search

HTB | Outbound

Machine - https://app.hackthebox.com/machines/Outboundarrow-up-right

IP - 10.129.214.156

Machine Information - As is common in real life pentests, you will start the Outbound box with credentials for the following account tyler / LhKL1o9Nm3X2

hashtag
NMAP

└─$ nmap -sC -sV -p 22,80 10.129.105.204 -Pn -oA nmap_port_details                                                                              
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-07-14 20:21 IST
Nmap scan report for 10.129.105.204
Host is up (0.59s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to <http://mail.outbound.htb/>
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 59.22 seconds

hashtag
Port 80

It’s a Roundcube mail login page

Since we have the credentials, let’s try to login

We found it’s version

hashtag
Foothold/ shell

hashtag
Shell as ?

hashtag
CVE‑2025‑49113

on looking for Roundcube Webmail 1.6.10 exploit we found CVE‑2025‑49113arrow-up-right

A critical vulnerability has been discovered in Roundcube Webmail (versions < 1.5.10 and 1.6.0–1.6.10) that allows authenticated users to perform remote code execution through a PHP object deserialization flaw triggered by improper validation of the _from parameter in program/actions/settings/upload.php. The flaw carries a CVSS 3.1 score of 9.9 (Critical)

We found thisarrow-up-right POC on GitHub

Now we have to confirm whether it is hitting our machine or not

Nice, we are getting hit. Now we have to get the shell

hashtag
Docker

We are in a docker environment since dockerenv file in the / directory.

hashtag
SQL

We found credentials to the roundcube db

When I was trying to use MySQL (mysql -u roundcube -pRCDBPass2025), it was stuck and not going anywhere, probably because it'll try to spawn a MySQL shell, which won't be directed to my terminal, cos it's technically outside bash

Now there are three way

  1. Transfer chisel to port forward the SQL port and access it on your local machine

  2. Transfer a Meterpreter shell

  3. look for and transfer the database

Now I don’t want to go for 1 and 2, so I will be dumping the database and transfer it to my system

Since I do not know the password (so no scp) I will base64 encode the db and decrypt it on my machine

Now first we need to make a db on our local

Now we need to import the roundcube db

Now we can confirm that db is imported or not

Now let’s look at users

Let's also take a look at the session table.

I can see 7 rows but the important one is the oldest one

the var is base64 encoded

hashtag
Decrypting jacob password

The password here is:

This is usually encrypted, not plaintext. Roundcube by default encrypts the password in session using a secret key defined in config.inc.php:

from ChatGPT I got this script

Now, let’s try to authenticate as Jacob

hashtag
Email for Jacob

SSH failed, but we can login to roundcube mail

We can see the new password was rested by tyler for jacob

and we are in with the new password and found user.txt

hashtag
Privilege Escalation

We can run /usr/bin/below with any arguments, except:

  • -config

  • -debug

  • d (short for -debug)

below is a performance monitoring tool (Rust-based), similar to top, with config parsing and TUI rendering. It may invoke external programs, read files, or use unsafe libraries (if exploitable).

There is a feature to record the data but for some reason it is not recording but we found the location

Nothing was there in the data file

hashtag
CVE-2025-27591

We found the advisoryarrow-up-right for CVE-2025-27591, and according to which

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Taking a look around, we can find error files in /var/log/below, interestingly enough error_root.log is writeable.

Let's try to symlink this file to some other file that we can see and that can potentially allow us to escalate privileges, I chose /etc/passwd because it doesn't have any permission restrictions unlike /etc/sudoers.

Next let's run any below command that'll error out, as root.

Now let's check /etc/passwd

Success! We have read write permissions on /etc/passwd. Let's add an entry and swap to that user

And we got the root.txt

Another way is to use thisarrow-up-right POC to get root

PreviousHTB | ArtificialNextHTB | Era

Last updated