HackTheBox - Reactor
Source: YouTube · IppSec · published Oct 3, 2026 · 32:11
BLUF: This video demonstrates a walkthrough of the Hack the Box "Reactor" machine, highlighting passive fingerprinting techniques to identify a vulnerable React version and exploiting a Node.js debug interface for root access 0:30.
Key Takeaways:
• Passive enumeration is preferred over active scanning to avoid detection; the presenter uses the React DevTools browser extension to identify the React version (19.0.0-rc.0) without triggering alerts 3:30.
• The primary foothold is achieved via "Reactor to Shell" (CVE-2024-55182), an RCE vulnerability in React 19 that exploits the Flight protocol's handling of promises and blobs to execute arbitrary JavaScript code 11:26.
• After gaining initial access, the attacker discovers a Node.js debug interface listening on localhost port 9229, which allows for remote code execution via the node inspect command 22:46.
• The intended path to root involves connecting Chrome DevTools to this debug port to execute commands directly within the Node.js environment, bypassing the need for complex reverse shell payloads 29:00.
• An alternative privilege escalation path exists via cracking a password from an SQLite database, which reveals credentials for an engineer user account that can SSH into the box 26:30.
Closing Statement: The exercise underscores the importance of understanding framework internals, such as React's Flight protocol, and the risks associated with exposing debug interfaces in production environments.
Sources:
- 0:30 Introduction to passive detection vs active scanning.
- 3:30 Using React DevTools to identify version 19.0.0-rc.0.
- 11:26 Explanation of CVE-2024-55182 (Reactor to Shell).
- 22:46 Discovery of the Node.js debug port 9229.
- 29:00 Connecting Chrome DevTools to the debug interface for root access.
- 26:30 Cracking database hashes for an alternative user shell.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing Reactor from Hack the Box, which is a pretty simple box that really just has two steps. So to keep things interesting, I'll show a few ways to enumerate the foothold, which is the infamous React to shell. The exploit is pretty straightforward, but many of the tools that are used to enumerate this vulnerability just launch the React to shell exploit itself. We'll dig into how to fingerprint the version of React, as not only is this a more reliable way to find the vulnerability, but also it's a technique that ages very well, as we can check for many CVEs instead of just this one. Oh, and also while launching safe exploits probably won't land you in hot water legally speaking, I still like to avoid it when possible, especially dur…