DevHub Writeup - HackTheBox

Medium Linux

Discuss on Discord

Last updated June 14, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

┌──(kali㉿kali)-[~]

└─$ nmap -p- -T4 --min-rate 1000 --open --max-retries 2 $TARGET_IP -oA $TARGET_IP-tcp-ports

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
6274/tcp open  unknown

Three open ports. Port 80 is nginx and port 6274 responds to HTTP with an application title. Service scan on all three:

┌──(kali㉿kali)-[~]

└─$ nmap -sC -sV -p 22,80,6274 -T4 $TARGET_IP -oA $TARGET_IP-tcp-full

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devhub.htb/
6274/tcp open  unknown
| fingerprint-strings:
|   GetRequest:
|     HTTP/1.1 200 OK
|     access-control-allow-credentials: true
|     content-type: text/html; charset=utf-8
|     <title>MCPJam Inspector</title>
<snip>
|   HTTPOptions, RTSPRequest:
|     HTTP/1.1 204 No Content
|     access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
<snip>
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 80 redirects to devhub.htb. Port 6274 serves an HTTP application: MCPJam Inspector.

┌──(kali㉿kali)-[~]

└─$ echo '$TARGET_IP $DOMAIN' | sudo tee -a '/etc/hosts' >/dev/null

[+] Added: $TARGET_IP → $DOMAIN

Confirming port 80 resolves:

┌──(kali㉿kali)-[~]

└─$ curl -I $DOMAIN

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Content-Length: 3396

Port 6274 returns the MCPJam Inspector SPA:

┌──(kali㉿kali)-[~]

└─$ curl $DOMAIN:6274

<title>MCPJam Inspector</title>
<script type="module" crossorigin src="/assets/index-DRYhT9Xb.js"></script>

Browsing to port 6274 in a browser shows MCPJam Inspector v1.4.2.

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.