Ssrf

Overview Machine author: NoobHacker9999. IP: 10.10.10.x. Technique categories: SSRF, SSRF filter bypass, redirect-based SSRF, data exfiltration, Python pdb privesc. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 enumeration (nmap, gobuster dir + vhost) v "Upload from URL" on forge.htb -> SSRF v localhost blacklist -> bypass via a 301 redirect from your own server v access to admin.forge.htb (localhost only) -> exfil /announcements (FTP creds user:heightofsecurity123!, /upload supports ftp://) v SSRF + ftp:// scheme -> read /home/user/.ssh/id_rsa v SSH as user -> user.txt v sudo python3 /opt/remote-manage.py -> force an exception -> pdb.post_mortem -> root shell v root.txt Three concepts to take away: ...