https://maxisfront.me/en/tags/s3/Recent content in S3 on MaxisFrontHugoenWed, 15 Jul 2026 10:16:52 -0600https://maxisfront.me/en/posts/writeup-facts-htb/Sat, 11 Jul 2026 00:00:00 -0600https://maxisfront.me/en/posts/writeup-facts-htb/<blockquote> <p>All rights reserved by <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploiting the <code>CVE-2025-2304</code> on <code>CMS Camaleon 2.9.0</code> to escalate privileges through mass attribute assignment</li> <li>Obtaining <code>API Key</code> and <code>Secret Key</code> via the compromised <code>CMS</code></li> <li>Accessing the internal <code>bucket S3</code> via <code>minio-client</code>, discovering the private key <code>SSH</code></li> <li>Exploiting a <code>Path Traversal</code> (<code>CVE-2024-46987</code>) to read sensitive system files</li> <li>Privilege escalation using the <code>facter</code> binary with <code>sudo</code> permissions</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port and service enumeration</li> <li>Directory and web architecture enumeration</li> <li>Exploitation of vulnerabilities in <code>CMS</code> (Mass Attribute Assignment)</li> <li>Interaction with object storage services (<code>S3</code>) via <code>minio-client</code></li> <li>Exploitation of binaries with <code>sudo</code> permissions</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>ping</li> <li>nmap</li> <li>minio-client</li> <li>python3</li> <li>ssh2john</li> <li>john</li> <li>curl</li> <li>ssh</li> <li>facter</li> </ul> <hr> <h2 id="vulnerability-assesment-and-analysis">Vulnerability Assesment and Analysis</h2> <p>The <code>HTB</code> platform provides us with the target <code>IP</code>, which is <code>10.129.16.176</code>—an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p>