HackTheBox Facts

Overview

Facts is a Medium-difficulty Linux machine featuring Camaleon CMS exploitation and creative privilege escalation. This machine teaches:

• CMS vulnerability research
• Mass assignment attacks
• AWS S3 credential exposure
• Ruby code injection via Facter
• SSH key-based lateral movement

Enumeration

Port Scanning

Standard web service ports plus SSH are exposed.

Key Services:

• SSH (22/tcp)
• HTTP (80/tcp) - Camaleon CMS

Web Application

The target hosts Camaleon CMS 2.9.0, an open-source content management system built on Ruby on Rails.

Initial Foothold

CVE Chain Overview

CVE-2025-2304 (Mass Assignment)chr(10)    ↓chr(10)Admin Panel Accesschr(10)    ↓chr(10)S3 Credentials Leakchr(10)    ↓chr(10)SSH Access

Mass Assignment Vulnerability

Camaleon CMS 2.9.0 is vulnerable to mass assignment, allowing privilege escalation through user registration.

Exploitation Path:

1. Register normal user account
2. Exploit mass assignment to elevate privileges
3. Access admin functionality
4. Extract AWS S3 credentials
5. Find SSH keys in S3 buckets

Facter - Ruby-based system profiling tool

Custom fact definitions with code injection

Service restart or scheduled task triggering execution

Root command execution

Key Concepts

• Understanding Ruby fact definitions
• Facter configuration files
• Service manipulation
• Code injection in configuration

Root Flag Location: /root/root.txt

Key Takeaways

• Mass assignment is a critical vulnerability
• Cloud credential exposure is common
• Configuration files often contain secrets
• Ruby injection techniques are powerful

aws-cli - S3 bucket access

ssh - Remote access

Custom exploit scripts

Ready for the complete attack chain? Get the PAID version on Buy Me a Coffee with CVE exploitation details, S3 enumeration commands, and Facter injection payload.