HackTheBox — Outbound
Chaining an authenticated RoundCube RCE exploit, MySQL session token harvesting with DES3 decryption, and a CVE-2025-27591 symlink attack via a world-writable log directory to reach root.
Overview
Outbound is a Medium-rated Linux machine that chains together a known RCE exploit against a self-hosted webmail server, credential harvesting from a database, cryptographic decryption of session tokens, and a privilege escalation via a symlink attack on a world-writable log directory (CVE-2025-27591). The path from initial access to root requires patience at each stage — nothing hands itself to you, but every foothold opens a new door if you look in the right places.
The whole engagement reads cleanly as a MITRE ATT&CK kill chain, and the rail on the left tracks it tactic by tactic. Notice the rhythm: each time we gain a new vantage point we discover what it exposes, then convert that into credential access, and repeat — three times over — before the final escalation to root.
Attack chain: RoundCube login as tyler → authenticated RCE (EDB-52324) → shell as www-data → plaintext MySQL creds in web config → harvest RoundCube session records → DES3-decrypt jacob's stored password → escalate to jacob → CVE-2025-27591 symlink via below → root