🐀🐀
0 pts earned
Blacksite Reports
🧩 BlacksiteWebapp
🖧 AD Network — BlacksiteWebapp
The report generation endpoint passes user input directly into Jinja2 render_template_string(). Server-side template injection gives RCE. cap_setuid on python3 makes root trivial.
🩸 First user blood: davidkarpinski1
🩸 First root blood: davidkarpinski1
Part of the BlacksiteWebapp set — it is not listed on the main challenges page, but its ports are open to you. Connect straight to the target IP and ports below; no pivot needed.
Target IP
Log in to reveal
User Flag
Pending
Root Flag
Pending
