Back to writeups
HTBmachineEasysolved

Nexus

13 Jul 2026 · by 0xIDA

Solvers

Nexus (HTB) — Writeup

Solvers

  • solve_chain.sh

  • Platform: HackTheBox Machine

  • Machine ID: 948

  • Name: Nexus

  • OS: Linux

  • Difficulty: Easy

  • Author: 0xIDA

  • Status: Free / Retired

  • IP (session): 10.129.48.201

  • **Writeup author: 0xIDA

  • Date: 2026-07-13

Flags

TypeFlagSubmit status
User29f19606881550c14c5e3c6e4e273fbcOwned (adventure completed=true; UI/API)
Rootcdbfa3fb8c1ed9b00e720aa11057789dSubmitted via POST /api/v5/machine/own

Official writeup

  • PDF: `
  • Text: `
  • API: GET /api/v4/machine/writeup/948

HTB API notes (machine own)

  • Flag submit is POST https://labs.hackthebox.com/api/v5/machine/own with {"id": <machine_id>, "flag": "<32hex>"}.
  • /api/v4/machine/own does not exist (404).
  • Progress check: GET /api/v4/machines/{id}/adventure → user/root completed flags.
  • Hermes HTB MCP updated to use v5 for own (rebuild /root/htb-mcp-server/htb-mcp-server).

Chain

User

  1. Hosts: nexus.htb, git.nexus.htb, billing.nexus.htb
  2. Careers → j.matthew@nexus.htb
  3. Gitea krayin-docker-setup commit history → password y27xb3ha!!74GbR
  4. Intended: Krayin CRM 2.2.0 CVE-2026-38526 file upload → www-data → same password in app .env
  5. Fast path: ssh jones@IP with y27xb3ha!!74GbR → user.txt

Root — Gitea template-sync path traversal

  • Timer: gitea-template-sync.timer (~1 min)
  • Script: /etc/gitea/template-sync.py uses os.path.join(stage_path, filepath) without sanitizing .. from git ls-tree
  • Create template repo as jones, push crafted trees so filepath is ../../../../../root/.ssh/authorized_keys
  • Wait for sync log: synced: ../../../../../root/.ssh/authorized_keys
  • ssh -i rootkey root@IP → root.txt

Commands (this session)

sshpass -p 'y27xb3ha!!74GbR' ssh jones@10.129.48.201 'cat user.txt'
# 29f19606881550c14c5e3c6e4e273fbc

# Gitea API create template repo + raw object push (build.py) + wait timer
ssh -i  root@10.129.48.201 'cat /root/root.txt'
# cdbfa3fb8c1ed9b00e720aa11057789d

curl -X POST https://labs.hackthebox.com/api/v5/machine/own \
  -H "Authorization: Bearer $HTB_TOKEN" -H 'Content-Type: application/json' \
  -H 'Origin: https://app.hackthebox.com' \
  -d '{"id":948,"flag":"cdbfa3fb8c1ed9b00e720aa11057789d"}'

Paths

  • `
  • `
  • Root key: `