Silentium is a HackTheBox Easy difficulty machine that hosts a Flowise AI staging site that is vulnerable to multiple exploits. Initial foothold involves exploiting CVE-2025-58434 to bypass authentication on a user account, followed by leveraging CVE-2025-59528 for remote code execution to gain a container root shell. After extracting hardcoded SMTP credentials to SSH into the host as the user, privilege escalation to root is achieved by exploiting a PackageKit TOCTOU race condition (CVE-2026-41651).
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O silentium.htb -oN nmap_scan to scan the open ports and services.
1.1 Directory Enumeration
The website did not provide much useful information. It seemed like a static website.
Next, I used gobuster to enumerate and find out if there are any hidden directories or files. But the scan results did not find any hidden directories or files.
1.2 Vhost Enumeration
Since I was unable to find any hidden files or directories from the above steps, I decided to run a vhost scan to see if there are any virtual hosts available.
1.3 Application Identification
I was able to see from the staging site title tag that the staging site was running a Flowise application.
The staging site contained a login page, a forgot password page and a reset password page.
Looking at the password reset form, in theory, I should be able to reset a user's password if I can get my hands on a user's email and a reset token.
2. Authentication Bypass & Initial Foothold
My first instinct was to run a directory scan using gobuster dir -u staging.silentium.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 --exclude-length 3142 to see if there are any hidden files or directories on the staging site. But I was unable to find any hidden directories or files.
Since none of the scans provided any useful information, I decided to search Google for "Flowise vulnerabilities". This search resulted in multiple known vulnerabilities.
2.1 User Enumeration
Most of the exploits needed a user email and password but I was unable to find any.
Then I remembered that the main website contains three employee names.
2.2 Authentication Bypass (CVE-2025-58434)
Since I was able to enumerate a viable email address, I decided to use CVE-2025-58434 Flowise < 3.0.5 - Missing Authentication for Critical Function to reset ben@silentium.htb password.
2.3 Initial Foothold (CVE-2025-59528)
While searching for Flowise vulnerabilities, I was able to find Flowise 3.0.4 - Remote Code Execution (RCE) exploit in ExploitDB.
I was able to find a working exploit and a very good explanation of the vulnerability in CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution.
Running this exploit, I was able to get an initial foothold on the target machine.
3. Host Pivoting & User Flag
Even though I am the root user inside the Docker container, the container is fairly restricted.
I downloaded LinPeas to enumerate the container, and it flagged some hardcoded credentials for an SMTP Service.
4. Privilege Escalation & Root Flag
I downloaded LinPeas to enumerate the target machine, and it flagged 4 possible vulnerabilities and 5 ports that are listening only to localhost.
Premium Writeup
This writeup is for premium members only. Please log in, subscribe or join Discord to read the full methodology, view the screenshots, and access the payloads.
