search

HTB | Editor

Machine - https://app.hackthebox.com/machines/Editorarrow-up-right

IP - 10.129.51.204

Machine Information - Services may take up to 5 minutes to load.

hashtag
NMAP

└─$ nmap -sT -p- --min-rate 10000 10.129.51.204 -Pn -oA nmap_ports
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-03 13:19 IST
Warning: 10.129.51.204 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.51.204
Host is up (0.31s latency).
Not shown: 50541 filtered tcp ports (no-response), 14991 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 195.52 seconds

└─$ nmap -sC -sV -p 22,80,8080 10.129.51.204 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-03 13:23 IST
Nmap scan report for editor.htb (10.129.51.204)
Host is up (0.30s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Editor - SimplistCode Pro
8080/tcp open  http    Jetty 10.0.20
|_http-open-proxy: Proxy might be redirecting requests
| http-robots.txt: 50 disallowed entries (15 shown)
| /xwiki/bin/viewattachrev/ /xwiki/bin/viewrev/ 
| /xwiki/bin/pdf/ /xwiki/bin/edit/ /xwiki/bin/create/ 
| /xwiki/bin/inline/ /xwiki/bin/preview/ /xwiki/bin/save/ 
| /xwiki/bin/saveandcontinue/ /xwiki/bin/rollback/ /xwiki/bin/deleteversions/ 
| /xwiki/bin/cancel/ /xwiki/bin/delete/ /xwiki/bin/deletespace/ 
|_/xwiki/bin/undelete/
| http-webdav-scan: 
|   Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, LOCK, UNLOCK
|   WebDAV type: Unknown
|_  Server Type: Jetty(10.0.20)
| http-title: XWiki - Main - Intro
|_Requested resource was <http://editor.htb:8080/xwiki/bin/view/Main/>
| http-methods: 
|_  Potentially risky methods: PROPFIND LOCK UNLOCK
|_http-server-header: Jetty(10.0.20)
| http-cookie-flags: 
|   /: 
|     JSESSIONID: 
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 19.79 seconds

hashtag
Port 80

hashtag
Port 8080

hashtag
Robots.txt

hashtag
Foothold/ shell

hashtag
Shell as oliver

hashtag
CVE-2025-24893

We know the version of XWiki XWiki Debian 15.10.8

After searching, we found CVE-2025-24893arrow-up-right

CVE-2025-24893 is a critical unauthenticated remote code execution (RCE) vulnerability in XWiki, a popular open-source enterprise wiki platform. The flaw resides in how the SolrSearch macro improperly handles Groovy expressions inside search queries. This allows unauthenticated attackers to execute arbitrary Groovy code remotely—without any authentication or prior access.

We found the exploit on GitHubarrow-up-right

and we were able to exploit this

We can get the shell via busybox

on listener

On looking around, we found the password

I also found another password

and we are in as oliver via theEd1t0rTeam99 and found user.txt

hashtag
Privilege Escalation

We are in the Netdata group

In Readable files belonging to root and readable by me, but not world readable, I found something interesting /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo

When I ran this, I got below

I found an advisoryarrow-up-right

The ndsudo tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions.

hashtag
Details

The ndsudo tool is packaged as a root-owned executable with the SUID bit set.

It only runs a restricted set of external commands, but its search paths are supplied by the PATH environment variable. This allows an attacker to control where ndsudo looks for these commands, which may be a path the attacker has write access to.

hashtag
PoC

As a user that has permission to run ndsudo:

  1. Place an executable with a name that is on ndsudo’s list of commands (e.g. nvme) in a writable path

  2. Set the PATH environment variable so that it contains this path

  3. Run ndsudo with a command that will run the aforementioned executable

hashtag
Impact

Local privilege escalation.

Now let’s try this

And we have root.txt

PreviousHTB | EraNextHTB | Previous

Last updated