Easy
HTB Silentium Complete Writeup -CVE-2025-58434, CVE-2025-59528 & Gogs RCE
Silentium is a HackTheBox Season 10 machine built around a Flowise 3.0.5 AI workflow platform exposed on a staging subdomain. The exploitation chain begins with CVE-2025-58434 - an unauthenticated password reset token disclosure - to take over the ben account, then leverages CVE-2025-59528, a critical CVSS-10 JavaScript code injection flaw in the Flowise CustomMCP node, to land a shell inside the Docker container. SSH credentials are extracted from process environment variables, yielding a proper shell as ben. The privilege escalation pivots through a locally bound Gogs 0.13.3 instance vulnerable to CVE-2025-64111, a symlink bypass that allows overwriting .git/config with a poisoned sshCommand, ultimately executing commands as root.
Apr 14, 2026