Facts is a Linux box hosting a trivia website built on the Camaleon CMS, a Ruby on Rails application. I’ll abuse a mass assignment vulnerability in Camaleon to promote my account to administrator, then use credentials from the admin panel to authenticate to a local MinIO S3 service. From the bucket I’ll grab an encrypted SSH private key, crack its passphrase with john, and SSH in as the next user. For root, I’ll abuse a sudo rule on facter, Puppet’s system inventory tool, that lets me load arbitrary Ruby code from a custom facts directory and run it as root. In Beyond Root, I’ll show an alternative foothold using a path traversal in Camaleon’s S3 uploader to read arbitrary files, and use the leaked Rails master key to decrypt the application’s encrypted credentials and session cookies.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox 'Facts' machine, a Linux box running Camaleon CMS 2.9.0 on Ruby on Rails. The attack chain involves exploiting CVE-2025-2304, a mass assignment vulnerability in Camaleon's password update endpoint, to escalate a regular user account to administrator. Admin credentials are then used to authenticate to a local MinIO S3 service, where an encrypted SSH private key is retrieved from a bucket resembling a home directory. The passphrase is cracked with john using rockyou.txt. For root privilege escalation, a sudo rule allows running 'facter' (Puppet's Ruby-based system inventory tool) as any user, which can load arbitrary Ruby code from a custom facts directory. A 'Beyond Root' section covers an alternative foothold via a path traversal vulnerability in Camaleon's S3 uploader and decrypting Rails session cookies using a leaked master key.

HTB: Facts