This Hack The Box write-up details the exploitation of Silentium, an investment firm’s website. The attack chain involves abusing an unauthenticated password reset endpoint in Flowise, a visual AI agent builder, to gain account takeover. Further exploitation leverages a node that passes user-supplied configuration to the JavaScript Function constructor, achieving root code execution within a Docker container. The process concludes with privilege escalation via leaked credentials and an internal Gogs instance.