root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat outbound.md
// writeups

Outbound

12 Jul 2025 · 15 min read · root access
writeupshacktheboxlinuxEasyretiredvip
Outbound HTB machine

Executive summary — Outbound is a Linux assumed breach machine: we start with a valid credential (tyler:LhKL1o9Nm3X2) for a Roundcube Webmail 1.6.10 running inside a Docker container. A post-auth RCE (CVE-2025-49113) yields a shell as www-data; from there we recover and decrypt another user's IMAP password stored in the database session, an internal email reveals the live password, and we pivot to the real host over SSH; finally, a symlink race in the below binary (CVE-2025-27591) runnable via sudo lets us rewrite /etc/passwd and become root. A Web → RCE → DB → SSH → Root path.

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.129.232.158

Attack map

[80/HTTP]  nginx 1.24.0 → Roundcube Webmail 1.6.10   (Docker container)
   │  CVE-2025-49113 (PHP deserialization, post-auth)  ·  tyler:LhKL1o9Nm3X2
   ▼
[RCE]  reverse shell as www-data   (inside the container, 172.17.0.2)
   │  config.inc.php → des_key  ·  dump the session table (MySQL)
   ▼
[DB]  jacob's IMAP password encrypted (DES-EDE3-CBC) → email with the live password
   │  gY4Wr3a1evp4
   ▼
[SSH]  jacob@10.129.232.158   (real host, outside the container)
   │  sudo -l → NOPASSWD: /usr/bin/below
   ▼
[ROOT]  CVE-2025-27591 (symlink race in below) → chmod 666 /etc/passwd → su root

1. Reconnaissance

We start by mapping the attack surface. A first full-port sweep at high speed and then version + default-script detection on the open ports:

nmap -p- --min-rate 3000 -T4 -Pn 10.129.232.158
nmap -p 22,80 -sC -sV -Pn 10.129.232.158

Why these flags:

  • -p- → scan all 65535 TCP ports.
  • --min-rate 3000 → force at least 3000 packets/second (fast sweep).
  • -Pn → skip host discovery ping; assume the host is up (HTB blocks ICMP).
  • -sC -sV → default NSE scripts + version detection.
22/tcp  open  ssh    OpenSSH 9.6p1 Ubuntu
80/tcp  open  http   nginx 1.24.0

Analysis: only two ports. 80/tcp redirects to the virtual host mail.outbound.htb (without following the redirect, nmap tells us where it points), so the entry vector is the web app. We keep SSH in reserve for later.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.