Hackthebox: Facts

5 min readJun 6, 2026

Facts, an easy-rate hackthebox machine dealing with exposed s3 bucket misconfiguration that leads to leak to certain content from buckets, mainly caused by misconfiguration on s3 buckets , then doing the sudo -l to execute a bash script to escalate privilege

it’s been a while since i solved a machine on hackthebox , so i said to myself , let’s give it a try

first we do basic nmap scan

we find some port 80 http open and ssh , so it means there is a website and the possibilty of a user that we might enumerate

so from here , let’s check the website

nothing really useful, i tried enumerating directories that are there and i found something really interesting

there are directories that lead to admin login , which means i can login as admin , let’s go there

okay i need to login as admin , i put some default creds admin:admin and it was incorrect , but what i found is that you can create an account (does it mean i can create account as admin ?) we don’t know yet , so i created an account as bald with password BALD123 and i entered the website

yup i am the admin panel of my site (not really) i found down there that we have a cms called camaleon (written in ruby) with version 2.9.0 , while googling the website i found a lot CVEs , one of them that caught my attention was this:

CVE-2025–2304

basically this version is vulnerable to extraction of s3 configuration from the admin settings page , which means i can fetch csrf token and login as full admin with my new account

okayy we entered as fully admin and we were able to see the plugins and all that stuff , also we were able to extract s3 configuration files as well as reverting to admin

we can use aws configure to add the keys

now let’s try to dive

Get Dhiasaid’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

we go to the s3 bucket we find 2 important ones

dive more in internal , i found ssh keys , which is cool

and an id , we can convert it to id_ed255519.hash and use john the ripper to crack it

now let’s crack it

okayy we have done it

we found a password , but what is the username that we will use , okayy while diving into the version of camaleon 2.9.0 , i found out that there is a cve from 2024 that we can do authenticated file read (LFI path traversal)

CVE-2024–46987

okayy by executing it i found two users that are really suspicious william and trivia

so from here let’s try to go as trivia

yes!!! we have done it , now we are logging in using ssh as user trivia but the flag wasn’t there , so i redirected myself and i found that i can go as william , interesting !

let’s go there

yup we found the user flag, cool

now can we go as root ??

YES!

performing privilege escalation was really easy , by doing sudo -l i found out that i can perform the command facter

facter is a a system inventory tool that collects basic information (facts) about a node (system), such as hardware details, network settings, and OS type, and displays them as key-value pairs

the version was important , it was 4.10.0 , so it uses the — custom-dir method

so we create the custom fact and run it with sudo