DevArea hosts a freelance developer marketplace backed by several web applications on different stacks. I’ll find a JAR file on an open FTP server that matches one of the web services that uses a vulnerable version of Apache CXF. I’ll abuse its attachment handling to read arbitrary files off the host. Those files leak credentials for a Hoverfly API simulation instance, where a command injection in the middleware feature gives a shell as the first user. From there I’ll pivot through a custom SysWatch monitoring app, forging a session cookie with a secret pulled from a world-readable environment file and slipping a command past a weak input filter to run as the service account. Finally, I’ll exploit a flawed symlink check in a script that account runs as root to read the root login key and get a shell. In Beyond Root I’ll explore why I couldn’t read user.txt from the initial file read, and look at the admin password from the syswatch application.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox machine 'DevArea', a multi-service Linux target. The attack chain starts with anonymous FTP access to download a Java JAR file, reverse engineering it to identify a vulnerable Apache CXF 3.2.14 SOAP service. CVE-2022-46364 (SSRF/arbitrary file read via XOP:Include in MTOM requests) is exploited to read files including /proc process listings, leaking Hoverfly credentials. CVE-2025-54123, a command injection in Hoverfly's middleware API, then yields a shell as dev_ryan. Privilege escalation proceeds through a custom SysWatch monitoring app by forging a session cookie and bypassing a weak input filter, then exploiting a flawed symlink check in a root-run script to read the root SSH key.

HTB: DevArea