Part 5: Hacking Web Apps (Verbose - Hack Smarter)

This video completes the Verbose lab on HackSmarter by turning confirmed Jinja2 SSTI in uploaded image metadata into root-level RCE, then—after extensive troubleshooting—obtaining a stable root reverse shell via busybox netcat 1:08.

Key Takeaways:
• Building on the previous part, SSTI was confirmed in logo upload metadata, with Jinja2 identified as the backend templating engine 0:46
• A standard Jinja2 RCE payload (importing the OS library and using popen) was injected via exiftool into boat.png's metadata, yielding full RCE as root on the first try 2:54
• The app runs as root—a poor practice the presenter notes is surprisingly common on internal engagements—and the root flag was read by swapping the payload's command from id to cat 5:03
• Getting a stable reverse shell proved hard: plain netcat failed, a wget-piped-bash shell hit errors (likely Dash vs. Bash issues), and attempts to write files or inject SSH keys into authorized_keys all failed 7:47
• The solution came from ZeroX Bob's walkthrough: using busybox netcat instead of standard netcat, which successfully delivered a root reverse shell 23:10
• The presenter emphasizes that consulting walkthroughs isn't failure—you only fail a lab if you don't learn something new—and recommends reviewing others' approaches after each lab 25:06

The lab was technically solved within minutes via SSTI to root RCE, but the extended troubleshooting for a stable shell highlights that experimentation and persistence are core parts of ethical hacking.

Sources:

• 0:46 SSTI in image metadata; Jinja2 identified
• 1:08 Goal: move from SSTI to RCE
• 2:54 Jinja2 RCE payload via exiftool gives root execution
• 5:03 Reading the root flag; lab technically solved
• 7:47 Failed reverse shell attempts: netcat, wget piping
• 23:10 Busybox netcat payload succeeds; root shell obtained
• 25:06 Lesson on using walkthroughs as learning tools