system but I had to change it my end and I don't
know the original one I sent him. <BR>> <BR>> The question is: is there
a way to view what his server is using to try to authenticate? I know the
username and am getting a lot of failures in var/log/maillog and also
/var/log/messages <BR>> <BR>> It's dovecot / sendmail bluequartz if it
helps. I know this <BR>> <BR>> Thanks in advance <BR>> <BR>> It's
<BR>> <BR>> _______________________________________________ <BR>>
Blueonyx mailing list <BR>> <A
href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</A> <BR>> <A
href="http://www.blueonyx.it/mailman/listinfo/blueonyx" target=_blank><A
href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</A></A>
<BR><B>------- End of Original Message -------</B>
<BR></FONT></DIV></BLOCKQUOTE>
<BLOCKQUOTE type="cite">
<DIV><SPAN>_______________________________________________</SPAN><BR><SPAN>Blueonyx
mailing list</SPAN><BR><SPAN><A
href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</A></SPAN><BR><SPAN><A
href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</A></SPAN><BR></DIV></BLOCKQUOTE>
<P>
<HR>
<P></P>
<DIV>_______________________________________________<BR>Blueonyx mailing
list<BR>Blueonyx@blueonyx.it<BR><A
href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</A></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>emm??? not tricks, just info out there. I
reckon we should be much more aware of these. </FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>dsniff is much easier --- just throws
out the info you need.</FONT></DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial></FONT> </DIV>
<DIV><FONT size=2 face=Arial>regards</FONT></DIV>
<DIV> </DIV>
<DIV><BR></DIV></BODY></HTML>