Extract

Extract

🚀 I think this is my second hard challenge. It was a good challenge for me.

🔍 As usual, I started with an nmap scan: This is the only open port:

💡 I checked the source code while Feroxbuster was running:

🕵️ As you can see, it sends a GET request to this URL with a PDF file:

http://10.81.170.31/preview.php?url=http://cvssm1/pdf/dummy.pdf

💻 I checked what kind of filters were in place and if we could access other URLs: I started a Python HTTP server on my local machine and checked. It turned out it sends a GET request to any URL:

📌 I put that aside for a moment. As you can see, there is a management system: We cannot access it directly, so let’s try requesting it via the preview URL:

http://10.81.170.31/preview.php?url=http://10.81.170.31/management/

🔑 It fails directly, but if we change the target host to localhost (127.0.0.1), we can access it because the application makes the request from its own IP address:

http://10.81.170.31/preview.php?url=http://127.0.0.1/management/