Facts — HTB Writeup | The Hack Sparrow

Executive summary — Facts is a Linux machine that isn't solved with a single exploit, but by chaining misconfigurations: a vulnerable web app leaks AWS credentials, those credentials grant access to an internal S3 store (a MinIO instance) holding a private SSH key, and once inside, a legitimate binary (facter) runnable as root enables the final escalation. A very realistic Web → Cloud → SSH → Root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.15.164`

Attack map

[80/HTTP]  Camaleon CMS 2.9.0
   │  CVE-2025-2304 (IDOR) → temporary admin → credential dump
   ▼
[AWS]  S3 keys leaked in the backend
   │  point the endpoint at  facts.htb:54321
   ▼
[S3/MinIO]  bucket "internal" → .ssh/id_ed25519  (+ authorized_keys)
   │  download the private key · the user is "trivia"
   ▼
[SSH]  trivia@facts.htb   (passphrase: dragonballz)
   │  sudo -l  →  (ALL) NOPASSWD: /usr/bin/facter
   ▼
[ROOT]  custom Ruby fact → exec("/bin/bash -p")

1. Reconnaissance

We start by mapping the attack surface. We run an nmap scan with default scripts and version detection:

nmap -Pn -n -sC -sV -T4 10.129.15.164

Why these flags:

-Pn → skip host discovery ping; assume the host is up (HTB usually blocks ICMP).
-n → no DNS resolution, faster scan.
-sC → run the default NSE scripts (banners, HTTP titles, etc.).
-sV → identify each service's version.
-T4 → aggressive timing template (fast but not reckless).

Relevant result: port 80/tcp (HTTP) is open.

Analysis: with a single web port exposed, the entry vector is almost certainly the web application. All initial enumeration focuses there.

Resumen ejecutivo — Facts es una maquina Linux que no se resuelve con un exploit unico, sino encadenando malas configuraciones: una aplicacion web vulnerable filtra credenciales de AWS, esas credenciales dan acceso a un almacenamiento S3 interno (una instancia MinIO) donde vive una clave SSH privada, y una vez dentro, un binario legitimo (facter) ejecutable como root permite la escalada final. Un recorrido Web → Cloud → SSH → Root muy realista.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.15.164`

Mapa del ataque

[80/HTTP]  Camaleon CMS 2.9.0
   │  CVE-2025-2304 (IDOR) → admin temporal → volcado de credenciales
   ▼
[AWS]  claves de S3 filtradas en el backend
   │  apuntar el endpoint a  facts.htb:54321
   ▼
[S3/MinIO]  bucket «internal» → .ssh/id_ed25519  (+ authorized_keys)
   │  descargar la clave privada · el usuario es «trivia»
   ▼
[SSH]  trivia@facts.htb   (passphrase: dragonballz)
   │  sudo -l  →  (ALL) NOPASSWD: /usr/bin/facter
   ▼
[ROOT]  fact Ruby personalizado → exec("/bin/bash -p")

1. Reconocimiento

Todo empieza mapeando la superficie de ataque. Lanzamos un escaneo de nmap con scripts por defecto y deteccion de versiones:

nmap -Pn -n -sC -sV -T4 10.129.15.164

Por que estas flags:

-Pn → no hace ping previo; asume que el host esta vivo (HTB suele bloquear ICMP).
-n → no resuelve DNS, escaneo mas rapido.
-sC → lanza los scripts NSE por defecto (banners, titulos HTTP, etc.).
-sV → identifica la version de cada servicio.
-T4 → plantilla de tiempo agresiva (rapida sin pasarse).

Resultado relevante: el puerto 80/tcp (HTTP) esta abierto.

Analisis: con un unico puerto web expuesto, el vector de entrada casi con seguridad es la aplicacion web. Toda la enumeracion inicial se centra ahi.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.