This Hack-The-Box Editor write-up details exploiting an unauthenticated XWiki RCE (CVE-2025-24893) to gain an xwiki shell. Plaintext credentials found in config files allow pivoting to the oliver user, while final root access is achieved by abusing Netdata’s SUID ndsudo binary (CVE-2024-32019) through PATH hijacking.