SMTP

Linux machine chaining SMTP user enumeration, a CSRF-token-aware brute force of Roundcube Webmail, CVE-2025-49113 remote code execution, and sudo apt-get privilege escalation to root.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Linux machine using default Apache James admin credentials to read mail and reset passwords, exploiting a James 2.3.2 RCE to escape a restricted shell, then hijacking a root cron job for full root.

Windows box driven by macro-based phishing, hMailServer database credential recovery, lateral movement over RDP, and Veeam Backup exploitation.

Windows machine starting from a phishing LibreOffice document, abusing IIS web root access, and escalating with SeImpersonatePrivilege via GodPotato and RunasCs.