Outbound writeup & walkthrough

Outbound is a medium HackTheBox Linux machine exploiting Roundcube webmail vulnerabilities (CVE-2025-49113) combined with a secondary CVE to achieve full compromise.

Overview

Access Path

no access => web shell => user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Outbound is a short one - I hadn't pre-prepped the box, so not every command is written up here, but two CVEs carried the exploitation and the rest was credential reuse.

Unfortunately, as I haven't pre-prepped this box, I haven't written all the commands used.

Exploitation

There were 2 CVES mainly used:

• https://github.com/hakaioffsec/CVE-2025-49113-exploit
• https://gist.github.com/strikoder/49a945eeff34362d58ae0eea2caa2fa5

Credentials & Loot

Roundcube stored credentials in its config file, and more were found in the database. The DB values were encrypted, so we decrypted them with the bundled decrypt.sh.

we found creds in cat /var/www/html/roundcube/configs/config.inc.php
Then more creds in the db.
we decrypted that by decrypt.sh in the /var/www/html/roundcube dir.