MIGRATION UCC CYBER STARS 3rd EDITION
Migration was one of the challenges in the web security challenges in the UCC cyberstars 3rd semi finals competition.
Thanks to UCC and Ug-CERT for the opportunity to learn and practice our cyber security skills in safe environments.
Lets get started on the challenge by reading the description.
On clicking the url it led me to a web page.
After visiting the URL the web page was asking for url. What could the url be??? Can we try http://google.com???
This probably show a common vulnerability called Server Side Request Forgery(SSRF). What could it be???
According to owasp top 10 an SSRF is flaw that occurs whenever a web application is fetching a remote resource without validating the user-supplied url.
If you are dealing with a web application that is vulnerable to this vulnerability its a best practice to start with local host IP address(127.0.0.1).
Lets try that.
On typing the local host it also displayed a message that said Access Denied! URL is not in white list. This basically means that there is a specific url that was whitelisted by the firewall and that urls we are typing are blacklisted.
Get Ronnie’s stories in your inbox
Join Medium for free to get updates from this writer.
Does that mean we should give up??? No We should dig to find the whitelisted URLs but yes earlier I had given up.
On using google to search about the payloads to bypass the firewall to exploit an SSRF I found many encoded urls that didnt work and they were displaying Access Denied for me until i found an ip (169.254.169.254). On testing it guess what??? It brought something different compared to the IPs I was using before.
This is promising since we are not getting the denied message anymore but we are missing the comp. What does that mean??? Are we missing something in our payload???
On doing more research I found the directories “/latest/meta-data/”. Lets add it on our payload and see what it gives us.
So we type the following in our input parameter.
http://169.254.169.254/latest/meta-data/
Upon clicking the fetch button looks like there is a directory “iam/” if we also add it to our payload to see what it gives us.
On entering the security-credentials path too we find a user “mock-role” and on adding it to the payload too guess what??? we get alot of information and bingooooo there is the flag too.
Happy hacking!!!!
Author: MAGEMBE RONALD
