# HTB-Editor ![image](https://hackmd.io/_uploads/SJUb_btCxe.png) ![image](https://hackmd.io/_uploads/SyaqNbYAxl.png) ![image](https://hackmd.io/_uploads/S1weSZKRll.png) ![image](https://hackmd.io/_uploads/r1QhuWFAee.png) ![image](https://hackmd.io/_uploads/H16I_btCxg.png) ![image](https://hackmd.io/_uploads/HJ1ddWF0le.png) ![image](https://hackmd.io/_uploads/S1UCOZtClx.png) I find this [poc](https://github.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC) ![image](https://hackmd.io/_uploads/BJ7h5ZY0ll.png) ![image](https://hackmd.io/_uploads/H1eeh-KCxe.png) ![image](https://hackmd.io/_uploads/ByB_2bFAlx.png) ![image](https://hackmd.io/_uploads/B1A9pWYAee.png) ![image](https://hackmd.io/_uploads/r1Lqp-F0gg.png) Linpeas don't give anything value I started poking around the XWiki installation directory to see if any sensitive configuration files were lying around. A quick look under /usr/lib/xwiki/WEB-INF revealed a promising candidate — hibernate.cfg.xml. https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Installation/InstallationWAR/InstallationMySQL/ ![image](https://hackmd.io/_uploads/rk6glGFCxl.png) Got the credentials theEd1t0rTeam99 and xwiki I try ssh to user oliver:theEd1t0rTeam99 ![image](https://hackmd.io/_uploads/rJRoeftCle.png) I know that oliver user is in the netdata group. ![image](https://hackmd.io/_uploads/HJZ9WztRxg.png) ![image](https://hackmd.io/_uploads/ryIkfzFCxx.png) I Find some SUID binaries, the one that interested is ndsudo and this one is owned by root and can be executed by netdata group. Luckily, oliver user is in the netdata group so we can execute it. When i search `/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo` i found that ndsudo have [CVE-2024-32019](https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation) ![image](https://hackmd.io/_uploads/ByHlBMKCex.png) ![image](https://hackmd.io/_uploads/H1F8rMFCex.png) ![image](https://hackmd.io/_uploads/HkasSMFClg.png) I need to run in my kali and transfer to target machine ![image](https://hackmd.io/_uploads/Sy5AFftRxe.png) ![image](https://hackmd.io/_uploads/B1epqMFRle.png)