> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/credentials/mail-spool/trick-0120.md).

# Extract SSH Password From Email Via POP3

***

Connect to the target's POP3 service, typically running on port 110, using `nc` or `telnet`. The standard, unencrypted POP3 service operates on port 110.

```bash
nc <target_ip> 110
```

Alternatively, using `telnet`:

```bash
telnet <target_ip> 110
```

Once connected, the server should respond with a greeting, usually starting with `+OK`. This indicates the server is ready. Authentication is then performed using the compromised username and password with the `USER` and `PASS` commands.

The `USER` command specifies the user name.

```
USER <valid_user>
```

The server should respond with `+OK` if the user name is accepted, or `-ERR` if not.

The `PASS` command specifies the password for the user name given with the `USER` command.

```
PASS <valid_password>
```

If the credentials are valid, the server typically responds with `+OK`. If the username and password combination is invalid, the server will respond with `-ERR`.

After successful authentication, the session enters the Transaction state. To identify potentially interesting messages, use the `STAT` command to get the mailbox status and the `LIST` command to list messages.

The `STAT` command returns the number of messages in the mailbox and the total size in octets.

```
STAT
```

A typical response is `+OK 2 320`, indicating 2 messages with a total size of 320 octets.

The `LIST` command provides a list of message numbers and their sizes.

```
LIST
```

The output will show the message numbers and their sizes in octets. For example:

```
+OK 2 messages (1234 octets)
1 567
2 667
.
```

The list is terminated by a line containing a single period (`.`).

Finally, retrieve the desired message by its number using `RETR <message_number>`.

```
RETR <message_number>
```

The server responds with `+OK <size> octets` followed by the full email content of the specified message. The message content is sent until a line containing a single period is encountered, indicating the end of the message. Examine the retrieved email content for credentials or other sensitive data.

Other useful commands include `QUIT` to terminate the session. The `QUIT` command causes the server to drop the connection after possibly deleting messages marked for deletion (if the server is configured to do so).

```
QUIT
```

The server typically responds with `+OK POP3 server signing off`.