HackTheBox Reactor is an Easy-difficulty Ubuntu 24.04 Linux box running a nuclear reactor monitoring dashboard built on Next.js 15.0.3.
I found the attack chain spans three escalation stages, version fingerprinting of the JavaScript chunks served by the Next.js app reveals React 19.0.0-rc running in App Router mode with React Server Components which is a combination directly in scope for React2Shell (CVE-2025-55182 / CVE-2025-66478), also I found a CVSS 10.0 pre-authentication RCE flaw where the Flight reply decoder unsafely deserialises forged objects from server function requests.
I crafted multipart POST with a Next-Action header injects arbitrary JavaScript into the server-side Node.js process via the Function constructor, yielding a shell as node.
A SQLite database in the application directory contains MD5 password hashes; the engineer hash cracks immediately and the password is reused for the OS account.
My path to privilege escalation to root uses the Node.js Inspector (--inspect=127.0.0.1:9229) attached to a root-owned monitoring process which is reachable from any local user via node inspect or by SSH-tunnelling the port and attaching Chrome DevTools, both of which execute arbitrary JavaScript inside the root process via Runtime.evaluate.
Full write-up below;