This writeup details the complete attack chain for the Silentium machine, starting from a vulnerable Flowise AI instance to a privilege escalation using a recent Gogs vulnerability (CVE-2025-8110).

1. Enumeration & Discovery

Initial enumeration of the target IP revealed an Nginx web server redirecting to silentium.htb and an open SSH port.

nmap -sV -sC <TARGET_IP>

Enter fullscreen mode