Facts | CTF | 0xdreadnaught

Machine: Facts
OS: Linux
Difficulty: Easy
Steps: 4
Added: 31 Jan 2026

A CameleonCMS mass-assignment flaw grants admin; an authenticated path-traversal read leaks an SSH key, and sudo facter runs a custom Ruby fact as root.

How it went

0
nmap
nmap shows SSH and an nginx site running CameleonCMS 2.9.0.
1
mass assign
A registered user escalates to CMS admin via a mass-assignment flaw (CVE-2025-2304).
2
file read
Admin unlocks an authenticated path-traversal file read (CVE-2024-46987) for the user flag and trivia's SSH key.
3
crack key
The ed25519 key's passphrase cracks from rockyou (dragonballz), giving SSH as trivia.
4
sudo facter
trivia may sudo facter; --custom-dir loads a Ruby custom fact that runs as root.