I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is a potential attack but from what I have read, it is not very useful and cannot establish a reverse shell? I looked at some stuff online but the scripts I found all require me to have a login for the squirrel mail service. As this is a test environment, I do not have an account or access to create one. Any ideas would be greatly appreciated.

  • 1
    Maybe you need to enumerate more in order to find the missing creds... In CTFs or pen-testing labs that's usually the case.
    – game0ver
    Commented Oct 30, 2018 at 10:57

1 Answer 1


You may find that many of these XSS attacks (https://www.cvedetails.com/vulnerability-list/vendor_id-803/product_id-1366/year-2018/opxss-1/Squirrelmail-Squirrelmail.html) on Squirrelmail will allow you to perform a session hijack, bypassing the need to create an account, at which point a known vulnerability in 1.4.22 will allow remote code execution: https://www.cvedetails.com/cve/CVE-2017-7692/

If this is a test environment, the XSS attacks would still require a 'victim' to open the mailicious email. If that won't happen, you'll need another approach.

Not the answer you're looking for? Browse other questions tagged .