SSRF » THOVITI SIDDHARTH

SSRF

March 9, 2024

AppSanity – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ASPX, chisel, DLL Hijacking, dnSpy, ffuf, HackTheBox, HTB, JWT, metasploit, meterpreter, Session Hijacking, SSRF, Windows 0

Machine Name: AppSanity
IP: 10.10.11.238
Difficulty: Hard

Summary

AppSanity is a hard difficulty machine that starts with subdomain enumeration and manipulation of the registration process. Utilizing JWT for session hijacking, the journey led to SSRF and finally gaining a user shell through bypassing file-type restrictions. For privilege escalation, analysis of the ExaminationManagement.dll revealed a registry key, providing user credentials. Reverse port forwarding via Chisel unveiled the service on port 100, enabling exploitation of DLL hijacking to escalate privileges and eventually access administrator shell and root flag.

January 6, 2024

Sau – HackTheBox

Thoviti Siddharth HackTheBox, Infosec CVE-2023-27163, GTFObins, HackTheBox, HTB, Linux Box, Mailtrail, Request Basket, SSRF, sudo -l, systemctl 0

Machine Name: Sau
IP: 10.10.11.224
Difficulty: Easy

Summary

Sau is an easy machine that starts with discovering a port that runs Request Basket. The application is vulnerable to an SSRF which led to discovering the Mailtrail application running on port 8338 was being forwarded. The Mailtrail application was vulnerable to an unauthenticated command injection. The RCE was obtained by chaining the SSRF to redirect us to the vulnerable “/login” page where the payload was injected. Privilege Escalation involved abusing sudo right to run systemctl as root.