> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/hackthebox/challenges/web/easy/templated.md).

# Templated

Templated HackTheBox Web Challenge Writeup by Thamizhiniyan C S

## Overview

Greetings everyone,

In this write-up, we will tackle Templated from HackTheBox.

Challenge link: [Templated](https://app.hackthebox.com/challenges/templated)

Difficulty Level: Easy

Let's Begin 🙌

First start the instance and navigate to the given IP address.

***

## Information Gathering - Website

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FfBcBp821iGnCBB4SXABA%2FUntitled.png?alt=media&amp;token=431a9899-06a1-4715-965a-85c4e154315e" alt=""><figcaption></figcaption></figure>

We got the response back as site under construction, with a message `Proudly powered by Flask/Jinja2`. From this we can devise that the server is made up of Flask and it uses `Jinja2` template engine.

If we try to access a route which is not available, the server responds with a page not found error.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FyKfJoJ5upNI118TSnP77%2FUntitled%201.png?alt=media&amp;token=8f7840ca-0d13-4bb2-a8b1-3ecc2861c0ad" alt=""><figcaption></figcaption></figure>

If we take a look at the error, we can see that the error has reflected the route which we tried to access. This might be vulnerable to template injection.

***

## Testing Template Injection

So I looked out for Jinja2 payloads and found the following website:&#x20;

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md>" %}

I tried the Detection payload from the above website to check whether it is vulnerable to template injection.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FFDuU82IKwPvgYQOLGYTc%2FUntitled%202.png?alt=media&amp;token=c84dfbc9-646b-497d-bff2-925a698c8273" alt=""><figcaption></figcaption></figure>

I used Postman to send requests because it will be easy to modify and send the request each time.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FE6fbaAidkcaPt6P5A2II%2FUntitled%203.png?alt=media&amp;token=a1ed8852-aa4a-4398-b057-fa2193fa8b73" alt=""><figcaption></figcaption></figure>

As mentioned in the Detection section, the server thrown a Error. So this site is vulnerable to template injection.

***

## Generating the Payload and Exploiting the Vulnerability

Next I tried some random payloads from the site and found the following which worked:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FNYd8oC3lCmJYbOrlD494%2FUntitled%204.png?alt=media&amp;token=0f6d7119-753d-4682-b69e-9ff6de996313" alt=""><figcaption></figcaption></figure>

When I tried one of the above mentioned payloads, It worked:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fk9uoGiRbcM7CV1EMvoCn%2FUntitled%205.png?alt=media&amp;token=c91d7481-67a7-411e-9e1b-ff7ef651166b" alt=""><figcaption></figcaption></figure>

Next again I tried some of the payloads in the above section and found the following payload to be working:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2F8gcGpWyimx0i1UyMcWQD%2FUntitled%206.png?alt=media&amp;token=01fdf4bc-67d6-4e6b-b824-d2ee72d5882a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FE0WyQpCELCduMBevnSkm%2FUntitled%207.png?alt=media&amp;token=ede18a8b-8bcb-4452-b3d0-e3aacd52ffb9" alt=""><figcaption></figcaption></figure>

Okay, now we are able to execute commands and get the output for those commands. So I modified the request to list the contents of the directory:

**Modified Payload:** `{{ self.**init**.**globals**.**builtins**.**import**('os').popen('ls').read() }}`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FvcNTnFd12BSPlK3pHzbU%2FUntitled%208.png?alt=media&amp;token=247faaec-1738-44f7-a631-2a9dbf2e646f" alt=""><figcaption></figcaption></figure>

If we take a look at the response we can see the flag file `flag.txt`. This time I modified the payload to view the contents of the `flag.txt` file:

**Modified Payload:** `{{ self.**init**.**globals**.**builtins**.**import**('os').popen('cat flag.txt').read() }}`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FNp7wfmhYXF04J7jhjQgE%2FUntitled%209.png?alt=media&amp;token=43e76000-c535-4aa3-9912-c97dca7c609b" alt=""><figcaption></figcaption></figure>

And we got the flag…….