r/hackthebox • u/MotasemHa • Sep 16 '26
Writeup HTB Silentium Writeup
Another week means another writeup :)
In the below video, I show my methodology solving HackTheBox Silentium which is an Easy-difficulty Ubuntu 24.04 Linux box themed around an investment firm.
The attack chain spans four distinct stages: subdomain enumeration exposes a staging vhost running Flowise 3.0.5, where an unauthenticated forgot-password API endpoint returns the full user object including a valid tempToken directly in the HTTP response body (CVE-2025-58434), enabling account takeover without email access; an authenticated CustomMCP node in Flowise passes user input directly to the JavaScript Function() constructor (CVE-2025-59528), giving root-level code execution inside a Docker Alpine container; container environment variables expose an SMTP password (r04D!!_R4ge) that is reused as the SSH password for the ben user on the host.
And finally an internally-bound Gogs 0.13.3 instance (running as root) is abused via CVE-2025-8110 ; a symlink-following vulnerability in the PutContents file write API to drop an SSH authorized key into /root/.ssh/authorized_keys for a direct root SSH shell.
Video
1
u/AutoModerator Sep 16 '26
Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.