# Takeoff Writeup - HackTheBox

> SSRF and SSTI exploitation chain on a Linux web target, leveraging command injection to achieve remote code execution and capture the flag.

- **URL:** https://hackindex.io/writeups/takeoff
- **Platform:** HackTheBox
- **Difficulty:** Hard
- **Operating system:** Linux
- **Tags:** web, ssrf, linux, command-injection, server-side-template-injection
- **Access:** Partly password protected
- **Read time:** 4 min read
- **Published:** 2026-09-22
- **Updated:** 2026-10-31

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

Domain: **takeoff.htb**

## **1. Recon**

```bash
addhost $TARGET_IP takeoff.htb
```

### **Port Scan**

```bash
nmap -sC -sV -p- 10.129.96.28
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 10.0p2 Debian
# 80/tcp open  http    nginx → Go Echo backend
```

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.