It seems like there is a file extension restriction. I look for more information about the configuration file. The examples given in the exploit Now I started a python server so that the CMS can call my shell files.įor example, a basic php web shell with CMD param. I searched for Cuppa CMS exploit and this seems promisingīasically, we can call a remote file without login to Cuppa CMS.
#Squirrelmail exploit password
I struggle to find the credentials to login to Cuppa CMS (tried with milesdyson credentials to see if password is reused). I followed the steps but the exploit does not work. I searched for possible exploits for squirrelmail (version 1.4.23). Hydra -l milesdyson -P /usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-500.txt ssh I tried to brute-force using hydra with username To summarize, I found three possible ways to gain a foothold into the system. Navigate to this directory and I can see a CMS named “Cuppa CMS”. Initially I had an issue because I didn’t put the backslash for the URL.Īfter I have done so, I ran this command: Inside this important.txt file, I saw that milesdyson have a custom CMS with the link “ There are a bunch of markdowns.īut I spotted a textfile named as “important.txt”. Then I manage to login to milesdyson share.Īt first glance, most of the files are some machine learning pdf. I tried to connect to the SMB milesdyson share with the username and password: To summarize, these are the found credentials: After reading one of the email, I saw that the SMB password for milesdyson was leaked. Once I login as milesdyson, I saw a bunch of emails. Using Burp Intruder, I brute-force the password with username (milesdyson).Įventually, the password for milesdyson is cyborg007haloterminator I ran another command to get the content of the SMB share:Īfter inspecting the content, I found a list of possible passwords (maybe they belong to Miles?).
#Squirrelmail exploit how to
The files look promising to find a clue on how to get the email credentials. I ran the command to connect to the SMB’s anonymous share Now I am going to look at the SMB service running at port 445. So now the goal is to find out the email credential. I don’t have the credentials at the moment. The squirrelmail page is working but I will need the login credentials.
0 kommentar(er)
