Hackthebox Reactor Complete Writeup - CVE-2025-55182 Next.js RCE, SQLite Credential Dump, MD5 Cracking & Node.js Inspector PrivEsc

A comprehensive penetration testing guide exploiting CVE-2025-55182 for unauthenticated remote code execution on a Next.js 15.0.3 application, dumping and cracking MD5 credentials from a local SQLite database, pivoting to the engineer user via su, and escalating to root by abusing a Node.js Inspector debug socket exposed on localhost port 9229.

May 31, 2026 • views • 12 min read • 1,335 words

By

Havoc

hackthebox 26 htb 30 linux 11 nextjs 2 cve-2025-55182 rce 8 sqlite 2 md5 2 hashcat 3 password-cracking node-inspector debug-socket privilege-escalation 17 lateral-movement 7 credential-dumping 2 medium-difficulty 7 season11 3