HackTheBox - Outbound
Source: YouTube · IppSec · published Nov 15, 2025 · 27:30
[BLUF] This video demonstrates an outbound attack from Hack The Box using a known RCE vulnerability in RoundCube, followed by credential harvesting from PHP sessions 2:15.
Key Takeaways:
• The target is Hack The Box, starting with credentials for RoundCube webmail 0:05.
• The application runs version 1.6.10, which is vulnerable to post-authentication Remote Code Execution (RCE) 0:14.
• Exploiting the RCE grants initial access to the server 0:17.
• RoundCube stores user credentials in encrypted form within PHP sessions to interact with mail services 0:21.
• Attacker can dump active PHP sessions to retrieve plaintext user credentials without cracking 0:33.
• Harvested credentials allow access to additional mailboxes, expanding the attack surface 0:38.
The technique highlights the critical risk of stored credentials in session files and the importance of patching known RCE vulnerabilities in web applications.
Sources:
- 0:05 Introduction to the Hack The Box target and RoundCube credentials
- 0:14 Identification of RoundCube version and RCE vulnerability
- 0:17 Execution of RCE to gain initial access
- 0:21 Explanation of how RoundCube handles user credentials in PHP sessions
- 0:33 Dumping PHP sessions to extract credentials without cracking
- 0:38 Using harvested credentials to access ot
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and we'll be doing outbound from hack the box which is an assumed breach box. So we start out with a set of credentials and in this case they go to RoundCube which is a popular web interface to email. Once we log in we discover it is running version 1.6.10 which is vulnerable to post authentication rce which gets us onto the box and this is where it gets somewhat interesting. RoundCube stores the user credentials encrypted inside of the PHP session. I believe this because RoundCube may interact with mail services like SMTP or IMAP. So the app needs to know the user password. But anyways, since it's there, we can dump the PHP sessions and get all the active user credentials without any cracking. This leads us to another mailbox that contains an SSH pass…