HackTheBox - DevHub

BLUF: This video demonstrates rooting the "DevHub" HackTheBox machine by exploiting an RCE vulnerability in MCP Jam to gain initial access, then leveraging a local Jupyter Notebook token for lateral movement, and finally abusing a custom web server's SSH key reading feature to obtain root access 0:00-0:34.

Key Takeaways:
• Initial enumeration reveals an MCP Jam instance on port 6274, which is identified as version 1.4.2 and exploited using a known CVE to achieve remote code execution and gain a shell as the mcpdev user 2:15-5:01.
• Process enumeration reveals a Jupyter Notebook running locally on port 8888 with a token leaked in the command line, allowing the attacker to authenticate and execute code as the analyst user via port forwarding 7:50-12:53.
• The analyst user can access a custom Flask web server on localhost:5000 that requires an API key to read SSH keys, enabling the retrieval of the root private key 13:31-19:42.
• Using the obtained root SSH key, the attacker logs in as root and completes the box 19:42-20:07.

The machine highlights the importance of checking local services and process arguments for leaked credentials after gaining initial foothold.

Sources:

• 2:15 Identification of MCP Jam version 1.4.2 and discovery of the RCE exploit.
• 5:01 Successful exploitation of the CVE to gain initial shell access.
• 7:50 Discovery of the Jupyter Notebook process and leaked authentication token.
• 12:53 Lateral movement to the analyst user via Jupyter Notebook.
• 13:31 Analysis of the custom web server and its SSH key reading functionality.
• 19:42 Retrieval of the root SSH key and final access to the machine.