Reactor
node. The app's
SQLite database leaked an MD5 password hash that cracked and unlocked SSH. Root came from a
root-owned Node.js process exposing the V8 debug inspector on localhost — attach a
debugger, run code as root.
01Why the full writeup is held back
Reactor is a live Season 11 machine, so — in line with Hack The Box's guidance on active machines — I'm not publishing a step-by-step reproduction. The complete writeup (recon, the RSC RCE, DB looting & hash cracking, and the inspector privesc, with commands and remediation) goes live here once the season closes.
02The interesting bits (no spoilers)
Modern framework RCE — React Server Components
The foothold wasn't a classic web bug — it was a server-side deserialization / action-handling flaw in React Server Components (the "React2Shell" class of issue), triggered through the framework's server-action request handling. A good reminder that new rendering frameworks bring new server-side attack surface, not just client-side.
A debugger left open as root
Privilege escalation came from a root-run Node.js uptime monitor started with --inspect, leaving
the V8 inspector listening on 127.0.0.1:9229. Anyone who can reach that local port can attach
a debugger and execute arbitrary code in the context of the root process — no exploit required.
03Takeaways
- Treat framework internals as attack surface — RSC / server actions need the same input-trust scrutiny as any endpoint.
- Never leave a debug inspector on a privileged process —
--inspecton a root service is remote code execution to anyone on localhost. - App databases are credential stores to an attacker — unsalted MD5 hashes crack instantly; salt + slow hashes, and don't reuse DB passwords for SSH.
- The same lessons I apply defensively: monitor for debug ports, audit service launch flags, and treat every reachable local port as a trust boundary.