Forged Emails

Before you start you must be running a mail server. In Kali, the server to use is exim4. Start this service by typing

service exim4 start

You are sending emails to ourselves. Find out what you hostname is by running "hostname".

What is your hostname?
hostname:

We are going to forge an email to ourselves.

Using the normal IP number of localhost, what would be the telnet command needed to telnet to the SMTP port of localhost? This is case-sensitive and space-sensitive. Use only numerical IP and port.
Telnet command:

Use this telnet command (and use QUIT in the telnet session) to test the connection. The MTA (Mail Transport Agent) server should identify itself with a string "ESMTP MTANAME Version". What is the version of the MTA?
MTA version:

We want to forge an email and make it appear that: (1) The sending server is "juggling.com", (2) the email is coming from "dave@rocketman.com", and (3) the email is going to "root@YOURHOST" (where YOURHOST is the hostname you have already discovered for your own virtual machine).

So what are those fields in this case?
Type first? (hint - the helo):
Type second? (hint - from who):
Type third? (hint - to who):

Remember to include the entire line you would type in SMTP. Case and space sensitive, so always use lowercase in answering.

Use the above information to send an email. Use all the details from above. In the email body (the data section) send the following:

From: me@thegovernment.com
To: you@thepeople.com
Date: today
Subject: stupid

Please send me your bank details.
Boss
.

After the body remember to end the block with ".", then end the session with "quit".

In Kali, mail for "root" actually goes to a user called "mail". To read the mail for "mail", do:

su mail -c mail

Note: make sure that their is only 1 email in the mailbox and that the one which is there is the one you are forging. Remember to "q" out of mail.

Run the command:

grep -A 5 "Received:" /var/spool/mail/mail

Validate this by entering the IP number of juggling.com
IP of juggling.com?

Repeat the forged email exercise, but this time include one fake hop. Use the grep information to make the hop identical to the last one, except this time replace 127.0.0.1 with the juggling.com IP and replace the hostname "localhost" with "email.juggling.com". MAKE SURE THAT ALL OTHER EMAIL HAVE BEEN DELETED from root's mailbox.

So if the header was:

Received: from localhost ([::1] helo=juggling.com)
        by host-19-17.linuxzoo.net with smtp (Exim 4.80)
        (envelope-from <dave@rocketman.com>)
        id 1WIgrz-00021U-Ge
        for root@host-19-17.linuxzoo.net; Wed, 26 Feb 2014 15:58:09 +0000