Nexus — Local Privilege Escalation PoC

Gitea template-sync path traversal via forged Git objects → root

A proof-of-concept privilege-escalation exploit for the HackTheBox machine Nexus. A root-owned systemd service synchronizes Gitea template repositories to disk without sanitizing entry names, allowing an authenticated low-privileged user to write arbitrary files as root through directory traversal — used here to implant an SSH key into /root/.ssh/authorized_keys.

⚠️ Disclaimer

This code is provided for educational purposes and authorized security testing only — i.e. lab environments such as HackTheBox, or systems you own or have explicit written permission to test. Unauthorized use against systems you do not control is illegal. The author assumes no liability for misuse.

If the Nexus machine is still active on HackTheBox, do not publish or share this exploit — HTB rules prohibit distributing solutions to active machines.

Vulnerability Summary

The synchronization script reads files from repositories flagged as templates in Gitea and writes them to the local filesystem. The destination path is built roughly as:

dest = os.path.join(base_dir, name)   # name comes straight from the Git tree
open(dest, "w").write(content)

os.path.join() does not neutralize .. sequences. A tree entry whose name is a traversal path (e.g. ../../../../../root/.ssh/authorized_keys) therefore makes the privileged process write outside the intended directory.

Why forged Git objects?

Git stores content and names separately:

• a blob holds a file's raw content (no name);
• a tree maps name → object (this is where the filename lives);
• a commit points to a top-level tree.

The filename in a tree entry is just text, so it can be .. — but the standard Git client refuses to create such an entry, precisely to prevent this attack.

This PoC bypasses that client-side check by writing raw Git objects directly into .git/objects/ (computing the SHA-1 ids by hand) and crafting refs/heads/main manually. The pushed repository then contains a tree entry named .., which the root sync process resolves and follows.

Attack Chain (full box context)

1. Foothold — Krayin CRM unrestricted file upload (CVE-2026-38526) → RCE as www-data.
2. Lateral movement — plaintext credentials in the production .env, reused as a system password → SSH as a low-priv user.
3. Privilege escalation — this PoC → root.

The recurring theme across all three stages: a privileged process trusting attacker-controlled data without validation (a spoofed MIME type, a reused password, an unsanitized filename).

Requirements

• Run on the target host, as the authenticated low-priv user.
• Gitea reachable at http://localhost:3000.
• git, python3, curl, and ssh available (default on the box).

Usage

chmod +x nexus_privesc.sh
./nexus_privesc.sh -t <TARGET_IP> -u <GITEA_USER> -p <GITEA_PASS> [-d DEPTH]

Example:

./nexus_privesc.sh -t 10.129.21.192 -u jones -p 'REDACTED' -d 5

What the script does

1. Generates an ed25519 SSH key pair (/tmp/.exploit_key).
2. Requests a Gitea API token via basic auth.
3. Creates a repository and flags it as a template.
4. Forges raw Git objects encoding a .. traversal tree that maps to /root/.ssh/authorized_keys, with the attacker public key as content.
5. Pushes the poisoned repository.
6. Waits for the root-owned sync timer (~60s).
7. Logs in as root with the implanted key.

Monitor the sync on the target with:

tail -f /var/log/template-sync.log

A successful run logs a line like:

synced: ../../../../../root/.ssh/authorized_keys

Tuning DEPTH

DEPTH is the number of .. levels needed to climb from the sync/staging directory up to filesystem root (/). If the sync succeeds in the log but the root SSH fails, the traversal landed at the wrong level — retry with -d 4 or -d 6. The exact value can be confirmed by reading the staging path in /etc/gitea/template-sync.py.

Remediation

• Never build filesystem paths from untrusted names with os.path.join() alone. Normalize and confine paths, e.g.:

  root@kitploit:~

  base = os.path.realpath(base_dir)
  dest = os.path.realpath(os.path.join(base, name))
  if not dest.startswith(base + os.sep):
      raise ValueError("path traversal blocked")
  

• Reject tree entry names containing .., absolute paths, or path separators.

• Run the sync service under a dedicated low-privileged account, not root.

• Enable receive.fsckObjects = true in Gitea to reject malformed pushed objects.

References

• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
• CVE-2026-38526 — Krayin CRM unrestricted file upload (foothold stage)
• Git internals — objects (blob / tree / commit): https://git-scm.com/book/en/v2/Git-Internals-Git-Objects
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation

Author

<your name / handle> — for educational use on HackTheBox.