TryHackMe

Surfer

[Room: https://tryhackme.com/room/surfer]
[Level: Medium]

This room is mostly about SSRF. There was a login panel that was not properly configured.

Get Vin’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I started with a portscan on the target, followed by a nmap service scan on the open ports.

port scanning

service version detection

I found two routes, ‘/login.php’ and ‘/backup/chat.txt’(I forgot to check this one). I tried common credentials (in this case, ‘admin’ as both username ans password) against the login panel and successfully got in.

/login

admin panel

On the right side, I found a new path ‘/internal/admin.php’.

internal webpage

I intercepted the traffic and messed with the ‘Referer’ header to see if the server somehow processed it. It did not seem like it.

internal webpage request interception using burp

There was another path that shows the report (At the bottom).

report

I intercepted the traffic for this route as well and found something interesting.

report request interception

In the body section, there is a url parameter. I thought that the server was sending requests to the given url and generating a report based on it.
So, I tinkered with the url parameter by changing its value to the path from before (‘/internal/admin.php’).

ssrf test

(NOTE: The ip has to be 127.0.0.1 or equivalent because the server has to send request to itself for this to work)

I checked the response in my browser (In request tab, right-click > Show reponse in browser > Copy) and found the flag.

Question 1: Uncover the flag on the hidden application page.

flag

Enjoy :)