--- title: "HTB: DevArea" url: https://daily.dev/posts/htb-devarea-og8fxznar source_url: https://0xdf.gitlab.io/2026/07/04/htb-devarea.html type: article source: "0xdf hacks stuff" published: 2026-07-04T17:59:56.644Z updated: 2026-07-04T18:00:21.539Z tags: ["security", "java"] reading_time: 46 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: DevArea **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 46 min read · 0 upvotes · 0 comments ## Summary A detailed walkthrough of the HackTheBox machine 'DevArea', a multi-service Linux target. The attack chain starts with anonymous FTP access to download a Java JAR file, reverse engineering it to identify a vulnerable Apache CXF 3.2.14 SOAP service. CVE-2022-46364 (SSRF/arbitrary file read via XOP:Include in MTOM requests) is exploited to read files including /proc process listings, leaking Hoverfly credentials. CVE-2025-54123, a command injection in Hoverfly's middleware API, then yields a shell as dev_ryan. Privilege escalation proceeds through a custom SysWatch monitoring app by forging a session cookie and bypassing a weak input filter, then exploiting a flawed symlink check in a root-run script to read the root SSH key. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB: WingData](https://daily.dev/posts/htb-wingdata-dj1dfee2w) · 0xdf hacks stuff · 1 upvotes · 0 comments - [HTB — Strutted Writeup: Linux Machine](https://daily.dev/posts/htb-strutted-writeup-linux-machine-x6cn8azui) · InfoSec Write-ups · 1 upvotes · 0 comments - [HTB: Store](https://daily.dev/posts/htb-store-nivt8i99r) · 0xdf hacks stuff · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java) [View this post on daily.dev](https://daily.dev/posts/htb-devarea-og8fxznar)