HackTheBox Writeups

45 writeups 22× Easy 15× Medium 5× Hard 3× Insane

Join CTF Team

Difficulty

Tag

Access

Sort

Showing 1–2 of 2

Medium Linux Locked

Exploit a Flask SSTI vulnerability in a developer hub app to gain RCE, then escalate privileges via misconfigured sudo or SUID binaries on Linux.

Joshua • May 30, 2026 • 3 min read

Medium Linux Locked

SSTI via resume upload, exploiting a Flask/Jinja2 template injection in a smart hiring app to achieve RCE and capture the flag.

ssti jinja2 flask rce +2

Benslates • May 16, 2026 • 1 min read

Other platforms

Proving Grounds 16 TryHackMe 2 All writeups