webmedium

JerryTok

hackthebox

Task: Symfony 7.0 PHP app with Twig SSTI via createTemplate(), but exec functions disabled and open_basedir=/www. Solution: Use Twig map filter to call file_put_contents, write .htaccess enabling CGI + shell script calling SUID /readflag, bypassing all PHP restrictions.

$ ls tags/ techniques/
phpsstiapachesuidcgitwigsymfonyhtaccessdisable_functionsopen_basedir
twig_ssti_createtemplatemap_filter_callbackfile_put_contents_via_twightaccess_cgi_executiondisable_functions_bypass_via_cgiopen_basedir_bypass_via_cgi
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]