This file provides a complete exploitation walkthrough for the "Outbound Mail" machine on Hack The Box (HTB). It covers initial VPN setup, reconnaissance, exploiting Roundcube Webmail via CVE-2025-49113 for remote code execution (RCE), privilege escalation to user via database credential extraction, and root escalation using CVE-2025-27591 (Below Symlink Attack).
1. Preparation & Recon
1.1 Connect to VPN
sudo openvpn --config /path/to/htb.ovpn
1.2 /etc/hosts Configuration
Add the host (replace IP if your instance is different):
echo "10.10.11.XXX mail.outbound.htb" | sudo tee -a /etc/hosts
2. Initial Enumeration
2.1 Nmap Scan
nmap -sC -sV -oN nmap.txt mail.outbound.htb
Open ports:
22 (SSH)
80 (HTTP)
🔐 MACHINE STILL ACTIVE
This machine is currently active on Hack The Box.
As per HTB policy, the complete walkthrough (exploitation & flags) will be published AFTER this machine is retired by HTB (~30-60 days after release).
In the meantime:
✓ Try solving it yourself!
✓ Come back when it's retired for the free solution
Keep grinding! 🎯
Need Help?
Have questions while solving it? Feel free to reach out:
Email: [email protected]
Still looking for guidance? You can always explore more resources here to support your learning journey.
Your support through Ko-fi membership (https://ko-fi.com/andres__) helps create more detailed writeups faster! ❤️
