Nexus — HTB Write-up
Author: Maccioni Andrea Contents Reconnaissance Web Enumeration & Virtual Hosts Gitea & Git History Krayin CRM CVE-2026-38526 with curl RCE & Reverse Shell Application Enumeration SSH as jones Privilege-Escalation Enumeration Root Template Sync Vulnerability Analysis Manual Git Plumbing Malicious Commit & Push Root Write Root Access Complete Attack Chain Lessons Learned & Defensive Notes 1. Reconnaissance The first step was to identify the exposed services and establish the HTTP virtual-host context. ...