HTB BlockSynergy Complete Writeup - Blockchain PoW Mining, SSRF 0.0.0.0 Bypass, URL Userinfo Command Injection, Smart Contract Path Traversal and TOCTOU SUID Race to Root
BlockSynergy is a HackTheBox Insane Linux machine running a blockchain themed Flask application on Werkzeug. The attack chain starts with a public mining API whose proof of work scheme (SHA-256 with a 00000 difficulty prefix) can be reimplemented offline to earn coins, unlocking VIP node registration. The VIP node tester fetches registered URLs server side, and the internal address filter can be bypassed with 0.0.0.0, exposing a localhost only admin panel. The admin ping handler passes URL userinfo data to a shell, so http://x;COMMAND;@0.0.0.0:8080/ yields RCE as walter, with commands hex encoded to survive the URL parser. Privilege escalation to hank abuses a path traversal in a debug smart contract logging engine on 127.0.0.1:5000, appending an SSH public key to authorized_keys. As hank (member of developers), a process watcher captures hardcoded FTP credentials from a root backup cron job. The final escalation is a TOCTOU race against a root restore daemon that downloads a backup archive, verifies its SHA-256, and extracts it with tar as root into /: an inotify watcher atomically swaps a SUID root bash archive into place between verification and extraction, and /opt/blocksynergy/.diag -p drops a root shell for the root flag.
Aug 30, 2026