HackTheBox - Silentium
Source: YouTube · IppSec · published Sep 12, 2026 · 31:22
BLUF: This video demonstrates a walkthrough of the Hack The Box machine "Selentium," exploiting a flawed password reset mechanism to gain initial access via Remote Code Execution (RCE) in Flowise, and ultimately achieving root access by abusing a symbolic link vulnerability in Gogs to overwrite SSH authorized keys. 0:15 11:00 22:00
Key Takeaways:
• The initial foothold is gained by triggering the "forgot password" feature for the user "Ben," which inadvertently returns the full user object including the password hash and the reset token in the API response, allowing immediate password reset. 6:50
• After logging into the Flowise application, the attacker identifies an RCE vulnerability in the API that allows arbitrary code execution, which is used to establish a reverse shell connection to the attacker's machine. 11:20
• The initial shell is unstable and hangs the server due to single-threaded execution; the attacker stabilizes access by using a base64-encoded reverse shell payload compatible with the BusyBox environment. 13:00
• Root access is achieved by exploiting an insufficiently patched CVE in Gogs (v0.13.3) involving symbolic links; the attacker creates a repo with a file named pone symlined to /root/.ssh/authorized_keys and overwrites it via the API to inject their public key. 22:30
• The Gogs vulnerability is a bypass of a 2024 patch that fixed a path traversal flaw but failed to account for symbolic links, allowing file writes outside the intended directory structure. 22:50
The walkthrough highlights how "vibe-coded" applications often contain critical logic errors that simplify exploitation, while also demonstrating the importance of understanding how patches can introduce new bypass vectors like symlink abuse.
Sources:
- 0:15 Introduction to the Selentium box and the unrealistic nature of the initial vulnerability.
- 6:50 Exploitation of the password reset API to extract user credentials and tokens.
- 11:00 Discovery and exploitation of the Flowise Remote Code Execution vulnerability.
- 13:00 Establishing a stable reverse shell using BusyBox-compatible payloads.
- 22:00 Identification of Gogs version and relevant CVEs regarding symlink bypasses.
- 22:30 Detailed explanation of the symlink-based file write exploit for root access.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is Ipsac, and today we'll be doing Selentium from Hack the Box, which funny story, when this box was being evaluated, I left the comment of, "I want to reject this for being highly unrealistic, but somehow this vulnerability made its way into a semi-large open source project." The vulnerability is at the start of the box. When doing the forgot password, the web server responds with the entire user object, not only including the user's password hash, but the reset token itself. Definitely a vibe induced vulnerability and I hope the models have gotten better to where we don't see this type of vulnerability in the future. Anyways, as you can guess there's also an rce vulnerability which gets us a foothold onto the box. For root there's a pretty cool GOGS vulnera…