I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is a potential attack but from what I have read, it is not very useful and cannot establish a reverse shell? I looked at some stuff online but the scripts I found all require me to have a login for the squirrel mail service. As this is a test environment, I do not have an account or access to create one. Any ideas would be greatly appreciated.

closed as off-topic by kasperd, Steffen Ullrich, forest, Tom K., Conor Mancone Nov 8 '18 at 13:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – kasperd, Steffen Ullrich, forest, Tom K., Conor Mancone
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Maybe you need to enumerate more in order to find the missing creds... In CTFs or pen-testing labs that's usually the case. – game0ver Oct 30 '18 at 10:57

You may find that many of these XSS attacks (https://www.cvedetails.com/vulnerability-list/vendor_id-803/product_id-1366/year-2018/opxss-1/Squirrelmail-Squirrelmail.html) on Squirrelmail will allow you to perform a session hijack, bypassing the need to create an account, at which point a known vulnerability in 1.4.22 will allow remote code execution: https://www.cvedetails.com/cve/CVE-2017-7692/

If this is a test environment, the XSS attacks would still require a 'victim' to open the mailicious email. If that won't happen, you'll need another approach.

Not the answer you're looking for? Browse other questions tagged or ask your own question.