pentesteasy
Pochta (Mail)
hackerlab
Task: Compromise a Roundcube Webmail server. Solution: Discover exposed update.zip backup via directory enumeration, extract MySQL credentials from config.inc.php, reuse credentials for IMAP login, then exploit CVE-2025-49113 (authenticated RCE via PHP deserialization) to get shell and read the flag.
$ ls tags/ techniques/
backup_file_discoveryblind_rceconfig_credential_extractioncredential_reusecve_exploitation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]