Introduction

In this application, we will take advantage of a Server-Side template injection in order to gain RCE in the flask server.

Step 1

Surfing the application we get

Obviously, Proudly powered by Flask/Jinja2 is an indication for SSTI vulnerability against the Jinja2 Engine.

Fuzzing more through the application I thought of fuzzing for hidden API endpoints?, but I guess this is way too hard for an easy challenge, let’s just test it manually first.

Finding the injection point

Sending a request to /test non-existing endpoint we get

Page Source:

The endpoint name is being reflected in an HTML __ tag, which is interesting.

Let’s try something simple …

Boom! template rendering applied.

Let’s jump in to try out RCE payloads.

Payload Gist

We get the flag.txt

HTB{t3mpl4t3s_4r3_m0r3_p0w3rfu1_th4n_u_th1nk!}

*TIP*: We can use the Internal Field Separator bash variable ${IFS} in order to inject bash spaces since endpoint path should not contain whitespaces.

Thank you for reading!