HTB Nexus Krayin CRM File Upload RCE, Installer Takeover, an...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/09/02/htb-nexus.html
• Blog Title: HTB Nexus: Krayin CRM File Upload RCE, Installer Takeover, and Git Tree Path Traversal
• Suggested Section: Linux Hardening > Interesting Files & Permissions > Arbitrary File Write to Root, with cross-references from Network Services Pentesting > Pentesting Web > Git and Pentesting Web > File Upload

🎯 Content Summary

Overview and attack chain

Nexus is a Linux Hack The Box machine exposing SSH and several Nginx virtual hosts. The compromise chain starts by recovering a deleted password from a public Gitea repository, using it to authenticate to Krayin CRM 2.2.0, and exploiting CVE-2026-38526 to upload an executable PHP webshell through TinyMCE. The resulting www-data shell can read the deployed Laravel .env, which exposes a database password reused by the ...

🔧 Technical Details

Recovering deleted secrets from Git history: Reviewing only the current repository tree is insufficient because commits preserve earlier versions of configuration files. Enumerate commits and inspect diffs, deleted files, branches, and tags for credentials that were later blanked or removed. Correlate recovered passwords with usernames and email addresses discovered from websites, commit metadata, or application configuration, then test authorized authentication surfaces and password reuse. Any exposed value must be rotated because rewriting or deleting it in a later commit does not invalidate the original secret.

Fingerprinting exact application versions through debug disclosure: Public debugging systems such as Laravel Debugbar or Ignition may expose framework and runtime versions, absolute paths, stack traces, and source snippets in embedded JSON. First use dependency constraints to narrow the possible application versions. Next compare lea...

🤖 Agent Actions

Plan:

1. Map relevant HackTricks pages and inspect at least five candidates.
2. Compare existing coverage against the blog and primary advisories.
3. Select one best existing page and implement only novel, reusable techniques.
4. Validate citations, Markdown structure, links, and the final diff.
   Repository mapping is underway. Since rg is unavailable in this environment, I’m switching to find/grep while preserving the same search scope.
   Five relevant pages have now been inspected. Existing pages already cover Git-history secret recovery, generic PHP upload/MIME bypass, Laravel debug exposure, and Git hooks/config abuse. The clearly novel item is the privileged git ls-tree path-materialization flaw, which fits the existing arbitrary-write-to-root page without duplicating those other pages. Next I’m verifying the exact object construction and vulnerable path logic from the original post and Git’s own documentation.
   The original post contains a reproducible low-level tree-object construction that was omitted from the supplied excerpt. I’ve also verified against Git’s official manuals that --literally accepts otherwise invalid object data, ls-tree exposes stored path fields, and safe.directory=* disables the ownership guard. I’m testing the distilled sequence locally before editing.
   Implementation plan is finalized: add one concise section immediately after existing Git-hook abuse in write-to-root.md, with a tested object-construction PoC, vulnerable-code signature, exploitation prerequisites, and race-resistant containment guidance. Existing references will remain intact; five new numbered sources will be appended.
   The edit is in place and the diff passes whitespace and citation-number checks. I’m now running repository-level validation and checking the five added references; if the full book toolchain is unavailable or exceeds the runtime limit, I’ll report that precisely rather than masking it.
   The full mdBook binary is not installed, but all source URLs return HTTP 200. One final lightweight check is being rerun after adjusting the shell wrapper’s quoting; this does not affect the documentation edit.
   Updated src/linux-hardening/interesting-files-permissions/write-to-root.md.

Added

• Privileged git ls-tree export path-traversal technique.
• Tested low-level Git tree-object construction PoC.
• Exploitation prerequisites and vulnerable Python pattern.
• Technical hardening using scoped safe.directory, receive-side object validation, and openat2() containment.
• Five numbered references with linked citations.

Validation

• git diff --check passed.
• Markdown fences and reference numbering validated.
• All added references return HTTP 200.
• No forbidden sources added.
• mdbook was unavailable in the environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/09/02/htb-nexus.html

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening > Interesting Files & Permissions > Arbitrary File Write to Root, with cross-references from Network Services Pentesting > Pentesting Web > Git and Pentesting Web > File Upload".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0