Hackthebox Reactor Complete Writeup - CVE-2025-55182 Next.js RCE, SQLite Credential Dump, MD5 Cracking & Node.js Inspector PrivEsc
Reactor is a HackTheBox Medium Linux machine running a Next.js 15.0.3 web application on port 3000. The attack chain starts with CVE-2025-55182, a critical unauthenticated RCE in Next.js that allows arbitrary command execution via a crafted React Flight payload, landing a shell as the node user. Post-exploitation reveals a SQLite database containing MD5-hashed credentials for two users. Hashcat cracks the engineer hash against rockyou.txt in seconds. Direct SSH does not work so lateral movement is achieved via su from the existing shell, recovering the user flag. Privilege escalation abuses a Node.js Inspector debug socket on localhost port 9229, using the node inspect client to execute system commands via child_process.execSync and read the root flag directly.
May 31, 2026