A detailed technical walkthrough shows how the seasonal Hack The Box machine Reactor can be fully compromised by exploiting the critical Next.js deserialization vulnerability CVE-2025-55182, publicly known as React2Shell.
Initial reconnaissance with Nmap identifies an OpenSSH service on port 22 and a web application on port 3000. The application presents itself as a reactor monitoring dashboard built with an outdated version of the Next.js framework, confirmed via the Wappalyzer browser extension.
Searching for known issues immediately surfaces CVE-2025-55182, a 10.0 CVSS vulnerability that allows unauthenticated remote code execution through unsafe deserialization of HTTP request data. A public exploit repository is cloned and executed to obtain a reverse shell as the node user.
Further enumeration reveals the reactor.db SQLite database containing user password hashes. The hash belonging to the engineer account is cracked offline with Hashcat using the rockyou wordlist, enabling SSH login and retrieval of the user flag.
Privilege escalation is performed by discovering an active Node.js Inspector debug listener on port 9229 running as root. The websocat binary is transferred to the target, and a crafted WebSocket payload sets the SUID bit on /bin/bash, granting root privileges and access to the root flag.
The article concludes by noting that the vulnerability affected numerous React/Next.js applications in late 2025 and emphasizes the risks of leaving development debugging ports exposed on production servers.
