Click Htb Writeup Upd May 2026

Wait for cron (or run backup manually if possible), then:

tar -czf /backups/click_backup.tar.gz /home/click/* Wildcard in tar with --checkpoint and --checkpoint-action can be exploited. click htb writeup

/login /dashboard /forgot-password /test The /test endpoint is promising. Discovering SSTI The /test endpoint accepts a parameter ?name= . Submitting {{7*7}} returns 49 in the response → Server-Side Template Injection (Jinja2). Confirming Execution Payload: {{ config }} → Leaks Flask configuration, confirming Jinja2. Gaining RCE Jinja2 SSTI to RCE: Wait for cron (or run backup manually if

In /home/click :

Running it shows it creates a backup of /home/click to /backups/click_backup.tar.gz using tar with wildcard. The command likely is: click htb writeup

{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }} Response shows uid=1000(click) ... – command execution achieved. Payload (URL-encoded):