HackTheBox - Silentium

By Ippsec1 min readPublished 12 September 2026

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 00:53 - Start of nmap 03:00 - Discovering the staging subdomain with ffuf 05:07 - The login has 3 different error messages allowing us to enumerate valid em...

00:00 - Introduction 00:53 - Start of nmap 03:00 - Discovering the staging subdomain with ffuf 05:07 - The login has 3 different error messages allowing us to enumerate valid emails 06:50 - Forgot Password returns the entire user object, including reset token, taking over ben's account 10:30 - Finding an public RCE in Flowise, but this docker doesn't have bash that makes it a little tricky to get the reverse shell 16:35 - Shell returned getting a password from the environment then SSH into the box 20:55 - Accessing GOGS by creating a SSH Port Forward, then looking at the version to find a RCE (CVE-2025-8110) 25:40 - Creating a Git Repo so we can trigger the File Write uploading our SSH key to the root directory 27:50 - Sending the File Write command to GOGS