Editor — HTB Writeup | The Hack Sparrow

Executive summary — Editor combines an unauthenticated RCE in XWiki (CVE-2025-24893: the guest-accessible SolrSearch search macro evaluates its parameter as wiki syntax, letting an attacker break out of context and inject a {{groovy}} macro that runs on the server) with a classic password reuse into the real SSH account. The final escalation is CVE-2024-32019: a $PATH hijack against Netdata's SUID ndsudo binary, with a non-obvious twist — a bash helper doesn't work, because bash itself drops the inherited privilege; an interpreter that doesn't enforce that protection is needed instead.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.231.23`

Attack map

[8080] XWiki 15.10.8 — unauthenticated SolrSearch macro
   │  CVE-2025-24893 — wiki syntax injection → {{groovy}} macro → RCE
   ▼
[RCE]  xwiki (uid 997)
   │  MySQL password in hibernate.cfg.xml reused over SSH
   ▼
[SSH]  oliver@editor.htb  (user.txt)
   │  oliver in the netdata group → SUID ndsudo resolved via $PATH
   │  CVE-2024-32019 — bash helper fails (drops euid); Python does not
   ▼
[ROOT]  malicious Python helper via $PATH → root-owned SUID bash → root.txt

1. Reconnaissance

The lab environment didn't allow writing to /etc/hosts without sudo, so most enumeration was done directly against the IP, setting the Host: header by hand wherever it mattered:

echo "10.129.231.23 editor.htb" | sudo tee -a /etc/hosts

ping -c 3 10.129.231.23

64 bytes from 10.129.231.23: icmp_seq=3 ttl=63 time=97.4 ms

TTL 63 (from the 64 band) confirms Linux with no significant intermediate hops.

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN nmap_allports.txt 10.129.231.23

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy

nmap -sT -sCV -p22,80,8080 -Pn -oN nmap_services.txt 10.129.231.23

22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editor.htb/
8080/tcp open  http    Jetty 10.0.20
| http-robots.txt: 50 disallowed entries ... /xwiki/bin/...
|_http-title: XWiki - Main - Intro
|_Requested resource was http://10.129.231.23:8080/xwiki/bin/view/Main/

Two clear clues: port 80 redirects to editor.htb (virtual hosting in play), and port 8080's robots.txt gives away by itself that this is an XWiki instance running on Jetty — without even opening the site.

curl -s -H "Host: editor.htb" http://10.129.231.23/ -o editor_index.html
grep -oiE '<title>[^<]*' editor_index.html

<title>Editor - SimplistCode Pro

Port 80 is a static Vite-style SPA with nothing directly exploitable — the real vector is XWiki, so its exact version is confirmed first via the unauthenticated REST endpoint:

curl -s "http://10.129.231.23:8080/xwiki/rest/"

<xwiki ...><version>15.10.8</version></xwiki>

XWiki 15.10.8 — the version affected by CVE-2025-24893 (vulnerable range: < 15.10.11 and < 16.4.1).

Resumen ejecutivo — Editor combina una RCE no autenticada en XWiki (CVE-2025-24893: la macro de búsqueda SolrSearch, accesible a cualquier invitado, evalúa su parámetro como sintaxis wiki, lo que permite escapar del contexto e inyectar una macro {{groovy}} ejecutada en el servidor) con una clásica reutilización de contraseña hacia la cuenta SSH real. La escalada final es CVE-2024-32019: un secuestro de $PATH sobre el binario SUID ndsudo de Netdata, con un matiz poco intuitivo — un helper escrito en bash no sirve para explotarlo, porque el propio bash renuncia al privilegio heredado; hace falta un intérprete que no aplique esa protección.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.231.23`

Mapa del ataque

[8080] XWiki 15.10.8 — macro SolrSearch accesible sin autenticar
   │  CVE-2025-24893 — inyección de sintaxis wiki → macro {{groovy}} → RCE
   ▼
[RCE]  xwiki (uid 997)
   │  Contraseña de MySQL en hibernate.cfg.xml reutilizada por SSH
   ▼
[SSH]  oliver@editor.htb  (user.txt)
   │  oliver ∈ grupo netdata → ndsudo (SUID root) resoluble vía $PATH
   │  CVE-2024-32019 — helper en bash falla (descarta el euid); Python no
   ▼
[ROOT]  helper Python malicioso vía $PATH → bash SUID propiedad de root → root.txt

1. Reconocimiento

El laboratorio no permitía escribir en /etc/hosts sin sudo, así que gran parte de la enumeración se hizo directamente contra la IP, fijando la cabecera Host: a mano donde hacía falta:

echo "10.129.231.23 editor.htb" | sudo tee -a /etc/hosts

ping -c 3 10.129.231.23

64 bytes from 10.129.231.23: icmp_seq=3 ttl=63 time=97.4 ms

TTL 63 (banda de 64) confirma un Linux sin saltos intermedios significativos.

nmap -sT -p- --min-rate 3000 -T4 -Pn -oN nmap_allports.txt 10.129.231.23

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy

nmap -sT -sCV -p22,80,8080 -Pn -oN nmap_services.txt 10.129.231.23

22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editor.htb/
8080/tcp open  http    Jetty 10.0.20
| http-robots.txt: 50 disallowed entries ... /xwiki/bin/...
|_http-title: XWiki - Main - Intro
|_Requested resource was http://10.129.231.23:8080/xwiki/bin/view/Main/

Dos pistas claras: el puerto 80 redirige a editor.htb (hay virtual hosting), y el robots.txt del puerto 8080 delata por sí solo que se trata de una instancia XWiki corriendo sobre Jetty — sin necesidad de abrir el sitio siquiera.

curl -s -H "Host: editor.htb" http://10.129.231.23/ -o editor_index.html
grep -oiE '<title>[^<]*' editor_index.html

<title>Editor - SimplistCode Pro

El puerto 80 es un sitio estático tipo SPA (Vite) sin funcionalidad explotable directa — el vector real está en XWiki, así que confirmamos su versión exacta antes de nada por el endpoint REST, que no requiere autenticación:

curl -s "http://10.129.231.23:8080/xwiki/rest/"

<xwiki ...><version>15.10.8</version></xwiki>

XWiki 15.10.8 — versión afectada por CVE-2025-24893 (rango vulnerable: < 15.10.11 y < 16.4.1).

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.