Facts

Technical Walkthrough

Facts - Walkthrough

Machine Info

• Name: Facts
• IP: <TARGET>
• OS: Linux
• Difficulty: Easy
• Author: LazyTitan33

Enumeration

Quick TCP scan found SSH (22) and HTTP (80). Full port scan revealed an additional port 54321 running MinIO (LocalStack S3). The web server is nginx proxying to a Camaleon CMS 2.9.0 (Ruby on Rails 8) app at facts.htb. The MinIO bucket randomfacts is anonymously readable and writable, serving CMS media files via nginx proxy at /randomfacts/.

Foothold

1. CMS Registration: Registered a user account on the Camaleon CMS admin panel at /admin/register. The registration form has a CAPTCHA that requires visual solving. The captcha accepts lowercase values. Used Python requests.Session() to maintain the session across captcha fetch and form submission.

1. <secret redacted> (Path Traversal File Read): As an authenticated client-role user, exploited the /admin/media/download_private_file?file=../../../etc/passwd endpoint to read arbitrary files from the server filesystem. This CVE allows any authenticated Camaleon CMS user to read files readable by the web application user (trivia).

User Flag

Read /home/william/user.txt via the path traversal LFI: <hash redacted>

Also extracted:

• trivia user's SSH private key from /home/trivia/.ssh/id_ed25519 (encrypted with aes256-ctr)
• Rails master key from /opt/factsapp/config/master.key

Privilege Escalation

trivia user (SSH access)

Cracked the SSH key passphrase with John the Ripper using rockyou.txt: dragonballz. Used <secret redacted> mechanism to pass the passphrase non-interactively.

Root

sudo -l revealed trivia can run /usr/bin/facter (Puppet Facter 4.10.0) as ALL users with NOPASSWD.

Exploited by creating a custom Ruby fact:

Facter.add(:rootflag) do
  setcode do
    Facter::Core::Execution.execute("cat /root/root.txt")
  end
end

Executed with: sudo /usr/bin/facter --custom-dir /tmp/myfacts rootflag

Root Flag

<hash redacted>

Attack Chain Summary

Anonymous MinIO bucket -> CMS Registration (captcha solve) -> <secret redacted> LFI ->
SSH key extraction -> Key passphrase crack (dragonballz) -> SSH as trivia ->
sudo facter --custom-dir (custom Ruby fact) -> root

Lessons Learned

1. The machine name "Facts" was a hint toward both the trivia content theme and the facter privesc tool.
2. Camaleon CMS v2.9.0 has <secret redacted> (path traversal file read) exploitable by any authenticated user, even client role.
3. The SSTI vulnerability (<secret redacted>) was patched (HTML-escaped) in this version but the LFI was not.
4. SSH key passphrase cracking with rockyou.txt continues to be a common HTB pattern.
5. Facter --custom-dir allows loading arbitrary Ruby code as custom facts, which executes as root when combined with sudo NOPASSWD.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Target: <TARGET>
• Pwnbox: <TARGET> (profex0r)
• Difficulty: Easy
• OS: Linux
• Date: 2026-05-10

Key Findings

• Ports: 22 (SSH), 80 (nginx/Camaleon CMS), 54321 (MinIO/LocalStack S3)
• Hostname: facts.htb
• CMS: Camaleon CMS 2.9.0 (Ruby on Rails 8)
• Users: trivia (uid=1000), william
• Rails app: /opt/factsapp, runs as trivia
• MinIO bucket randomfacts has anonymous read/write
• <secret redacted>: Path traversal file read in /admin/media/download_private_file
• SSH key for trivia at /home/trivia/.ssh/id_ed25519 (passphrase: dragonballz)
• Sudo: trivia can run sudo /usr/bin/facter NOPASSWD
• Privesc: facter --custom-dir with custom Ruby fact

Credentials

• CMS user: profx99 / Hackthebox1! (client role)
• trivia SSH key passphrase: dragonballz
• Rails master key: <hash redacted>

Flags

• User (william): <hash redacted>
• Root: <hash redacted>

Evidence Ledger

Notes

Scope

• Target: <TARGET>
• Pwnbox: <TARGET> (<<secret redacted>>)
• Difficulty: Easy
• OS: Linux
• Date: 2026-05-10

Key Findings

• Ports: 22 (SSH), 80 (nginx/Camaleon CMS), 54321 (MinIO/LocalStack S3)
• Hostname: facts.htb
• CMS: Camaleon CMS 2.9.0 (Ruby on Rails 8)
• Users: trivia (uid=1000), william
• Rails app: /opt/factsapp, runs as trivia
• MinIO bucket randomfacts has anonymous read/write
• <secret redacted>: Path traversal file read in /admin/media/download_private_file
• SSH key for trivia at /home/trivia/.ssh/id_ed25519 (passphrase: dragonballz)
• Sudo: trivia can run sudo /usr/bin/facter NOPASSWD
• Privesc: facter --custom-dir with custom Ruby fact

Credentials

• CMS user: profx99 / Hackthebox1! (client role)
• trivia SSH key passphrase: dragonballz
• Rails master key: <<secret redacted>>

Flags

• User (william): <<secret redacted>>
• Root: <<secret redacted>>

Evidence Ledger