I am going to set up a mail server that will be later used as an SMTP relay server. First off, a new Ubuntu droplet was created in Digital Ocean:
Postfix MTA was installed on the droplet with:
apt-get install postfix
During postfix installation, I set
nodspot.com as the mail name. After the installation, this can be checked/changed here:
root@ubuntu-s-1vcpu-1gb-sfo2-01:~# cat /etc/mailnamenodspot.com
DNS records for nodspot.com has to be updated like so:
Once postfix is installed and the DNS records are configured, we can test if the mail server is running by:
telnet mail.nodspot.com 25
If successful, you should see something like this:
We can further test if the mail server works by trying to send an actual email like so:
root@ubuntu-s-1vcpu-1gb-sfo2-01:~# sendmail firstname.lastname@example.org,.
Soon enough, the email comes to my gmail:
...with the following headers - all as expected. Note that at this point the originating IP seen in headers is my droplet IP 18.104.22.168:
Delivered-To: email@example.comReceived: by 2002:a81:1157:0:0:0:0:0 with SMTP id 84-v6csp5026946ywr;Tue, 2 Oct 2018 12:22:38 -0700 (PDT)X-Google-Smtp-Source: ACcGV62oH69fwYnfV1zg+o+jbTpjQIzIzASmjoIsXbbfvdevE0LlkY32jflNS/acOtNBXiwzxYxPX-Received: by 2002:a62:6547:: with SMTP id z68-v6mr17716388pfb.20.1538508158395;Tue, 02 Oct 2018 12:22:38 -0700 (PDT)ARC-Seal: i=1; a=rsa-sha256; t=1538508158; cv=none;d=google.com; s=arc-20160816;b=FpEgLAICLn66cI+DDvpIsStUrReQ8fArcreT7FyS8SYcFQXFiK44HDcxwVHXCA8XxbfUl+3HcerQEznHZMttZ4pZIMbN18pJS08wzuZdOlhGKAA2JSTkxGd+1PhJwDe1SFTYZcNoARSHL9opemJKg5YqZNjSTDSTfk/QqaCbq7mQL9LAwCKzanGSNR/R/28WymYrdRACORGSmDCVvPaUaoemIP8+GwXkfU5Gkk49+F7t9Jbg23HKKq/YOhwF3ryeOEVfn74bhtZIkMQcUzWn5WSL0lIm0nbd2t7677/wcabOg0TCoZj1IHg+I7yLXE7+QZOYX1TguKu16oZeqtmTIA==ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;h=from:date:message-id;bh=VSFU9fKoMQMmtQzPFdmefDuA+phTpwZXd9k5xGRzwRs=;b=VZ2vHjhPUSs17PXAUDyjYzm0w5sdQYqFx7h9iirh/BF1krrl3MQg4QAgfeo0py9qZHXf8/9HmNe1pIgxnZiiZJeVijXeSHCIB4XkG4HYFJY2m/gQ9oZ4JSMfX/Kiw/CXEmbt71YP5S7yQKQNkHw24XnP3WUeDDQ7XvENEfPIS+LlCVtQOPT8fM9TAWQReKz06idynolfhR7P73wH8igwPea7586wdhSOtDYCURSMKTNVb8yP2eEPNBlP2u2jUrFImG2D2/lke4O6Iu7zu96tCYEY9FVG11dPFheKlMjvMoL4rqPSAQ3zty4Cbi4Vy2Is6f/VF8AYZ34i0FJoojeEkw==ARC-Authentication-Results: i=1; mx.google.com;spf=pass (google.com: domain of firstname.lastname@example.org designates 22.214.171.124 as permitted sender) email@example.comReturn-Path: <firstname.lastname@example.org>Received: from ubuntu-s-1vcpu-1gb-sfo2-01 ([126.96.36.199])by mx.google.com with ESMTP id 38-v6si3160283pgr.237.2018.10.02.12.22.38for <email@example.com>;Tue, 02 Oct 2018 12:22:38 -0700 (PDT)Received-SPF: pass (google.com: domain of firstname.lastname@example.org designates 188.8.131.52 as permitted sender) client-ip=184.108.40.206;Authentication-Results: mx.google.com;spf=pass (google.com: domain of email@example.com designates 220.127.116.11 as permitted sender) firstname.lastname@example.orgReceived: by ubuntu-s-1vcpu-1gb-sfo2-01 (Postfix, from userid 0) id DC6DD3F156; Tue,2 Oct 2018 19:22:37 +0000 (UTC)Message-Id: <20181002192237.DC6DD3F156@ubuntu-s-1vcpu-1gb-sfo2-01>Date: Tue,2 Oct 2018 19:22:31 +0000 (UTC)From: root <email@example.com>yolo,
We need to set up the originating mail server that will use the server we set up earlier as a relay server. To achieve this, on my attacking machine, I installed postfix mail server.
