Fireflow — HTB Writeup | The Hack Sparrow

Executive summary — Behind a corporate landing page, Fireflow hides a Langflow instance vulnerable to CVE-2026-33017: the public build_public_tmp endpoint runs arbitrary Python with no authentication. Langflow's superuser password is reused for the real SSH account. From there, a leaked config file points to an internal service — the «MCP AI Tool Registry» — vulnerable to a classic JWT alg: none bypass that lets an admin token be forged with no signature at all. That fake role registers a malicious tool that gives RCE inside a Kubernetes pod. That pod's ServiceAccount holds an innocuous-looking RBAC permission (get nodes/proxy) that actually grants direct access to the node's Kubelet, from where commands run as root inside a privileged monitoring pod that has the host's root filesystem mounted.

Platform	Hack The Box
Operating system	Linux
Difficulty	Medium
Status	Retired
Target IP	`10.129.37.81`

Attack map

[443] fireflow.htb — Langflow flow_id exposed in the public HTML
   │  CVE-2026-33017 — unauthenticated RCE in Langflow 1.8.2 (build_public_tmp)
   ▼
[RCE]  www-data
   │  Langflow superuser password (.env) reused over SSH (nightfall)
   ▼
[SSH]  nightfall@host  (user.txt)
   │  ~/.mcp/config.json leaks MCP AI Tool Registry credentials (NodePort 30080)
   │  JWT alg:none → forged admin token, no signature needed
   ▼
[RCE]  Malicious tool registered via MCP → Kubernetes pod
   │  Excessive RBAC: get nodes/proxy → Kubelet API (10250)
   ▼
[ROOT]  Kubelet exec on a privileged pod (node-exporter) with host / mounted

1. Reconnaissance

echo "10.129.37.81 fireflow.htb flow.fireflow.htb" | sudo tee -a /etc/hosts

nmap -p- --min-rate=2000 -T4 10.129.37.81 -oN htb_allports.txt

PORT    STATE SERVICE
22/tcp  open  ssh
443/tcp open  https

Only two ports open from outside. Port 80 doesn't even show as filtered in the sweep — nginx actively rejects the connection instead of just redirecting or staying silent.

nmap -p22,443,30080,80 -sV -sC 10.129.37.81 -oN htb_sVsC.txt

22/tcp    open     ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
80/tcp    closed   http
443/tcp   open     ssl/http nginx
| ssl-cert: Subject: commonName=fireflow.htb/organizationName=Task Force Nightfall
| Subject Alternative Name: DNS:fireflow.htb, DNS:*.fireflow.htb
|_http-title: FireFlow — Task Force Nightfall
30080/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Three key clues: the TLS cert carries a wildcard SAN *.fireflow.htb (more vhosts to find); port 30080/tcp shows as filtered — the typical Kubernetes NodePort range (30000-32767), hinting at an internal cluster service only reachable from within; and the HTTP title already gives away the system username (nightfall).

Resumen ejecutivo — Fireflow esconde, detrás de un sitio corporativo, una instancia de Langflow vulnerable a CVE-2026-33017: el endpoint público build_public_tmp ejecuta código Python arbitrario sin autenticación. La contraseña de superusuario de Langflow se reutiliza para la cuenta SSH real. Desde ahí, un fichero de configuración filtrado apunta a un servicio interno — el «MCP AI Tool Registry» — vulnerable a un clásico bypass JWT alg: none que permite forjar un token de administrador sin firma. Con ese rol falso se registra una herramienta maliciosa que da RCE dentro de un pod de Kubernetes. El ServiceAccount de ese pod tiene un permiso RBAC de aspecto inofensivo (get nodes/proxy) que en realidad da acceso directo al Kubelet del nodo, desde donde se ejecutan comandos como root dentro de un pod de monitorización privilegiado que tiene montado el disco raíz del host.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.37.81`

Mapa del ataque

[443] fireflow.htb — flow_id de Langflow expuesto en el HTML público
   │  CVE-2026-33017 — RCE no autenticada en Langflow 1.8.2 (build_public_tmp)
   ▼
[RCE]  www-data
   │  Contraseña de superusuario de Langflow (.env) reutilizada por SSH (nightfall)
   ▼
[SSH]  nightfall@host  (user.txt)
   │  ~/.mcp/config.json filtra credenciales del MCP AI Tool Registry (NodePort 30080)
   │  JWT alg:none → token admin forjado sin firma
   ▼
[RCE]  Tool maliciosa registrada vía MCP → pod Kubernetes
   │  RBAC excesivo: get nodes/proxy → Kubelet API (10250)
   ▼
[ROOT]  Kubelet exec en un pod privilegiado (node-exporter) con / del host montado

1. Reconocimiento

echo "10.129.37.81 fireflow.htb flow.fireflow.htb" | sudo tee -a /etc/hosts

nmap -p- --min-rate=2000 -T4 10.129.37.81 -oN htb_allports.txt

PORT    STATE SERVICE
22/tcp  open  ssh
443/tcp open  https

Solo dos puertos abiertos desde fuera. El puerto 80 ni siquiera aparece como filtered en el barrido — nginx rechaza activamente la conexión en vez de solo redirigir o quedarse en silencio.

nmap -p22,443,30080,80 -sV -sC 10.129.37.81 -oN htb_sVsC.txt

22/tcp    open     ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
80/tcp    closed   http
443/tcp   open     ssl/http nginx
| ssl-cert: Subject: commonName=fireflow.htb/organizationName=Task Force Nightfall
| Subject Alternative Name: DNS:fireflow.htb, DNS:*.fireflow.htb
|_http-title: FireFlow — Task Force Nightfall
30080/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Tres pistas clave: el certificado TLS lleva un SAN wildcard *.fireflow.htb (hay vhosts adicionales por descubrir); el puerto 30080/tcp aparece como filtered — el rango típico de NodePort de Kubernetes (30000-32767), sugiriendo un servicio interno del clúster solo alcanzable desde dentro; y el título HTTP ya anticipa el nombre de usuario del sistema (nightfall).

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account