Ssti

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Overview Ubuntu 20.04. IP: 10.10.10.x. Topics: SSTI (Spring Boot), log poisoning, path traversal, XXE, source code review. Chain: SSTI in the search box, shell as woodenk, credentials in the source, SSH, analysis of a root cron job (a Java jar), a four-vulnerability chain (log poisoning + path traversal + metadata-driven path injection + XXE), the root SSH key, root. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV 10.10.10.x 22/tcp: OpenSSH 8.2p1 (Ubuntu) 8080/tcp: HTTP (http-proxy) HTTP (port 8080): ...