#### HTB-Facts
First, I always scan all the port of the machine
I use nmap to scan which service was running in that port
I need to set up DNS resolution by adding 10.129.213.90 facts.htb to /etc/hosts
Checking http://facts.htb shows a trivia website, however there is nothing interesting here.
I use gobuster to enumerate the path and get /admin
Checking the login page, i can register for an account, so we created a account with the following credentials:

taolatan 123456789

Looking at the CMS panel, it's hosting a Camaleon CMS v2.9.0
Camaleon CMS v2.9.0 is quite outdated, and it's vulnerable to CVE-2025–2304.
The vulnerable code uses params.require(:user).permit! which accepts all user-supplied parameters without validation:

def updated_ajax
  user_params = params.require(:user).permit!  # DANGEROUS!
  current_user.update(user_params)
end

Attack Vector:
* Authenticate as a low-privileged user (e.g., "client" role)
* Send crafted POST request to /admin/users/{id}/updated_ajax
* Inject user[role]=admin parameter
* User role escalates to administrator

This CVE is a Post-auth Privilege Escalation and AWS Credential leak, which we can utilize using this [POC](https://github.com/Alien0ne/CVE-2025-2304)

s3 access key: AKIA97F932B9D48C05F2
s3 secret key: sLLdgk55MHOVh1OrPzvHe1rsWvjO2tmksuFrG3FJ
s3 endpoint: http://localhost:54321

With command `aws configure` to configure auth in aws
I use command `aws --endpoint-url http://facts.htb:54321 s3 ls` to list all the bucket
Listing the S3 bucket `internal` shows an SSH private key, which i can use to login via SSH.
I need to crack the private key to get passphrase: `dragonballz`
Now i need to know who user i can ssh. After some reseach i find Camaleon CMS v2.9.0 have another [CVE-2024-46987](https://github.com/Goultarde/CVE-2024-46987), with this CVE i can read file /etc/passwd to get user name. I create another account because the previous don't work
In here we have two user trivia and william. I try with user trivia first and it work.
However, the user flag is not in the trivia folder. Checking the /home directory for users, we can see william, so we retrieved the flag from that directory.
Checking the privileges of trivia, we found an interesting program called /usr/bin/facter
In [gtfobins](https://gtfobins.org/gtfobins/facter/), we found that it's a program that lists facts about the system, written in Ruby. We can abuse this by creating a malicious Ruby script and load it using facter.