$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: Flask COVID vaccination app with SSTI in the profile name field, observable only through a server-generated PDF certificate. Solution: inject Jinja2 payload into profile name, trigger /generate_certificate, and read RCE output (lipsum.__globals__.os.popen) from the PDF text.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar