Server-side attacks / Exploiting SSRF section about Gopherus

HTB Content Academy
1

The instruction: Exploit the SSRF vulnerability to identify an additional endpoint. Access that endpoint to obtain the flag.

I’ve enumerated and found port 3306 running on 127.0.0.1
I tried to use Gopherus --exploit mysql and get gopher://xxxxxxx link.
But when put the link to Burp, I can only get 500 internal server.

Anyone still remember?

Screenshot_20240802_230415
Screenshot_20240802_2304151605×595 52.7 KB

1 Like
2

for this question try looking for directories within the http://dateserver.htb/ (this link is the one that is initially used in the post data) then accessing one of the pages you find, should yield the flag. I didn’t need to use gopher for this question. I did have an issue where using ffuf or zaps fuzz did DoS which was odd and honestly for that I just reset the server and manually tried the first few entries of the file used in the section for fuzzing.

4

any other clues you can give on this? have enumerated with this command but could not find any interesting directories:

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://10.129.211.9/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "dateserver=http://dateserver.htb/FUZZ.php&date=2024-01-01"

Yielded /javascript from this though
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://10.129.211.9/index.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "dateserver=http://dateserver.htb/FUZZ&date=2024-01-01"

5

I don’t recall exactly but try fuzzing the javascript directory you have found

6

For others stuck on this, there is no need to venture out of port enumeration for this section. Find the correct port and “browse” it.

7

Hi Paperthing,
I have found the port, but who I can browse it? Metasploit?

With the Gopher I receive an error because use python2.

┌─[eu-academy-2]─[10.10.xx.yyy]─[htb-ac-xxx]@htb-lp]─[~/Gopherus]
└──╼ [★]$ python3 gopherus.py
  File "/home/htb-ac-xxx/Gopherus/gopherus.py", line 28
    print colors.green + """
    ^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?
8

Try to use Burpsuite Repeater with the port you found (assuming you are referring to the Question for “Identifying SSRF”)

9

I solved it but I didn’t follow the normal path. I used an LFI but reading the old message, I also managed to find the js files and the base64 encoded strings but not to assemble them correctly