HackTheBox - Editor
Source: YouTube · IppSec · published Dec 6, 2025 · 38:49
This Hack The Box walkthrough demonstrates a privilege escalation path starting with an XWiki RCE vulnerability and concluding with a SUID binary path hijack.
Key Takeaways:
• The initial vector involves exploiting an outdated XWiki version via malicious Groovy code injection in a search parameter, leading to remote code execution 0:04.
• The attacker retrieves a database password from the Hibernate config file, which is reused for a local user account, allowing SSH access 0:15.
• Privilege escalation is achieved by identifying a vulnerable SUID binary in the Netdata application that is susceptible to path hijacking 0:25.
The video highlights the importance of checking for outdated software and credential reuse in penetration testing scenarios.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ipsac doing an editor from hack the box which is a nice easy box that starts off with finding an outdated version of XWiki that is vulnerable to remote code execution through injecting malicious groovy code into a search parameter with a shell on the box. We can find a database password which is in the hibernate config file and this password is reused for a local account on the box. So we can just SSH in as that user and as them we discover an application called net data is installed which has a set UID binary that is vulnerable to path hijacking. So with that being said let's just jump in. As always we're going to start off with an end map. So - sc for default scripts sv enumerate versions vv for double verbose. This gives us things like the ttl oa output …