HTB Takeoff Writeup: Go SSTI and n8n Privilege Escalation
Hack The Box Takeoff is an active Linux machine featuring Go SSTI in an airline ticket workflow, an n8n API attack surface, and container mount misconfiguration. This protected writeup page introduces its topics without publishing the solution.
Due to Hack The Box policies this walkthrough is not publicly served until Takeoff retires. See the official HTB writeup guidelines.
Machine profile
- Platform
- Hack The Box
- Machine
- Takeoff
- Difficulty
- Medium
- Published
- Status
- active
Takeoff is an active Linux machine built around an airline ticketing workflow. The public service exposes a document generation path that is worth examining closely, especially how it handles passenger supplied notes. Other topics include local service discovery, n8n workflow APIs, and container mount boundaries.
Follow the trail from the booking interface into its document and check-in features. The complete walkthrough remains private while the machine is active.
What this machine covers
Software, services & tooling
Techniques & attack classes
What the finished writeup contains
When Takeoff retires, the complete walkthrough publishes here unchanged — every command, output and screenshot from the actual box, in the order it was solved.
- Reconnaissance Port scanning, service fingerprinting and attack-surface mapping
- Initial foothold The first authenticated or unauthenticated execution path
- Enumeration Deeper inspection of the exposed services and their configuration
- Exploitation Chaining the weaknesses found into a working exploit
- Credential recovery Secrets, keys and hashes, and how they were obtained
- Privilege escalation The route from the foothold account to a root shell
- Flags User and root flag capture
10 views on this machine so far — demand is tracked, and the walkthrough publishes the moment the box retires.
Why is this walkthrough protected right now?
No active-machine solution, flag, credential, exploit chain or private asset appears on this public page. Only the machine's profile, the topics it covers and a description of what the finished writeup will contain are published while the box is live.
Topics: Medium Difficulty, Go Template Injection, Go SSTI, Server-Side Template Injection, SSTI to RCE, Environment Variable Disclosure, HMAC-SHA256, Golang gob, QR Code Forgery, Ticket Validation, n8n, n8n API, Container Security, Container Mount Misconfiguration, Linux Privilege Escalation, Root Command Execution, Rustscan, Nmap
Comments
No comments yet — be the first to share your thoughts.