🐀🐀
0 pts earned
Blacksite Reports
🧩 BlacksiteWebapp
🖧 AD Network — BlacksiteWebapp
The report generation endpoint passes user input directly into Jinja2 render_template_string(). Server-side template injection gives RCE. cap_setuid on python3 makes root trivial.
🩸 First user blood: davidkarpinski1
🩸 First root blood: davidkarpinski1
Internal machine — reachable only by pivoting from the entry host. It is not directly scannable from the internet, so external scans return filtered. This is by design, not an outage.
Target IP
Log in to reveal
User Flag
Pending
Root Flag
Pending
