HTB Write-Up: Silentium

Table of Contents

1. Reconnaissance
2. Enumeration — Subdomain Discovery & Flowise Fingerprinting
3. Initial Access — CVE-2025-58434 & CVE-2025-59528 (Flowise RCE)
4. Lateral Movement — Credential Extraction & SSH Access
5. Privilege Escalation — Gogs CVE-2025-8110 (RCE as Root)
6. Summary & Takeaways

1. Reconnaissance

Target: 10.129.6.254. Started with the usual full scan:

Two ports, and the HTTP one didn't even try to hide where it wanted to send me. Added the hostname straight away:

2. Enumeration — Subdomain Discovery & Flowise Fingerprinting

2.1 — Web Application

The main site is a basic financial institution landing page. The Institutional Leadership section leaks a handful of names — worth keeping around as potential usernames later. Nothing else stood out, so I ran directory enumeration:

Hit a soft-404 problem — the server returns 200 for everything with a body size of 8753. Excluded that and re-ran, still nothing useful. Pivoted to subdomain fuzzing instead. First checked the baseline response size for a subdomain that shouldn't exist:

Default size came back as 178. Used that to filter ffuf:

One subdomain came back: staging. Added it to /etc/hosts and went to look.

2.2 — staging.silentium.htb

A login form, no registration option. The forgot-password feature responds differently depending on whether the email exists or not — a classic user enumeration bug. Tried the names pulled from the leadership section with @silentium.htb, and ben@silentium.htb came back valid.

2.3 — Identifying Flowise

Hit the login endpoint directly to grab response headers:

The response title gave it away: Flowise, an open-source AI agent builder. Grabbed the version from its API:

Time to go looking for CVEs against that version.

3. Initial Access — CVE-2025-58434 & CVE-2025-59528 (Flowise RCE)

3.1 — Two CVEs That Chain Together

Flowise 3.0.5 is hit by two separate CVEs that combine nicely: CVE-2025-58434, an unauthenticated account takeover, and CVE-2025-59528, an authenticated RCE via JavaScript injection into the mcpserverconfig parameter of the CustomMCP node. The first gets you auth, the second gets you a shell.

3.2 — Exploitation

Found a public PoC that chains both CVEs together:

4. Lateral Movement — Credential Extraction & SSH Access

4.1 — Exploring the Filesystem

Nothing in /home/node, but a directory at the root level caught my eye:

Pulled the users table — ben's bcrypt hash plus an API key came back. Kicked off hashcat while continuing to poke around:

4.2 — Environment Variables

While hashcat chewed on the hash in the background, checked env and two passwords jumped out immediately:

FLOWISE_PASSWORD=F1l3_d0ck3r
SMTP_PASSWORD=r04D!!_R4ge

Tried F1l3_d0ck3r on SSH and on staging login — no luck either way. Nmap hadn't shown SMTP exposed externally, so the SMTP password looked like a strong candidate for reuse elsewhere.

4.3 — SSH as ben

User flag at /home/ben/user.txt.

5. Privilege Escalation — Gogs CVE-2025-8110 (RCE as Root)

5.1 — Internal Port Enumeration

Curled the internal-only ports to fingerprint them. Port 3001 returned HTML with Gogs metadata — a self-hosted Git service — and the og:url tag leaked the internal hostname: staging-v2-code.dev.silentium.htb:3001. Port 8025 turned out to be Mailhog's web UI, nothing useful there.

5.2 — Accessing Gogs

Ben's listed as a Gogs user but none of the known passwords worked, and forgot-password is disabled. Registered a throwaway account to keep looking — no public repos visible anywhere.

5.3 — Gogs Config & Version

Gogs running as root — any RCE through it is a direct line to root. Checked the version:

5.4 — CVE-2025-8110 (Gogs RCE)

This one works by creating a repo with a malicious symlink pointing at .git/config, then overwriting it via the API with a malicious sshCommand payload. When Gogs processes the repo over SSH, it executes the command. Used a modified PoC that skips registration entirely (captcha's enabled) and reuses the dummy account instead:

Root flag at /root/root.txt.

6. Summary & Takeaways

Attack Chain

What I Took Away From This Box

The main domain was a dead end on purpose, and everything real was sitting on a subdomain I only found by fuzzing. I almost stopped after the directory brute-force came up empty — worth remembering that a quiet root domain doesn't mean a quiet target.

The forgot-password oracle handing me a confirmed username for free was a nice reminder that verbose auth error handling is still a common miss, even on things that look otherwise solid. And the env dump giving up two plaintext passwords was almost too easy — one of them just happened to be reused on SSH.

The real lesson was at the end though: once I had a low-priv shell and found Gogs internally with RUN_USER = root sitting in its config, it was just a matter of matching the version to a CVE. Any internal service running as root turns a foothold into a root shell the moment there's a public exploit for it.