English  ·  Ελληνικά

Reconnaissance

Two ports, and the web root redirects to a hostname — a hint to start fuzzing vhosts, not paths.

The main site is static — the only thing of note is an email, j.matthew@nexus.htb, in a careers section. Directory brute-forcing finds nothing, so pivot to virtual-host discovery with ffuf, filtering out the default response size:

Add nexus.htb, billing.nexus.htb and git.nexus.htb to /etc/hosts (or drive everything with curl -H "Host: …", which is what I did to keep things scriptable).

Gitea — a password in the first commit

git.nexus.htb is a Gitea instance with one public repo, admin/krayin-docker-setup. Gitea's API makes commit history trivial to walk without a browser:

The .env at HEAD has an empty DB_PASSWORD — but secrets committed once don't disappear when you edit the file, they just move down the history. Fetching .env at the initial commit tells a different story:

Krayin CRM — CVE-2026-38526 → www-data

billing.nexus.htb is a Krayin CRM admin login. The email from the careers page plus the leaked password gets us in — Laravel's login just needs a valid _token pulled from the login form first:

The version (2.2.0, shown under the profile menu) is vulnerable to CVE-2026-38526 — the /admin/tinymce/upload endpoint performs no server-side type or extension validation, and writes into the web-served /storage/tinymce/. So an authenticated user can upload a .php file (spoofing an image MIME to look normal) and then execute it with a plain GET. Rather than the public PoC's reverse shell, I uploaded a small scriptable webshell — no listener to babysit:

Lateral — a second .env → SSH as jones

/etc/passwd shows a real user, jones, whose home we can't read as www-data. But the deployed app carries its own live .env, and it holds a different password from the one in git:

Password reuse does the rest — that value is jones's SSH password. First thing in, drop an SSH key so the foothold is a stable ssh -i rather than a fragile session:

Root — abusing git tree-entry paths in a root sync script

No sudo for jones. The lead is in /etc/systemd/system: a timer fires a root oneshot every minute.

The script (world-readable) queries Gitea for every repo marked as a template, then for each one runs git ls-tree -r HEAD on the bare repo and copies each blob into a staging directory. Here's the whole vulnerability, in three lines:

filepath is attacker-controlled — it's whatever name a tree entry carries — and it flows straight into os.path.join. The quirk that makes this fatal:

So if I can get a tree entry whose name is /etc/cron.d/pwncron, the root process writes my file straight into /etc/cron.d. The blocker is that Git's plumbing (and Gitea's push checks) reject ../ and leading-slash pathnames the normal way. The way through is to forge the git objects by hand — build a raw tree object whose entry name is the absolute path, using hash-object --literally, which skips the sanity checks:

Now create a repo as jones, mark it a template (that's the flag the sync script filters on), and push the forged history. The /tmp/.copybash.sh the cron references just copies bash and sets the SUID bit:

Within a minute the root timer syncs the "template", os.path.join resolves the entry name to /etc/cron.d/pwncron, and root writes it. Cron runs the SUID copy, and bash -p keeps the root EUID:

Why it worked

Operator notes — from macOS

• No reverse shells. A scriptable webshell (?c=) covered the www-data step, and an SSH key covered jones — both stable and non-interactive, so nothing to babysit across a VPN.
• Host headers beat /etc/hosts churn. Every web request used curl -H "Host: …", so no sudo was needed to test the three vhosts.
• The root exploit is git plumbing, not tooling. Nothing macOS-specific — git hash-object -t tree --literally and commit-tree forge the object graph identically everywhere; the trick is understanding that a tree entry's name is just a string in a blob you can author yourself.
• Old secrets live in old commits. Always fetch sensitive files at the first commit, not just HEAD — a cleaned-up .env at the tip is the classic misdirection.

Key commands