The next thing to do is to amend the
/etc/postfix/main.cf and set the
relayhost=nodspot.comwhich will make the outgoing emails from the attacking system travel to the nodspot.com mail server (the server we set up above) first:
Once the change is made and the postfix server is rebooted, we can try sending a test email from the attacking server:
If you do not receive the email, make sure that the relay server is not denying access for the attacking machine. If you see your emails getting deferred (on your attacking machine) with the below message, it is exactly what is happening:
Once the relay issue is solved, we can repeat the test and see a successful relay:
This time the headers look like so:
Note how this time we are observing the originating host's details such as a host name and an IP address - this is unwanted and we want to redact that information out.
We need to make some configuration changes in the relay server in order to redact the headers for outgoing emails.
First off, let's create a file on the server that contains regular expressions that will hunt for the headers that we want removed:
/etc/postfix/header_checks/^Received:.*/ IGNORE/^X-Originating-IP:/ IGNORE/^X-Mailer:/ IGNORE/^Mime-Version:/ IGNORE
Next we need to amend the
/etc/postfix/master.cf to include the following line:
This will tell the postfix server to remove headers from outgoing emails that match regular expressions found in the file we created above.
Save the changes and reload the postfix server:
postmap /etc/postfix/header_checkspostfix reload
Now send a test email from the attacking machine again and inspect the headers of that email:
Note how the
Received headers exposing the originating (the attacking) machine were removed, which is exactly what we wanted to achieve:
Delivered-To: firstname.lastname@example.orgReceived: by 2002:a81:1157:0:0:0:0:0 with SMTP id 84-v6csp5668508ywr;Wed, 3 Oct 2018 03:47:35 -0700 (PDT)X-Google-Smtp-Source: ACcGV614wuffoVOsvFkTPPxCiRj0hgFwTIH7y3B4ziIaXfogLFjsoiFyYOdNVChhr+oRcL1axO+aX-Received: by 2002:a17:902:a9cc:: with SMTP id b12-v6mr988630plr.198.1538563655360;Wed, 03 Oct 2018 03:47:35 -0700 (PDT)ARC-Seal: i=1; a=rsa-sha256; t=1538563655; cv=none;d=google.com; s=arc-20160816;b=qhbzI+R3vHbkqwp2ALOEQ0ItUXU/fA1kEmYln1dBe0CmLELuIfourst4gZVYiU0tAfsRx20Z5Vcqvv9w6s6f2gVp6crlOuoX2cSKJCn/HyRYKiDB5aVKpEYTDjQtGEBRLoL9xm/T8+3PgV6CHy/KowoPeLugKg3t5mIh9pq+Ig8gG+VVKZcFyvUBJa9YEgBgVKcMwew8H6x8WzIB2zyavpZLnbIi6SrtheYZAeSTMTwXRutqxZl0n4O/iZS4Y+ZVdRlYeXFXFNdtMKJFaS1XVLR4hYXOzlQT1IC2yeQlqf+Q3FJukmkDlDTgw91ImfZa0HtQYQoo3LwKotp92Q1HiQ==ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;h=from:date:message-id;bh=hZH42YPrA1C1YyKkQ/LM0S6pyh9p5LGmoqE/s4CGGts=;b=Squ71HtAuuwYHfX+4z63WcgBMoiKbcX5KAQLKwfvlnXuF5QEJNHjfX0GwekViXJIZ5D2v03648ni6W3/b6uXVoecrtX0MZ9Z/Ck+LxcJRi16toE4QfjR6fhX5l9OSKFjgqkst3Exk9yB1iiX8IAoIvnSaT0pQ5UzOov5Yneti3HO8QbzeCnT1/HieLwIhB/d+znryw1mTQjj/VBlNEGFEJhpXjS7cbQFHQEz3yGl1YTSNB3Kxp9T5a7+ncsW3pOAlfKqNYpVywSlBes6OUSTZ/bEwVYP3dv9aHmbpOIV6rC8uPgUlm+SKYtlj9xiR9uXTtj21IbA0F1esFx+UpjAQw==ARC-Authentication-Results: i=1; mx.google.com;spf=pass (google.com: domain of email@example.com designates 18.104.22.168 as permitted sender) firstname.lastname@example.orgReturn-Path: <email@example.com>Received: from ubuntu-s-1vcpu-1gb-sfo2-01 ([22.214.171.124])by mx.google.com with ESMTP id y11-v6si1190446plg.237.2018.10.03.03.47.35for <firstname.lastname@example.org>;Wed, 03 Oct 2018 03:47:35 -0700 (PDT)Received-SPF: pass (google.com: domain of email@example.com designates 126.96.36.199 as permitted sender) client-ip=188.8.131.52;Authentication-Results: mx.google.com;Message-Id: <20181003104734.1871F42006E@kali>Date: Wed, 3 Oct 2018 11:47:28 +0100 (BST)From: root <firstname.lastname@example.org>removing traces like a sir
This lab is not going to deal with the emails being marked as phishing by gmail. This, however, is related to setting up DKIM, PTR records and the likes, see below for more references.