Platform: Hack Smarter
Box: Casino
Difficulty: Medium
Author: thehuskyhacker
Casino is a Hack Smarter lab themed around a resort’s guest WiFi portal — “Hack Smarter World.” The attack chain starts with an unauthenticated API endpoint that leaks guest information, which lets us log in to the portal. From there we find a Server-Side Template Injection (SSTI) in a profile field that gives us RCE as www-data. Pivoting through two local users via credential reuse in bash history and a leaked root password in a provisioning log gets us to root.
Starting with a full service scan:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.18
80/tcp open http Werkzeug httpd 3.1.8 (Python 3.10.18)
2222/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u7
Two SSH services — port 22 on the host and port 2222 likely a container — plus a Python/Werkzeug web app on 80. The HTTP title says “Hack Smarter World - Guest WiFi & Portal” and redirects to /login.
Confirms Bootstrap frontend, Python 3.10.18 backend running behind Werkzeug 3.1.8.
Ran both dirsearch and feroxbuster:
200 /login
302 /logout => /login
302 /profile => /login
302 /dashboard => /login
200 /static/css/style.css
200 /static/js/app.min.js