https://wearethebug.dev/tags/debug-port-hijack/Recent content on WE ARE THE BUGTradecraften-usSun, 24 May 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-reactor/Sun, 24 May 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-reactor/Reactor is an Easy-rated Linux machine where initial access is gained by exploiting CVE-2025-55182 (React2Shell), a pre-auth RCE in React Server Components triggered via a crafted Next-Action header, yielding a shell as node. Credentials are extracted from a SQLite database dump, cracked to reveal valid SSH access for lateral movement to the user engineer. Privilege escalation abuses an exposed Node.js debug port (9229), reached via SSH tunnel, to call process.mainModule.require and execute commands as root.