Outbound

Platform: HackTheBox | Category: Machines | Type: Machine | Difficulty: Easy | OS: Linux | Author: DonutMaster | Date: 2025-11-16 | Status: Solved Techniques: Roundcube Webmail Deserialization RCE (CVE-2025-49113), 3DES Session Decryption, Roundcube Session Database Extraction, Sudo/Below Symlink Privilege Escalation (CVE-2025-27591)

Summary

Walkthrough of the HackTheBox Easy machine Outbound (Linux). Foothold via Roundcube Webmail RCE (CVE-2025-49113) using provided initial credentials (tyler). Lateral movement via database config keys and 3DES session decryption to extract credentials for jacob. Privilege escalation via CVE-2025-27591 (below command symlink to /etc/passwd).

Recon

Port Scan

 bash read-only • copy allowed Copy
rustscan -a outbound.htb -- -A

Foothold

Exploitation (CVE-2025-49113)

1. Navigate to Roundcube Webmail (mail.outbound.htb) and log in with provided credentials (tyler / LhKL1o9Nm3X2).
2. Exploit Roundcube remote code execution vulnerability (CVE-2025-49113) using public exploit scripts to achieve RCE as www-data.
3. Switch user to tyler using stored credentials.

Privilege Escalation

Lateral Movement & Root

1. Inspect Roundcube configuration config.inc.php for database credentials and des_key.
2. Query MySQL roundcube database session table, decrypt 3DES session data using des_key to retrieve credentials for jacob.
3. SSH in as jacob.
4. Exploit below binary privilege escalation vulnerability (CVE-2025-27591) by setting a symlink from /var/log/below/error_root.log to /etc/passwd to append a root user line.

Flags

Key Takeaways / Lessons

• Keep webmail software like Roundcube patched against gadget-chain deserialization and RCE vulnerabilities.
• Ensure proper file permission checks on log directories exposed to sudo-enabled administrative binaries.