Facts Writeup (HackTheBox Easy Machine)
Created: 2026-06-08
Updated: 2026-06-08
Facts is an easy-rated machine on HackTheBox that exploits a privilege escalation through a mass assignment existing in Cameleon CMS, as well as a pretty basic user to root pivot.
Reconnaissance
A quick naabu scan to identify open ports reveals ssh and a possible web interface.
then nmap reveals the website to be facts.htb .
After adding it to /etc/hosts we get to acess it over the browser:
As it appears it’s a simple looking website with random facts ( I agree with this one) and user comments.
Nothing much here. Let’s fuzz for directories:
An interesting find is /admin which redirects to either a login or a register page :
At the bottom of the page it’s indicated that the site was made using Cameleon CMS and the version is 2.9.0, that’s a nice find , next step is check for vulnerabiltites related to this specific version, in this case it meant scraping the GitHub repo of Cameleon CMS.
You can check it yourself via : https://github.com/owen2345/camaleon-cms/releases
CVE-2025-2304
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS
When a user wishes to change his password, the ‘updated_ajax’ method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
You can learn more about it via : https://www.tenable.com/security/research/tra-2025-09
I proceeded following the PoC and changed my password from bay to another random string:
Then I intercepted that request in BurpSuite and allowed myself to change the role to admin before transmitting it :
The action is successful
When I refresh my profile I get a new set of features in the margin space as well as “administrator” as my role.
CVE-2024-46987
Another CVE allows arbitrary file read to authenticated users.
You can find the exact same one here: https://github.com/Goultarde/CVE-2024-46987
I followed yet another PoC to dump /etc/passwd which revealed to me two users : trivia and william
Tried to retrieve the user.txt file from both users’ home directories, and found it finally in William’s:
And that’s our user.
Now I wanted to leverage this vulnerability into getting an ssh connection, but this time with user trivia , simply because I have found the private key in its home directory.
Fun Fact (pun intended): I have learned that the vulnerability in here is not in the algorithm itself, because the math behind it is pretty solid. It’s actually the exposure of the file.
Now we get to crack the password using ssh2john and john:
1 | ssh2john id_ed25519_trivia > trivia_hash |
The password is dragonballz.
Note: After Facts retired I figured out that this was the unintended solve, which is self-explanatory since I basically didn’t need the admin I got using the first CVE. However, I just like to document my thought processes when I’m playing, and produce authentic material in my blog.
If you’re interested in reading about the intended foothold, here is the writeup made by the actual author of the machine: Author Writeup
Privilege Escalation
This one is pretty simple. sudo -l reveals root privilege on facter .
Facter is a system inventory tool that collects facts about the machine it runs on and returns them as structured key-value data.
1 | Facter.add('exploit') do |
Now a simple cat /root/root.txt gets us the root flag. And we’re done. That’s it for facts.
Rating
Facts is a special one because it marked the start of my commitment to playing HTB machines regularly. Totally a game changer.
Also great start of Season 10.
5 Stars.
⭐⭐⭐⭐⭐
Please share with your friends !