HackTheBox Facts

Overview

Facts is a Medium-difficulty Linux machine featuring Camaleon CMS exploitation and creative privilege escalation. This machine teaches:

• CMS vulnerability research
• Mass assignment attacks
• AWS S3 credential exposure
• Ruby code injection via Facter
• SSH key-based lateral movement

Enumeration

Port Scanning

Standard web service ports plus SSH are exposed.

Key Services:

• SSH (22/tcp)
• HTTP (80/tcp) - Camaleon CMS

Web Application

The target hosts Camaleon CMS 2.9.0, an open-source content management system built on Ruby on Rails.

Initial Foothold

CVE Chain Overview

CVE-2025-2304 (Mass Assignment)
    ↓
Admin Panel Access
    ↓
S3 Credentials Leak
    ↓
SSH Access

Mass Assignment Vulnerability

Camaleon CMS 2.9.0 is vulnerable to mass assignment, allowing privilege escalation through user registration.

Exploitation Path:

1. Register normal user account
2. Exploit mass assignment to elevate privileges
3. Access admin functionality
4. Extract AWS S3 credentials
5. Find SSH keys in S3 buckets

Privilege Escalation

Facter Code Injection

After gaining SSH access via the leaked S3 credentials, discover:

• Facter - Ruby-based system profiling tool
• Custom fact definitions with code injection
• Service restart or scheduled task triggering execution
• Root command execution

Key Concepts

• Understanding Ruby fact definitions
• Facter configuration files
• Service manipulation
• Code injection in configuration

Root Flag Location: /root/root.txt

Key Takeaways

• Mass assignment is a critical vulnerability
• Cloud credential exposure is common
• Configuration files often contain secrets
• Ruby injection techniques are powerful

Tools Used

• aws-cli - S3 bucket access
• ssh - Remote access
• Custom exploit scripts