• Search for:

    Monthly Archives: October 2026

    1. Home  - 2026  - 
    2. October
    10 Oct, 2026
    Hack The Box: Devhub Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , , , , ,

    Completed another Hack The Box machine: Devhub (Medium).

    Devhub was a great exercise in exploring modern development tooling, service misconfigurations, and Linux privilege escalation. The journey began with web enumeration and identifying an exposed MCP Inspector service. Further investigation revealed a command injection vulnerability that provided initial access to the machine.

    From there, internal service enumeration uncovered a localhost-only Jupyter instance. Accessing it through SSH port forwarding and investigating its authentication mechanism opened the path to another user. The final stage involved examining an internal operations service, understanding its exposed functionality, and identifying a weakness that ultimately led to root access.

    Devhub highlights how development tools, internal services, and poorly secured administrative functionality can create unexpected attack paths when combined. Another valuable machine for practising enumeration, lateral movement between local users, and privilege escalation.

    #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #MCP #InfoSec …

    Learn MoreHack The Box: Devhub Machine Walkthrough – Medium Difficulty

    3 Oct, 2026
    Hack The Box: Reactor Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , , , , ,

    Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.

    The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.

    From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.

    For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.

    I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.

    Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.

    #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …

    Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty