> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/ssrf.md).

# SSRF

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekanpWkz3I31r_kpWq%2Fimage.png?alt=media\&token=fefc4c87-0829-4559-8506-678d0b351001)

## What is SSRF?

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-Mekb6tO7-dVK3Gcx_Cb%2Fimage.png?alt=media\&token=bed8bc6e-041d-4d29-a74a-3a1f8ce750d2)

## Cause of the Vulnerability

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekbZr6OQIdmdMGEi2b%2Fimage.png?alt=media\&token=819010e6-63a9-464c-a622-8a3020425a44)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekboLZyctlpagd66KX%2Fimage.png?alt=media\&token=c16c7afa-33bd-4fc0-b091-2185fb14089d)

## SSRF Payload

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-Mekc18iLpxi0HKFNuIl%2Fimage.png?alt=media\&token=606f6459-325f-474b-9f0e-81ef71e32441)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekcGQJbgIVkt-TEM0P%2Fimage.png?alt=media\&token=be68d28b-cee5-4222-ab4d-d045a96eb60e)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekcOtRpaAm0KEHaebY%2Fimage.png?alt=media\&token=21eac4ab-aa93-42af-921a-e4570adba3c2)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekcXv_zO26vinmkwD-%2Fimage.png?alt=media\&token=1ffc3f0f-eb2a-4c96-988f-ea8742c22d82)

## Exercise

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekciO-JKrXxVviZuSA%2Fimage.png?alt=media\&token=d2c4a848-a9b7-4fbc-ba4a-c9108eb3cb03)

Lets check the webpage

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekcvDeZ2T0F8nxSkjn%2Fimage.png?alt=media\&token=95cb4d07-9867-404b-92c0-7286ec737bab)

After doing a number of check, we can write a simple bash script that will give us the answer.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekdncdYt2JjDJjZ5fm%2Fimage.png?alt=media\&token=9f5c9a51-c5af-4c78-bace-81046da44736)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekipSW2ouhIucj5mF4%2Fimage.png?alt=media\&token=0c7f18f6-fd86-4109-9b64-cdede5e2e060)

After a while, it shows that 5 ports are open

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-Mekiw42dqUDjhnSn7lc%2Fimage.png?alt=media\&token=b2b59f9a-9a01-41e8-8e91-788b8b221492)

We can find out how many users there are by looking at the /etc/passwd file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekjFyrHkq6hFOWdwpA%2Fimage.png?alt=media\&token=f690e15d-3e7c-423e-a257-82dc9e64317b)

Lets go to the source code

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekjSymzGGeLeDDv5Oc%2Fimage.png?alt=media\&token=c32e4858-e2de-4449-8040-a4f07ac10591)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MekaiYM7UmfcIX1dPn1%2F-MekjXTkvkryXl8WgND9%2Fimage.png?alt=media\&token=88c5bb2f-80ec-4333-9d0a-1a072ec59c02)