$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: HackTheBox Facts machine — Camaleon CMS 2.9.0 on Ruby on Rails with Linux privilege escalation. Solution: Exploited two CVEs for CMS privilege escalation and arbitrary file read, cracked encrypted SSH key, then abused sudo permissions on facter utility for root access.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
| Field | Value |
|---|---|
| Platform | HackTheBox |
| Name | Facts |
| Category | Web / Linux Privilege Escalation |
| Difficulty | Medium |
| Target | 10.129.22.178 (facts.htb) |
A HackTheBox machine featuring Camaleon CMS running on Ruby on Rails. The attack chain involves exploiting two CVEs in the CMS for privilege escalation and arbitrary file read, cracking an encrypted SSH key, and finally abusing sudo permissions on the facter utility for root access.
nmap -sC -sV 10.129.22.178
Open Ports:
The web server hosts Camaleon CMS 2.9.0 running on Ruby on Rails 8.0.2.
Key endpoints discovered:
/admin/login - Admin login page/admin/register - User registration (with captcha)/admin/users/{id}/updated_ajax - User update endpointUsers discovered on the system:
trivia - Regular user with SSH accesswilliam - User with user.txt flagroot - System administratorFirst, registered a new user account via the /admin/register endpoint. This required solving a captcha challenge.
Camaleon CMS is vulnerable to mass assignment in the user update functionality. By adding the role=admin parameter to the update request, a regular user can escalate their privileges to administrator.
Vulnerable Endpoint: /admin/users/{id}/updated_ajax
curl -X POST "http://facts.htb/admin/users/3/updated_ajax" \ -H "Cookie: _camaleon_cms_session=..." \ -d "user[role]=admin&user[first_name]=Test&user[last_name]=User"
Result: User account elevated to CMS administrator.
...
$ grep --similar