HTB - Reactor

Sun, 24 May 2026 00:00:00 +0000

Difficulty: Easy | OS: Linux

Logo & Name Analysis - First Impressions Link to heading

Before touching a single tool, the machine logo and name already give away a significant amount of information to an experienced player.

The Logo Link to heading

The machine logo shows a nuclear reactor facility - cooling towers with radiation symbols (☢), smoke/steam rising, set inside a green circle. On HackTheBox, machine logos almost always hint directly at the technology or theme involved.

What the logo tells us immediately:

Nuclear reactor theme → the web app will be a reactor monitoring dashboard, ICS/SCADA-style interface with sensor readings, logs, and personnel panels
Green color scheme → "nominal / online" status indicators - a live running service dashboard
Radiation symbols → nuclear operations terminology ahead: coolant flow, pressure, neutron flux, core temperature - all realistic dashboard labels that give no obvious attack surface

The Name Link to heading

"Reactor" combined with the logo points toward two things at once:

React/Next.js - "Reactor" is almost certainly a pun on React, the JavaScript framework. HTB machine names frequently reference the intended technology this way. This immediately narrows the attack surface to a Node.js web application.
Nuclear monitoring theme - the app will look like a static read-only dashboard with no login, no forms, no visible input - pushing the attacker toward framework-level vulnerabilities rather than application logic.

The Instant Hypothesis Link to heading

Combining name + logo before even running nmap:

"This is a Next.js app themed as a nuclear reactor dashboard. The name 'Reactor' punning on React strongly suggests a Next.js vulnerability is the intended path. The dashboard will look static but the attack vector will be server-side - likely Server Actions, API routes, or RSC deserialization."

This hypothesis was confirmed within minutes:

Port 3000 → X-Powered-By: Next.js in response headers
No login page, no visible forms → the framework itself is the attack surface, not the application logic
Next.js Server Actions prototype pollution (CVE-2025-55182) → exact match

This is why reading the logo matters. A good HTB player can often narrow the entire attack path to 1-2 CVEs before the nmap scan finishes.

Next.js on z3r0s

HTB - Reactor

Logo & Name Analysis - First Impressions Link to heading

The Logo Link to heading

The Name Link to heading

The Instant Hypothesis Link to heading