> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ports-and-services/james-server-4555-119-110.md).
# James Server - 4555/119/110
Apache James enumeration across NNTP, remote administration, POP3 mailbox access, password reset abuse, and credential discovery.
### Port 119 - NNTP
> Port 119 uses the Network News Transfer Protocol (NNTP) service. The server runs an instance of Apache James, a mail and news server. Connect with `netcat`, but no relevant information is found.
```bash
nc 10.10.10.51 119
```
### Port 4555 - Remote Administration Tool
> In the context of remote administration, it can be exploited to access control panels or to interact with remote services on the target machine. It is important to scan it to check if it is open and which service it is hosting.
Connect to the James administration panel via Telnet:
```bash
telnet 10.10.10.51 4555
```
Default credentials are found:
* **Username** : root
* **Password** : root
After logging in, the James admin panel allows user enumeration with the `listusers` command. Five users are discovered:
* `user: james`
* `user: thomas`
* `user: john`
* `user: mindy`
* `user: mailadmin`
The `setpassword` command can change user passwords so the mailboxes can be accessed over POP3 on port 110. Change the password for each user:
```ada
setpassword james james
setpassword thomas thomas
setpassword john john
setpassword mindy mindy
setpassword mailadmin mailadmin
```
### Port 110 - POP3
> Port 110 is the standard port used for **POP3** (Post Office Protocol version 3). Email clients use this protocol to retrieve messages from a server.
Connect to the POP3 service via Telnet:
telnet 10.10.10.51 110
Log in with the following commands:
```ada
USER
PASS
```
List the messages with the `list` command.
There are no messages in the `james` and `thomas` mailboxes.
However, the `john` mailbox has a message that can be retrieved with `retr 1`. The message contains the following text:
> John,
>
> Can you restrict Mindy's access until she is allowed to join the program? Also make sure to send her a temporary password so she can log into her accounts.
>
> Thanks in advance.
>
> Regards,/ James
This suggests that the `mindy` user has credentials in the mailbox. The following information is found:
* **Username** : mindy
* **Password** : P\@55W0rd1!2@
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/ports-and-services/james-server-4555-119-110.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)