Official PDFy Discussion

HTB Content Challenges
1

Official discussion thread for PDFy. Please do not post any spoilers or big hints.

2 Likes
2

Any hint?

3

I really hate blackbox stuff

1 Like
4

i am trying for hours to make the ssrf working but no way :frowning:

edit : use ngrok :slight_smile:

1 Like
6

Hello,

Iā€™m reaching out for help because Iā€™m completely stuck after spending 8 hours on this.

Iā€™ve tried everything that came to mind and searched through countless internet pages.

Iā€™ve tried XSS vulnerabilities with no results, Iā€™ve tried sending malicious code through the URL without success.
The only thing Iā€™ve ā€œsucceededā€ in is putting a PHP file in the URL and having this code executed only on my local machine, not on the challenge server.

Iā€™m not asking for the answer, just some assistance or a possible direction to follow if possible.

Thanks in advance.

7

need a hint please

8

Ok, i have found XSS but now i donā€™t know how to go on. Any hint please?

9

Try if you can figure out how the PDF is generated, that should put you in the right direction.

10

Do some research on the internet.

11

website use wkhtmltopdf. I did some resarch. Maybe this help you wkhtmltopdf SSRF | Exploit Notes wkhtmltopdf File Inclusion Vulnerability - Virtue Security if you find anything please reply

1 Like
12

Solved? Man I have been stuck on this for about like 3 days. Nothing positive yet. Donā€™t know where I am lacking behind. Found XSS and even I am able to interact with a my locally hosted server. But donā€™t know what to do. Tried the ā€œfile://ā€ wrapper but that too fails. Just totally messed up. Need help man need some help.

13

Did you solve? I went on like an insane research path but still couldnā€™t land into anything good. Found how this wkhtmā€¦ utility works i.e. the syntax but still struggling to find the right path. Help mate please help.

14

Donā€™t dig deep. When you google wkhtmltopdf lfi, almost the first 3 search result will be enough to solve this challenge. This is an easy challenge. Donā€™t assume things if you find a possible way. Just follow what PoC suggests.

15

You are very close to the solution. Just figure out the weakness there.

1 Like
16

The iframe window opens but I canā€™t receive anything. What am I missing? Do I need to complicate the payload?
console says Not allowed to load local resource

17

The solution for this challenge is easier than the PoC on the site you shared. How can you make it simpler, think about that

1 Like
18

Any hint plz ?

19

solved!

the solution was in the PoCsā€¦ but there is a tricky part.
iā€™ve solved cracking the PoCs in two. each part with one step of the PoC.
part1: webhook.site . part2: hosted a php server in my public ip address (easier to send headers :smiley: ) .

1 Like
20

Pwned! I figured out where I was going wrong and why it took so long. If anyone using ngrok, make sure to use ā€˜tcpā€™ option rather than ā€˜httpā€™ to avoid the confirmation page that was getting in middle of the redirection. Hope this will lead someone else frustrated towards the final door. Best of Luck!

2 Likes
21

i tried to get /etc/passwd, but i kept receiving empty PDFs, any hints please ? Thanks