search

Previous (HTB)

hashtag
Intro

Hello there, fellows another HTB machine, Let's jump right into it.

hashtag
Enumeration.

hashtag
Port scanning.

# Nmap 7.97 scan initiated Sun Aug 24 15:21:00 2025 as: nmap -vvv -p 22,80 -4 -Pn -sC -sV -vv -o nmap.scan 10.10.11.83
Nmap scan report for 10.10.11.83
Host is up, received user-set (0.48s latency).
Scanned at 2025-08-24 15:21:03 +08 for 9s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
80/tcp open  http    syn-ack nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://previous.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Aug 24 15:21:12 2025 -- 1 IP address (1 host up) scanned in 11.75 seconds

Classic .

hashtag
Web server enumeration.

When we first enter the site the site does not contain anything anything we will do will redirect us to login page which we do not have access to. And using curl we can know that this site is running next js.

And guess what ?. couple weeks ago i read about Next js vulnerability which allow us to bypass this login form completely. And this things behind it is that there is a special header called x-middleware-subrequest when provided middle-ware value. It will completely bypass the middle-ware authentication and authorization and jump you to the desire endpoint. You can read more about it here.

LogoCVE-2025-29927: Next.js Middleware Bypass Vulnerability Explainedwww.picussecurity.comchevron-right

Anyway. With that i added the following header to my request.

And this enable me to bypass the authentication. Using dirsearch and feroxbuster i found some endpoints that we can take advantage of.

We can see that we have docs , getting_started and examples . These three endpoints are important. Using burpsuite i was able to inject this header into my requests to get what i want.

First let's take a look at getting_started.

Nothing...

hashtag
LFI

moving to the next examples

Here i stopped for a bit. Because in my inital enumeration i came a across a endpoint which allow us to download it exist under /api/download

I tried to access it but i got this error.

I tried every possible way to find the parameter that it take but i could not find it so here if i was able to access that page and inspect it. I could find what parameter that it takes and use that to our advantage.

Using burpsuite i was able to do that just open the browser, request the page, intercept the request, modifie the headers and forward the request. And the page should load inspect it and you should see this.

If the image is not clear the parameter name is example . So the first thing came to my mind was LFI. I maybe able to abuse this endpoint to access more files. Which is indeed the case here ;)

Cool right ?.

From here we can enumerate many things the first thing came to my mind is the .env file which sometime include secrets. And I found it.

So after a lot of enumeration i found the following.

we have few important files but the most important is .next as it include the artifcates of the build process which may give us some info about the implementation.

The above wordlist was not so helpful as it does not contains alot of javascript specic file names so i had to use another one.

Logowordlists/js-25k.txt at master · camchenry/wordlistsGitHubchevron-right

Using this wordlist i was able to find the following.

Here we have .env which we already know about. But importantly server.js . Let's see what this file contains./

This json tells a lot but the most important we can note is distDir the destination for the after building results.

and also next.config.mjs which may help us if we are able to find it.

Now let's try to look for the manifest file . which include metadata about the files. Their format are quite simple but they are the most tricky to find. Take me a while to allocate where are they but you can find them at http://previous.htb/api/download?example=../../../../app/.next/server/FUZZ-manifest.json this is from FFUF . Anyway after fuzzing there you going to file these files.

we have pages and middle ware let's check them

hashtag
pages.

Here we can see the each route and the corresponding page that serve it. There is very important detail here we going to comeback to it after we look at the middleware

hashtag
middle-ware.

A few imporant things keys and stuff but before we go any further in these keys let's check the value from the pages

hashtag
Login as Jeremy

The pages manifest file shows next auth and the endpoint it uses.

Intresting so we can access that from the same .next folder we are in. but we need to some url encoding for [ ] we can use this to read its content

This is it in better format. So... we got the creds RIGHT?? let's ssh.

And we have it ;). Man this was so tough.

Last updated