Editorial

Editorial is an easy difficulty Linux machine that features a publishing web application vulnerable to Server-Side Request Forgery (SSRF). This vulnerability is leveraged to gain access to an internal running API, which is then leveraged to obtain credentials that lead to SSH access to the machine. Enumerating the system further reveals a Git repository that is leveraged to reveal credentials for a new user. The root user can be obtained by exploiting CVE-2022-24439 and the sudo configuration.

Tasks

Question 1: How many TCP ports are listening on Editorial?

Run nmap -sC -sV -A [TARGET_IP] -Pn to discover open ports.

┌─[au-free-2]─[10.10.14.224]─[aaronamran@htb-jbyobmwxar]─[~]
└──╼ [★]$ nmap -sC -sV -A 10.129.19.96 -Pn
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-14 07:43 EDT
Nmap scan report for 10.129.19.96
Host is up (0.26s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)
|_  256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editorial.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 47.61 seconds

We also need to add the DNS entry to the /etc/hosts file.

┌─[au-free-2]─[10.10.14.224]─[aaronamran@htb-jbyobmwxar]─[~]
└──╼ [★]$ echo "10.129.19.96 editorial.htb" | sudo tee -a /etc/hosts
10.129.19.96 editorial.htb

Answer:

Question 2: What is the primary domain name used by the webserver on editorial box?

Run curl -I [TARGET_IP].

┌─[au-free-2]─[10.10.14.224]─[aaronamran@htb-jbyobmwxar]─[~]
└──╼ [★]$ curl -I 10.129.19.96
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 13 Sep 2026 11:48:40 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://editorial.htb

Opening the website in a web browser and exploring reveals a page with multiple input fields.

Answer: editorial.htb

Question 3: What relative endpoint on the webserver can cause the server to generate an outbound HTTP request?

We open a new terminal and run nc -lvnp 1337 to catch inbound requests. In the website, we display the DevTools Network Tab, enter http://[LOCAL_IP]:1337 into the Cover URL field and click on Preview.

We should see the file name called upload-cover in the Network tab. At the same time, our Netcat listener should successfully receive an inbound request, proving SSRF.

┌─[au-free-2]─[10.10.14.224]─[aaronamran@htb-jbyobmwxar]─[~]
└──╼ [★]$ nc -lvnp 1337
Listening on 0.0.0.0 1337
Connection received on 10.129.19.96 36992
GET / HTTP/1.1
Host: 10.10.14.224:1337
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

Answer: /upload-cover

Question 4: What TCP port is serving another webserver listening only on localhost?

Answer:

Question 5:

Answer:

Question 6: Submit the flag located in the dev user's home directory.

Answer:

Question 7:

Answer:

Question 8:

Answer:

Question 9:

Answer:

Question 10:

Answer:

Question 11:

Answer: