Note: This machine is still active on Hack The Box. To respect the platform’s rules and avoid spoiling the experience for other users, this write-up will be published in its entirety once the machine has been retired.

Introduction

“Editor” is an easy-level Linux machine that demonstrates a realistic three-phase attack chain. We’ll start by exploiting a Remote Code Execution (RCE) vulnerability in a web application to gain initial access. Next, we’ll perform lateral movement by taking advantage of poor security practices to compromise a user account. Finally, we’ll abuse a misconfigured SUID binary to elevate our privileges to root.

Phase 1 : Recognition and Initial Access

Service Enumeration

Every engagement begins with reconnaissance. Our first step is an nmap scan of the target.

nmap -sC -sV 10.10.11.80

The scan reveals two open ports : 22 (SSH) and 80 (HTTP). The web service on port 80 redirects us to http://editor.htb, indicating the server uses virtual hosts. To interact with the site, we need to add this entry to our /etc/hosts file.

10.10.11.80 editor.htb

Full write-up coming soon! The rest of this content will be available once the machine is retired from Hack The Box.