🗒️PDFy

https://app.hackthebox.com/challenges/PDFy

By intercepting the request we can changing the url we can see wkhtmltopdf is used to create pdfs

We can use this CVE to get the flag from /etc/passwd

Logo[Security 9.8 CRITICAL] CVE-2022-35583 - wkhtmlTOpdf 0.12.6 is vulnerable to SSRF (Server-side request forgery) · Issue #5249 · wkhtmltopdf/wkhtmltopdfGitHub

First we are starting the php-server:

We need an account ngrok and must enter a valid CC("We require a valid card as a way to combat abuse and keep the internet a safe place")

We are coyping the tcp and change the protocol to http. Entering both in our pdy-file and send it to the server.

Last updated