search

HTB | Previous

Machine - https://app.hackthebox.com/machines/Previousarrow-up-right

IP - 10.10.11.83

hashtag
NMAP

└─$ nmap -sC -sV -p 22,80 10.10.11.83 -Pn -oA nmap_port_details
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-08-26 09:32 IST
Nmap scan report for previous.htb (10.10.11.83)
Host is up (0.27s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: PreviousJS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 23.19 seconds

hashtag
Port 80

directory enum

whatweb

found a user jeremy

On looking around we found a callback URL to localhost:3000

hashtag
Foothold/Shell

hashtag
Shell as Jeremy

hashtag
CVE-2025-29927

We found that Next JS 15.2.2 is using

We found the CVE-2025-29927arrow-up-right for that version

Next.js uses middleware to enforce security policies such as authentication and authorization before routing requests. To avoid infinite loops during internal redirects or server-side rendering (SSR), it includes a special header x-middleware-subrequest in internal requests.

The flaw lies in the fact that this header is blindly trusted by the framework without verifying its origin. An attacker can spoof this header in a request, tricking the server into skipping the middleware layer entirely. This effectively bypasses all access control logic enforced by middleware, granting unauthorized access to protected routes.

Now we need to find out the endpoint

We can add X-Middleware-Subrequest: middleware:middleware:middleware:middleware:middleware header (refer - https://github.com/UNICORDev/exploit-CVE-2025-29927arrow-up-right)

We can see the docs

Looking around the docs, we found the endpoint http://previous.htb/api/download?example=hello-world.ts

We can read /etc/passwd

We can also read the environment variable

We can also confirm NEXTAUTH usage

the package.json confirms this is a Next.js app with NextAuth. That’s a big hint because NextAuth always requires secrets (NEXTAUTH_SECRET, NEXTAUTH_URL, plus provider credentials like GitHub/Google/LDAP/etc.).

we found NEXTAUTH_SECRET

Asking ChatGPT for some endpoints, and one of them revealed Jeremy’s credentials

Let’s use prettier for a better understanding

And we can SSH as Jeremy and found user.txt

hashtag
Privilege Escalation

We can run teraform as root

we can see the main.tf

  • It defines a variable source_path, defaulting to /root/examples/hello-world.ts.

  • Validation forces the value to contain /root/examples/ and blocks ...

  • It uses a custom provider: previous.htb/terraform/examples.

  • The resource examples_example takes that file as input and produces some destination_path.

Let’ find the provider binary because In Terraform, terraform itself is just an orchestrator. All the "real work" (like creating files, copying stuff, running code) is done by provider binaries.

Now we can create our terraform-provider-examples and we can change the pointing of the previous.htb/terraform/examples to our provider path

Now we can have root

and get root.txt

PreviousHTB | EditorNextHTB | Angler

Last updated