Dark Side 108: Intro to SSRF — Server-Side Request Forgery
By: Katlyn Gallo
Tags: Cybersecurity, Exploit, Vulnerability, Dark Side, Web Application Security

Dark Side 108: Intro to SSRF — Server-Side Request Forgery

lvcriminaldenfense.com

Today’s challenge demonstrated a Server-Side Request Forgery attack. As it sounds, this attack tricks a website into letting a user into the backend server supporting a public facing web application. These vulnerabilities usually exist as a result of improper error handling, meaning a malicious user sends a request to access resources that aren’t publicly available, and the website serves up that data not knowing it shouldn’t.

Let’s dive into this challenge to better understand how this works.

Here’s the scenario:

Santa has released a web app that lets the children of the world check whether they are currently on the naughty or nice list. Unfortunately, the elf who coded it exposed more things than she thought. Can you access the list administration and ensure that every child gets a present from Santa this year?

After deploying the web server, I began by browsing to the IP in a web browser and sure enough, our Naughty and Nice List loaded. To test it out, I typed in a random name and hit “Search”.

The name I searched, Sarah, was on the Nice list. In order to begin planning our SSRF attack, I had to review the URL of the search results. To do so, I was instructed to decode the URL using CyberChef. CyberChef is a great tool that can be used for encoding and decoding various strings, as well as encryption.

By looking at the below decoded URL, we can see that the long, seemingly random string has been decoded to a much cleaner version of the URL. The search function on the main page of the application is simply connecting to a backend server at “list.hohoho” over port 8080.

image by author

So how can we use this to our advantage? Well, we know “list.hohoho” isn’t a legitimate external site. It’s most likely an internal server that we can attempt to gain administrative access to.

One way we can start to learn more about this server is to enumerate some common ports.

The next step in this challenge was to test the server’s response when we try to connect over ports 80 and 22, or HTTP and SSH.

Upon trying to browse to “list.hohoho” over port 80, we get “Failed to connect to list.hohoho port 80: Connection refused”.

But what about port 22?

image by author

“Recv failure: Connection reset by peer”

Hmm, that error message is a bit different than the one we got when we tested port 80. This “connection reset” suggests port 22 is open, but of course connecting to port 22 via the internet won’t work.

Another way we can try to access the local server is by using “localhost”.

Most applications have checks in place to reject attempts at connecting directly to localhost like this:

http://10.10.105.126/?proxy=http%3A%2F%2Flocalhost

image by author

A way to bypass this is by tricking the server into thinking we’re browsing to “list.hohoho”, when really, we’re attempting to connect to the local host.

This challenge had us try to bypass the localhost check by browsing to the following URL:

http://10.10.105.126/?proxy=http%3A%2F%2Flist.hohoho.localtest.me

localtest.me is one of the many domains that already exist resolving to 127.0.0.1, also known as localhost or loopback address.

For more information on localtest.me, check out their Read Me webpage.

So what do we discover upon browsing to list.hohoho.localtest.me? A note from Elf McSkidy! Looks like we stumbled upon Santa’s password too.

Now all we need to do is guess the username. I don’t want to give away all the answers, so I’ll let you discover the username for yourself, but upon logging in, it looks like we’ve successfully exploited this website!

Do we click on the big button that reads DELETE NAUGHTY LIST? Well of course. The whole goal of this challenge is to make sure everyone gets presents, which is exactly what will happen if no one’s on the naughty list!

Flag captured, task accomplished, and everyone gets presents!

Try the challenge out for yourself here: