>_ 0xDext3r

esc

#mysql

1 writeup(s) tagged mysql.

Outbound

Outbound

Outbound is an easy-difficulty Linux machine with provided assumed breach credentials. The credentials provide access to a Roundcube instance, where the user can enumerate the version and utilize CVE-2025-49113, which demonstrates post-authenticated remote code execution via PHP object deserialization. After initial access to the target, we enumerate the database and find a session for the Jacob user, which, when base64 decoded, provides an encrypted password. Using an internal tool called decrypt.sh, we can extract the plaintext value of the password, which allows access to Roundcube as Jacob. Jacob has two messages in his inbox: one provides him with a new, updated password for the system, and another informs him that they have been granted sudo privileges to monitor system resources with a utility called below which is vulnerable to CVE-2025-27591 that is a flaw that creates logs within the /var/log/below directory with excessive permissions allowing attackers to perform symlink attacks under certain conditions. We symlink /etc/passwd to the error_root.log file and write our payload to the log file via parameter injection, thereby creating a new user with a UID of the root user.

2026-10-21 Easy Hackthebox

Browse other tags

#active-directory 8 #post-exploitation 6 #enumeration 4 #pentest-reference 4 #red-team 4 #acl-abuse 3 #ad 3 #bloodhound 3 #certipy 3 #dcsync 3 #kerberoasting 3 #local-privilege-escalation 3 #reverse-shell 3 #certificate-abuse 2 #hackthebox 2 #impacket 2 #kerberos 2 #lateral-movement 2 #mitre-att&ck 2 #privilege-escalation 2 #rid brute 2 #windows 2 #3des 1 #ACL-exploitation 1 #CVE-2025-24893 1 #CVE-2025-64714 1 #CVE-2026-23744 1 #SeBackupPrivilege 1 #adcs 1 #adsi 1 #aiohttp 1 #amsi-bypass 1 #antivirus-evasion 1 #arcane-api 1 #azure 1 #azurehound 1 #backup scripts 1 #blue-team 1 #certificaterequest 1 #cif 1 #cip 1 #cip-objects 1 #command-injection 1 #credential-leak 1 #credential-reuse 1 #cve-2024-23334 1 #cve-2024-23346 1 #cypher 1 #dacl 1 #delegation-abuse 1 #dll-injection 1 #docker 1 #docker-group-abuse 1 #domain-trusts 1 #dpapi 1 #eaphammer 1 #edr-bypass 1 #ethernet-ip 1 #etw-patching 1 #evil-twin 1 #fontforge 1 #gMSA 1 #git-exposure 1 #godpotato 1 #groovy-template-injection 1 #hashcat 1 #hibernate.cfg.xml 1 #htb-writeup 1 #ics 1 #identity-object 1 #industrial-control-systems 1 #keepass 1 #ldap 1 #ldapsearch 1 #lfi-template-cookie 1 #ligolo 1 #ligolo-ng 1 #linux 1 #linux-privilege-escalation 1 #llmnr-poisoning 1 #lolbas 1 #malware-development 1 #mcpjam-inspector 1 #message-router 1 #ms-sql 1 #mschapv2 1 #mysql 1 #mysql-creds 1 #ndsudo 1 #neo4j 1 #netdata 1 #netntlm 1 #newgrp 1 #ntdll-unhooking 1 #ntlm-relay 1 #ot-security 1 #pass-the-hash 1 #password-spraying 1 #path-manipulation 1 #peap 1 #penetration-testing 1 #petitpotam 1 #php-webshell 1 #pivoting 1 #plc 1 #powershell 1 #powerview 1 #privatebin 1 #privileged-container 1 #process-injection 1 #protocol-enumeration 1 #pymatgen 1 #python 1 #radius 1 #rbcd 1 #remotepotato 1 #rogue-ap 1 #roundcube 1 #rubeus 1 #rundll32 1 #s4u2proxy 1 #s4u2self 1 #secretsdump 1 #seimpersonate 1 #session-hijack 1 #setuid-binary 1 #sharphound 1 #sharpview 1 #shellcode-encryption 1 #smb 1 #spn-jacking 1 #ssh 1 #ssh-key-injection 1 #ssh-login 1 #ssti 1 #sudo-misconfiguration 1 #suid 1 #timeroasting 1 #uac-bypass 1 #unauthenticated-rce 1 #utf-16le 1 #web-exploitation 1 #wifi-exploitation 1 #wireless 1 #wmi 1 #wpa-eap 1 #xp_dirtree 1 #xss 1 #xwiki 1