Template injection: HTB

Hello, my dear friends, and welcome to my first writeup on HTB. In this blog, I will describe all the steps and the systematic method, and in addition, I will try to explain a few topics. So without wasting time, start the machine on HTB and solve it step by step.

lab Name: Template

Difficulty : easy

First, we scan the IP address to collect important information, such as the open ports, what services run on the network, and also which version they used. As we see in the screenshot, only one port is open in the network, and it uses the http service. There are HTTP ports open that use the Werkzeug server.

2.1 Werkzeug?

Werkzeug is a Python utility library that provides a set of tools for developing web applications. It is commonly used as part of the Flask web framework, which is built on top of Werkzeug. Werkzeug offers features such as routing, request handling, and response generation, making it easier to handle HTTP requests and build server-side applications.

As we see in the above image, this website uses Flask and Jinja2.

Flask: Flask is a lightweight and flexible web framework written in Python. It is designed to make web development tasks, such as routing, handling HTTP requests, and generating responses, easier and more efficient.

Jinja2: Jinja2 is a popular templating engine for Python web applications. It is used to generate dynamic HTML, XML, or other markup formats by blending templates with data.

Get Meet Mangukiya’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This website uses Jinja technology for templating, and for this reason we can perform the templet injection.

Now we exploit this website using different types of payloads. In this phase, we use the

{{request.application.globals.builtins.import('os').popen('').read()}}

Let’s break down the syntax step by step:

• request refers to an object that represents an HTTP request made to the server.
• application is a property or method accessed on the request object.
• __globals__ is a special attribute that accesses the global namespace of the application.
• __builtins__ is a module in Python that contains built-in functions and objects.
• __import__('os') is a call to the __import__ function, which dynamically imports the os module.
• .popen('cat flag.txt') is an attempt to execute the command cat flag.txt using the popen function from the os module.
• .read() is used to read the output of the command execution.

Flag: HTB{t3mpl4t3s_4r3_m0r3_p0w3rfu1_th4n_u_th1nk!}

If you like my blog, please follow me 🙏

Thank you