$#ssti

2 writeups

TryHackMeMedium05 Aug 2026

Hacker Holidays — Day 10: The Hollow Shell

A zip-slip flaw in a staff upload feature lets an extracted archive entry escape its per-upload folder and overwrite the app's own live Jinja template, turning a simple file upload into persistent SSTI/RCE.

#hacker-holidays
#zip-slip
#ssti
#file-upload

Grey hooded mascot holding a laptop with a wifi signal icon

TryHackMeMedium02 Aug 2026

Hacker Holidays — Day 7: Do Not Disturb

A NoSQL injection auth bypass leads to an EJS SSTI RCE, then an exposed Node --inspect debugger and disk-group membership chain all the way to a raw block-device read of root.txt.

#hacker-holidays
#nosql-injection
#ssti
#privesc