Hack The Box - HTB DevHub Writeup - Medium - Weekly - May 31th, 2026

May 31, 2026

HTB Machine: DevHub IP: Attacker IP: OS: Ubuntu 22.04.5 LTS Difficulty: Medium Category: Web / MCP Ecosystem / Lateral Movement Reconnaissance Port Scan nmap -Pn -T4 -sV -p- --min-rate 2000 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 80/tcp open http nginx 1.18.0 (Ubuntu) 6274/tcp open http MCPJam Inspector (Node.js) Internal-only ports discovered later via process enumeration: 5000/tcp OPSMCP Flask server (127.0.0.1 only) 8888/tcp JupyterLab (127.0.0.1 only) Web Enumeration — Port 80 Adding devhub.htb to /etc/hosts and visiting port 80 reveals a static n…