Pearson's OSCP Notebook

Pidgin

Properties1
tagspidgin, xmpp, jabber, openfire, 5222, 5223, user-enumeration, active-directory, recon

4 min read

Pidgin — XMPP / Jabber Client

What is this for?

Pidgin is a desktop IM client. On OSCP/labs it is used to interact with XMPP/Jabber servers (ports 5222 / 5223) — a protocol that is not HTTP, SMB, or LDAP, so normal web/SMB tools won’t help you talk to it.

OSCP use: When Nmap shows 5222/tcp open (often jabber, Openfire, or XMPP), use Pidgin to register, enumerate users, join chat rooms, and find creds — then pivot to AD attacks (Kerbrute, AS-REP roast, Kerberoast).

Canonical lab: HTB Jab — XMPP user enum → AS-REP → chat room cred leak → dcomexec → Openfire admin.

📌 When You Need Pidgin

You see…Do this
Port 5222 or 5223 openInstall Pidgin, connect via XMPP
Web page offers XMPP/Jabber registrationRegister account → enumerate
Openfire / Prosody / ejabberd in version scanExpect user search + MUC (chat rooms)
Already have XMPP credsAdd second account → check rooms you couldn’t see before

Not for: general “weird protocol” access — use the right client per service (Database, Impacket, etc.).

📌 Installation

sudo apt update && sudo apt install pidgin -y
pidgin &

Optional plugins are built-in — enable from Tools → Plugins after launch.

📌 Account Setup (First Connection)

  1. Accounts → Manage Accounts → Add
  2. Protocol: XMPP
  3. Username: anything (e.g. testuser) — many servers allow open registration
  4. Domain: domain.htb (e.g. jab.htb)
  5. Password: choose any (registration often unrestricted)
  6. Advanced tab (if connection fails):
    • Port: 5222 (or 5223 for direct TLS)
    • Connection security: try Allow plaintext auth over unencrypted streams on labs (no real TLS)
    • Connect server: domain.htb or target IP
Username:  testuser
Domain:    jab.htb
Resource:  (leave default)
Password:  anything
Port:      5222

If registration fails, check the web UI on port 80/443 — some boxes expose a signup page.

📌 Essential Plugins

Tools → Plugins — enable:

PluginPurpose
XMPP ConsoleView/send raw XML stanzas — capture user search results
XMPP Service DiscoveryList services (MUC, search, etc.) on the server

📌 User Enumeration

GUI method (easiest)

  1. Accounts → your account → Search for Users…
  2. Search field: * (wildcard — returns all users)
  3. Copy results from GUI or capture XML in XMPP Console

Export users for AD attacks

Save XMPP Console output to a file, then parse:

grep jab.htb xmpp.txt | awk -F\> '{print $2}' | awk -F@ '{print $1}' | sort -u > users.txt

See full pipeline breakdown: Pipelines & Chaining

Feed into Kerberos attacks

# AS-REP roast (accounts without preauth)
impacket-GetNPUsers jab.htb/ -dc-ip 10.10.10.10 -no-pass -usersfile users.txt -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# Valid user check
kerbrute userenum --dc 10.10.10.10 -d jab.htb users.txt

📌 Chat Room Enumeration (MUC)

After logging in with valid domain creds, new rooms may appear.

  1. Buddies → Join Chat… (or Room List)
  2. Conference server: conference.domain.htb (e.g. conference.jab.htb)
  3. Find Rooms → join each room
  4. Read history for cleartext passwords, pentest notes, internal hostnames
Low-priv account  →  few/no rooms
Valid AD creds    →  private rooms (e.g. pentest2003) with leaked hashes/passwords

Room names and conference subdomain vary — use XMPP Service Discovery if unsure.

📌 Raw XML User Search (XMPP Console)

If GUI search is limited, send search stanza via XMPP Console (adapt domain):

<iq type="set" id="search1" to="search.jab.htb" xmlns="jabber:client">
  <query xmlns="jabber:iq:search">
    <username>*</username>
  </query>
</iq>

Copy XML response → save as xmpp.txt → run Pipelines & Chaining extraction.

📌 Brute Force (Secondary)

Prefer user enum + AS-REP over spraying. If needed:

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 10.10.10.10 xmpp -s 5222 -t 4 -f

See Hydra — xmpp module.

📌 HTB Jab — Full Attack Chain

1. Nmap → 5222/tcp open (XMPP)
2. Pidgin → register testuser@jab.htb
3. Search for Users (*) → 2000+ domain users → users.txt
4. GetNPUsers → crack AS-REP hash → jmontgomery creds
5. Pidgin → login as jmontgomery → join pentest2003 room
6. Read chat → svc_openfire password + Kerberoast mention
7. impacket-dcomexec → shell as svc_openfire
8. Openfire admin on localhost:9090 → malicious plugin → SYSTEM

📌 Troubleshooting

ProblemFix
Connection refusedConfirm 5222 open; try target IP instead of hostname
Auth failed on registerCheck web UI for signup; try different username
Plaintext auth disabledAdvanced → allow plaintext on unencrypted stream
No rooms visibleNeed higher-priv creds — enum users first, roast/spray
Empty user searchEnable XMPP Console; try raw XML to search.domain.htb

📌 Quick Copy/Paste

# Install
sudo apt install pidgin -y
 
# After Pidgin user search → parse users
grep domain.htb xmpp.txt | awk -F\> '{print $2}' | awk -F@ '{print $1}' | sort -u > users.txt
 
# AS-REP roast
impacket-GetNPUsers domain.htb/ -dc-ip DC_IP -no-pass -usersfile users.txt -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# Hydra (if needed)
hydra -L users.txt -P passwords.txt TARGET xmpp -s 5222 -t 4 -f

Graph View

Backlinks