HackTheBox - Editor Walkthrough (Timestamps Included)
Editor from HackTheBox is an easy level Linux CTF all about program enumeration and public exploits. The foothold involves enumerating a webserver on a non-default port that is running a vulnerable version of XWiki that allows us to get remote code execution. From there we can look around on the box until we find a config file containing a cleartext password that is shared with the oliver user account on the box. Once we have access to the oliver account, we will discover that our group permissions grant us the ability to run ndsudo as the root user. The version of ndsudo has a privilege escalation vulnerability that will allow us to spawn a shell as root and own the box.
Timestamps:
0:00 – Box Introduction
0:33 – Initial Enumeration
3:00 – Discovering a the webserver is running a vulnerable version of XWiki
4:00 – Getting our first shell on the box with the XWiki user
5:58 – Finding cleartext credentials that gives us access to the oliver user
8:04 – Enumerating for a privilege escalation path to root
9:28 - Noticing we can run ndsudo with the SUID permission set
10:49 - Checking for CVE-2024-32019
12:35 - Exploiting CVE-2024-32019 to gain a shell as root
Discord:
/ discord
Disclaimer: This video is for educational and ethical hacking purposes only. The techniques shown are performed in a controlled laboratory environment (HackTheBox) where I have explicit permission to test these systems. Do not attempt to use these techniques on any system, network, or device without prior written authorization from the owner. Unauthorized access to computer systems is illegal and can lead to severe legal consequences. I am not responsible for any misuse of the information provided in this video.
#hackthebox #walkthrough #ctf #ethicalhacking
Sur cette page du site, vous pouvez voir la vidéo en ligne HackTheBox - Editor Walkthrough (Timestamps Included) durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur Cyber Ryan | Cyber Security 05 février 2026, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 646 fois et il a aimé 31 téléspectateurs. Bon visionnage!
